The IT Nerd

 It is being reported that the ransomware gang Qilin today claimed responsibility for a March 2025 cyber-attack against the Kuala Lumpur International Airport in Malaysia. The airport has not verified Qilin’s claim, but Qilin says it stole 2 TB of data from Kuala Lumpur International Airport in the attack.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Qilin is a ransomware group that began claiming responsibility for attacks on its website in late 2022. Also known as Agenda, Qilin is a Russia-based hacking group that mainly targets victims through phishing emails to spread its ransomware. It launched in August 2022 and runs a ransomware-as-a-service business in which affiliates pay to use Qilin’s malware to launch attacks and collect ransoms. Qilin has claimed responsibility for 60 confirmed ransomware attacks since 2022, 14 of which it claimed in 2025.”

“Ransomware attacks can lock down computer systems and steal confidential data. For transportation businesses, these attacks can cause cancellations, delays, missed bookings and payments, data loss, and other disruptions. Infected organizations must either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud.”

“In 2025, Comparitech researchers logged eight confirmed ransomware attacks against organizations in the transportation sector, plus another 123 unconfirmed claims that haven’t been acknowledged by the targeted organizations.”

It’s only a matter of time before a ransomware gang takes responsibility for an attack that takes down a major transport hub. When, not if that happens, that will be devasting. At the same time it will highlight that not enough is being done to stop these criminals from causing havoc.

Comparitech has reported that the ransomware gang Interlock today claimed the cyberattack on kidney dialysis company DaVita last week where 1.5 TB of data was stolen. 

In a blog post reporting this news, Rebecca Moody, Head of Data Research at Comparitech, wrote:

“Interlock first began adding victims to its data leak site in October 2024. As with most ransomware gangs today, it seeks a ransom payment for the decryption of systems and the deletion of stolen data.”

“Since October 2024, we’ve tracked 13 confirmed attacks via this group and a further 13 unconfirmed attacks that haven’t been acknowledged by the organizations in question.”

“2025 has already seen 17 confirmed attacks on US healthcare companies, as well as a further 80 unconfirmed.”

“As we are seeing with DaVita, ransomware attacks on healthcare companies have the potential for widespread disruption. Not only can patient care be affected when systems are encrypted, but these attacks often have ongoing consequences when data is stolen by hackers. In 2024 alone, nearly 25.7 million individual records were breached across 160 ransomware attacks on US healthcare providers.”

 James McQuiggan, Security Awareness Advocate at KnowBe4 had this comment:

“Sadly, it’s another ransomware case, another data leak. The mechanics haven’t changed much: initial access, privilege escalation, exfiltration, extortion. Rinse. Lather. Repeat. What’s still missing in many organizations is the alignment across people, processes, and technology. Cybercriminals rely on simple vectors like phishing or weak external access with unpatched systems or credential stuffing.”

“Cybercriminals will steal data before encrypting it, so preventative measures must include outbound traffic monitoring and to consider controls to limit data movement. Good backups help recovery but don’t neutralize extortion. Organizations need plans for data leaks, not just complete data loss. Cybersecurity teams need tested response plans for encryption and extortion; if not, you’re unprepared for an attack. Coordinate with legal, comms, IT, and incident response teams before it’s public.”

“Technology alone can’t solve the human risk aspect. Reduce risk by building a strong security culture where security habits are reinforced, measured, and modeled from the top. Ensure cybersecurity teams coordinate across executives, IT, compliance, legal, and communications to reduce the opportunity for a cybercriminal to have the upper hand.”

I am truly afraid that ransomware attacks are out of control at this point. This is scary as nobody is safe. This is not a good place to be in. Something needs to change on this front and fast.

Comparitech today released research looking at worldwide laws regarding SIM-card registration.

According to the report, the majority of national governments (over 160) require mandatory SIM-card registration. Users must register their real name and personal details to sign up for a phone service. Just over 35 countries also require biometrics, e.g., your fingerprints or a facial scan. More countries are in the process of adding biometric requirements, or they have some requirements but not for everyone (e.g., tourists only).

