Swiss train maker Stadler says it will not pay the Everest ransomware group's demand of 10 million Swiss francs, about 12.3 million dollars, after attackers stole technical files from a data exchange platform the company shares with one of its suppliers. "Stadler will not pay any ransom under any circumstances and is therefore not susceptible to extortion," the company said, and it has filed a criminal complaint with cantonal police in Thurgau. The manufacturer, which employs 18,000 people across eight production sites, says no personal data was taken, its vehicles in service are unaffected, and production continues without disruption.
The week's largest disclosure came from dental benefits administrator DentaQuest, a Sun Life U.S. unit, which began notifying more than 15 million people that attackers had access to its network between May 17 and May 20. Independent analysis puts the potential total as high as 23.4 million while the data review runs, a figure that would place the incident among the largest healthcare breaches on record. The exposed records include Social Security numbers, Medicaid and Medicare numbers, and diagnosis, treatment and billing information. The ShinyHunters group claims to hold 234 gigabytes of the company's data. DentaQuest engaged Kroll for the forensic review, started mailing letters on July 17, and is offering 24 months of credit and identity monitoring.
Professional services firms did not escape the month either. Ernst & Young notified regulators that a third-party platform supporting its tax work was accessed between March 28 and April 12, exposing names, Social Security numbers, account and card numbers, and tax preparation documents. "Support tickets submitted through the platform may include documents containing client tax information," the firm wrote in its notification letter. EY has not said how many clients are affected and reports no evidence of misuse so far.
For infrastructure operators, the notable technical development is ENCFORGE, a compiled Go ransomware that Sysdig researchers link to the JadePuffer threat operator. The strain enters through an unpatched Langflow flaw rated 9.8 out of 10 and encrypts "model weights, vector indexes, training datasets, and other AI infrastructure files." It struck a server the same operator had already compromised once before, through the same entry point. Extortion aimed at the model layer rather than the corporate file share turns training data and vector stores into assets that need the same backup discipline as any database.
There is now also a claimed author for the Fairlife production outage. The Anubis group listed Coca-Cola's dairy unit on its leak site with 1 terabyte of allegedly stolen data and a one-week deadline, telling the company its systems could be restored "within hours if it agrees to pay a ransom." The group has listed roughly 100 victims since late 2024 and ships a wiper mode alongside its encryptor.
Refusals like Stadler's come easiest when the stolen files are a supplier's technical documents rather than millions of patient records. Extortion pricing keeps following the sensitivity of the data, not the size of the company that lost it.
Leave a Reply