You may have seen that the University of Nottingham looks to be the first public victim of a new attack salvo by ShinyHunters.
We know this information is likely to cause concern for students and staff in our community and we apologise for any anxiety that this may cause.
Two groups have been impacted by the incident – current students, and alumni.
We are working to understand the data that has been accessed and have contacted those students and alumni affected directly. We are working closely with Action Fraud, the Information Commissioner’s Office, and other regulatory bodies.
We will remain in contact with those directly impacted and will continue to provide updates as the situation develops.
Targeted at Oracle’s Peoplesoft software, it seems like yet another example of supply chain attacks that can spread far and wide at little cost to the attacker.
Raluca Saceanu, CEO of Smarttech247, argues that the best strategy in the world is worthless if you can’t trust the whole chain:
“We’ve seen this type of supply chain attack before. It’s yet another example of how the best cybersecurity strategy in the world is worthless if partners up and down the chain aren’t working to the same standards. The Salesloft Drift breach — where a single compromised integration exposed over 700 organisations — proves exactly this point. Most attackers don’t discriminate: Nottingham is likely just the first tremor in a chain reaction of similarly affected businesses. In this environment, trust is critical. That’s only possible if all parties react swiftly and effectively to the threat; if communications are open and intelligence is shared immediately; and if security in every organisation has a human face that’s clearly following best practice and protocols. Without this, every part of the supply chain remains an island. And isolated victims are much easier to pick off.”
Lee Sult, Chief Investigator of Binalyze, points out how organisations can try and disrupt ShinyHunters’ apparent winning streak:
“If this is a supply chain attack, it’s another painful reminder that attackers love the path of least resistance. Why compromise a group of organisations separately when you can just do one and move laterally from there? It also makes it clear that nobody is exempt from being a target: if you use software, you’re in the firing line.
“Initial reports suggest the attackers have stolen financial data and even National Insurance numbers. That can be used for devastating follow-on attacks should the data be shared among cybercriminal groups for scams and phishing attempts.
“If it’s all true, ShinyHunters is on a winning streak against universities. This is the latest addition to their trail of havoc in the education sector. Just recently we had the ransomware attack and settlement on education software provider Canvas which impacted countless universities and people. They’re getting what they want from their attacks.
“That’s why thorough, fast investigations are crucial to know exactly what happened, showing victims the right steps have been taken to mitigate impact, and getting the word out to all who may have been affected.”
My advice is that ShinyHunters is a force to be taken seriously. Thus if you don’t take them seriously, you will pay the price.
Global Cyber Attacks Ease in May 2026, But Ransomware Surges 48% As Threats Reorganize
Posted in Commentary with tags Check Point on June 10, 2026 by itnerdIn May 2026, global cyber-attack activity eased from April’s sharp rebound, though the underlying trends offer little genuine comfort. Organizations experienced an average of 2,055 weekly cyber-attacks, a 2% increase year over year and a short term 7% decrease month over month. While the monthly decline may read as stabilization, ransomware activity surged to its highest year-over-year growth rate of 2026, and GenAI-driven data exposure risks continued to deepen across enterprise environments.
Check Point Research data consistently shows that short-term volume moderation does not equal reduced risk. Adversaries keep recalibrating timing, tools, and targeting, and May is a clear example of that pattern.
The Sectors That Kept Taking the Hits
Education absorbed more attacks than any other industry in May, averaging 4,641 weekly attacks per organization, with year-over-year volumes climbing another 7%. The combination of open networks, high student turnover, and chronically stretched security budgets continues to make schools and universities an almost frictionless target. Government sat in second place at 2,620 weekly attacks, and Telecommunications followed at 2,583, both essentially where they were a year ago.
Where in the World Attacks Hit Hardest
The more interesting movement happened further down the list. Agriculture surged 51% year over year to 2,243 weekly attacks. Hospitality, Travel and Recreation climbed 24% to 2,291, and Construction and Engineering rose 23% to 1,999. These are not sectors anyone would have highlighted as cyber attack hotbeds two years ago. The growing digitization of their operations, combined with the sheer availability of automated attack tooling, is changing that calculation fast.
Latin America held the top spot for another month running, with 3,149 weekly attacks per organization and a 13% year-over-year increase, as rapid digitalization continues to outpace security maturity across the region. Africa posted the most dramatic shift of any region, down 20% year over year, though volumes remain high enough to keep it firmly in the danger zone.
GenAI: The Risk That Grows With Every New Tool Adopted
Enterprise GenAI adoption showed no signs of slowing in May, and neither did the exposure risks that come with it.
Every new tool adopted without a governance framework in place is another surface where credentials, intellectual property, and internal data can slip out quietly. The exposure does not announce itself.
Ransomware Recorded Its Sharpest Year-Over-Year Jump of 2026
If May had a headline, this was it. 698 ransomware attacks were reported globally, a 48% increase on May 2025, when 472 incidents were recorded. The growth landed across every region: Asia up 119%, EMEA up 40%, the Americas up 39%. This was not concentrated pressure from one geography or one group. It was broad-based acceleration.
Business Services bore the sharpest end of it, accounting for 35% of all ransomware victims and recording a year-over-year increase of 359%, from 54 incidents to 248 in a single month. Consumer Goods and Services grew 223%, and Industrial Manufacturing climbed 50% from last year.
North America absorbed 49% of reported incidents globally, followed by Europe at 22% and APAC at 19%. The United States alone accounted for 43% of all reported ransomware victims, with Canada (5.6%), the United Kingdom (4.6%), Germany (4.0%), and Spain (3.0%) rounding out the top five.
Three Groups Led, But 61 Were Active
Ransomware in May was dominated at the top but remarkably spread out everywhere else. The top three groups accounted for 39% of reported attacks, all growing above the average rate. The other 61% was distributed across 58 additional active groups, a level of fragmentation that reflects just how industrialized and competitive the ransomware market has become.
Qilin led the field at 14% of published attacks, continuing its expansion following RansomHub’s retirement and the aggressive affiliate recruitment drive it has been running since early 2025. The Gentlemen secured second place at 10%, a striking position for a group that had zero recorded activity in May 2025. Founded in mid-2025 by a former Qilin affiliate, the group built its early reach around self-service access to approximately 14,000 pre-exploited FortiGate devices and has since grown into a top global threat in under a year. Their May 2026 operator communications announced a tactical evolution away from brute-force EDR-killing toward surgical userland evasion, suggesting a group investing seriously in longevity. DragonForce climbed to third at 8%, having risen five positions since January 2026 by absorbing displaced RansomHub affiliates and running a white-label model that lets affiliates operate entirely independent brands on shared infrastructure.
Reading May Correctly
The dip in overall volumes is real, but it is the wrong thing to anchor on. Underneath it, ransomware posted its biggest year-over-year leap of the year, new groups matured at a pace that has no real precedent in recent history, and sectors that once sat comfortably outside the crosshairs are now absorbing thousands of incidents per month. The threat landscape is not pausing. It is reorganizing. A prevention-first, AI-powered security strategy across cloud, network, endpoint, and user environments is not just best practice in that context. It is the only realistic response to a landscape that adapts faster than reactive models can follow.
Leave a comment »