Key findings Include:

• 6 countries have enforced mandatory SIM-card registration or increased restrictions in the last few years– Brunei Darussalam, Burkina Faso, Cyprus, Lithuania, Maldives, and Serbia. Among these, Brunei Darussalam requests users re-register their SIMs, while Burkina Faso and the Maldives have placed limits on the number of SIM cards available to customers (two and ten per person, respectively).
• Cambodia and Thailand introduced a mandatory IMEI database, bringing the total number of countries with one of these to 24.
• Mauritius was the only country that retracted its SIM-card registration requirement. The Council of Ministers approved the decision on December 27, 2024, replacing the 2023 SIM registration rules with fresh 2024 regulations. Mobile operators must now delete all previously stored photos as well.
• In contrast, several countries introduced or strengthened their biometric identification measures, including Argentina, Eswatini (Swaziland), India, Laos, and Mauritania. Mozambique’s new requirements come into effect at the end of the year.
• What to watch: Russia is tightening its biometric registration measures. From the start of this year, any foreigners buying SIM cards in Russia will have to provide their biometrics.

The full research can be read here: https://www.comparitech.com/blog/vpn-privacy/sim-card-registration-laws/

Today, Comparitech reported two cyber stories. In one, an Alabama eye doctor has notified 131k people of a data breach compromising SSNs and medical information. And in the other, 114k people are now confirmed to have been impacted by a breach against a Wisconsin ambulance company, also having medical info and SSNs leaked. 

In the blog posts reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech,commented: 

“Comparitech researchers logged 16 confirmed ransomware attacks on US hospitals, clinics, and other care providers in 2025, compromising the personal and health data of about 470,000 people.”

“Ransomware attacks on US hospitals, clinics, and other care providers can cripple key systems and endanger the privacy and security of patients. Providers must pay a ransom or face extended downtime, data loss, and putting patients and staff at increased risk of fraud. Hospitals and clinics may have to resort to pen and paper, cancel certain appointments, and divert patients elsewhere until systems are restored.”

This is a prime example of healthcare organizations being soft targets for threat actors. This needs to change as the status quo is not sustainable. It truly isn’t.

Ransomware gang Qilin today claimed responsibility for a November 2024 cyber-attack against North Platte Natural Resources District in Nebraska. Although it didn’t disclose what data was compromised, it does recommend victims take precautions to protect their identities and SSNs from abuse. 

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote: 

“Qilin is a ransomware group that began claiming responsibility for attacks in late 2022. Also known as Agenda, Qilin is a Russia-based hacking group that mainly targets victims through phishing emails to spread its ransomware. It launched in August 2022 and runs a ransomware-as-a-service business in which affiliates pay to use Qilin’s malware to launch attacks and collect ransoms.”

“Qilin has claimed responsibility for 58 confirmed ransomware attacks since it began, 12 of which were against government entities. They include attacks on the city of West Haven, CT; the Palau Ministry of Health and Human Services; the Cleveland, OH Municipal Court; and the town of Bedford, MA.”

“In 2025 so far, Qilin has claimed 12 confirmed ransomware attacks, plus another 128 unconfirmed claims that haven’t been acknowledged by the targeted organizations. Comparitech logged 92 confirmed ransomware attacks against US government entities in 2024, and 14 in 2025.”

“Ransomware attacks on US government agencies and departments can both steal data and lock down computer systems. The attacker then demands a ransom to delete the stolen data and in exchange for a key to recover infected systems. If the target doesn’t pay, it could take weeks or even months to restore systems, and people whose data was stolen are put at greater risk of fraud. Ransomware can disrupt everything from communications to billing, payroll, and online services.”

Additionally, the researchers at Comparitech today released a report looking at all the confirmed and unconfirmed ransomware attacks of Q1 2025. I covered that in this story.

 Researchers at Comparitech have released a study looking at the impact of global ransomware attacks in Q1 2025.  

In this report, the researchers not only outline the number of attacks but also which sectors were most impacted, the average ransom paid globally, as well as the most prolific gangs in the quarter. 

Key findings include: 

• 2,190 ransomware attacks globally–1,000 more than in the same period of 2024 (1,172). Government organizations remain a key focus for hackers, and the manufacturing industry has also seen a huge uptick in attacks.
• Of the 2,190, 197 of them have been confirmed. While this is significantly lower than the number logged in Q1 of 2024 (373), many attacks aren’t confirmed until months after the event.
• Clop was the most prolific ransomware gang at 331 attacks, with RansomHub coming in at second place with 224. 

You can access the report here: https://www.comparitech.com/news/ransomware-roundup-q1-2025/

Have you ever wondered whether your (or your kids’)  screen time is above average? On Wednesday, Comparitech researchers will be publishing a study looking at the screen times of Americans compared to the rest of the world. The report also looks at the data of what kind of media people are using their screens for. 

Key findings include: 

• The average American spends almost 7 hours looking at a screen each day.
• Worldwide, the average user spends 2 hours and 52 minutes looking at their computer screens and 3 hours and 46 minutes looking at their mobiles.
• Americans are above average for their desktop screen consumption (3 hours and 18 minutes) but are just below average for their mobile consumption 3 hours and 22 minutes).
• Worldwide, the average person spends 2 hours and 21 minutes on social media each day. Americans consume less than this, averaging 2 hours and 9 minutes per day.

You can read the full research here.

Ransomware gang Cloak today claimed responsibility for a February 2025 cyber attack on the Attorney General of Virginia that prompted officials to shut down computer systems including email, VPN, internet access, and the AG’s website.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote: 

“Cloak is a ransomware group that first started claiming its cyberattacks in August 2023. Its malware both steals data and locks down computer systems, forcing victims to pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud.”

“Since it began, Cloak has claimed 13 confirmed ransomware attacks and 54 unconfirmed attacks that weren’t acknowledged by the targeted organizations. This attack on the Virginia attorney general is Cloak’s first confirmed attack in 2025. Ransomware attacks on US government agencies and departments can both steal data and lock down computer systems. The attacker then demands a ransom to delete the stolen data and in exchange for a key to recover infected systems. If the target doesn’t pay, it could take weeks or even months to restore systems, and people whose data was stolen are put at greater risk of fraud. Ransomware can disrupt everything from communications to billing, payroll, access to data and applications, and online services.”

“Comparitech researchers have logged 10 confirmed ransomware attacks on US government agencies in 2025 so far. Earlier this week, we confirmed Qilin’s attack on the Cleveland Municipal Court, which is still facing service disruptions three weeks later.”

Additionally, Comparitech recently released two studies looking into the impacts of ransomware attacks against US and worldwide government organizations.  Those are worth a read.

The Pennsylvania State Education Association this week confirmed it notified 517,487 people of a July 2024 data breach that compromised the following personal info including SSNs, passwords, routing numbers, credit/debit card numbers, and a lot more. 

Ransomware gang Rhysida claimed responsibility for the breach in September 2024 but the PSEA has not yet verified Rhysida’s claim.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote: 

“Rhysida is thought to have ties to the ransomware group Vice Society and first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected systems. Rhysida has claimed 82 confirmed ransomware attacks since it began, compromising more than 5.3 million records. Its average ransom demand is $1.08 million.”

“Ransomware attacks can both steal data and lock down computer systems. Organizations are then forced to either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud.”

“In 2024, Comparitech researchers logged 74 confirmed ransomware attacks on the US education sector, 72 of which were against schools and colleges. These attacks compromised more than 3 million records in total. Rhysida’s attack on the PSEA is the third-largest of the year by number of records affected. The largest such attacks in 2024 were on Texas Tech University Health Sciences Center (1.5 million) and Chicago Public Schools (700,000).”

“In 2025 so far, we are tracking nine confirmed ransomware attacks on US education, plus another 31 unconfirmed claims that haven’t been acknowledged by the targeted organizations.”

This is yet another bad situation where a threat actor is about to cause lots of misery to lots of people for many years to come. That illustrates why we all need to wrap our heads around protecting organizations from threat actors who mean to do harm to us all.

Comparitech researchers have released a study looking into the impact of ransomware attacks on government organizations in both the US and worldwide. 

Key findings from 2018 through 2024 include: 

• 1,133 confirmed worldwide ransomware attacks on government organizations with the highest figures recorded in 2023 (231) and 2024 (193)
• Nearly 8.4 million individual records were impacted in these worldwide attacks with 2024 seeing the highest figure so far (over 2.3 million)
• On average worldwide, attackers demanded $2.2 million in ransom. Based on that figure, we can estimate that around $2.9 billion in ransom has been demanded in total
• In the US, 5,285,785 individual records affected since 2018. 2024 saw the highest number of breached records, accounting for 44 percent (2,345,078) of the total
• In the US, the overall cost of these attacks is estimated at $1.09 billion.

You can view the worldwide study here.