Every story tagged Extortion, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
6 stories · open in the command center
A Canadian hacker pleaded guilty to participating in coordinated attacks on 165 organizations using Snowflake, stealing billions of sensitive records and extorting millions of dollars from victims including AT&T, Ticketmaster, and Neiman Marcus. This case demonstrates the critical vulnerability of cloud data warehouses to credential-based attacks and highlights the evolving threat landscape where attackers exploit inadequate access controls to compromise massive datasets. CIOs must recognize this as a watershed moment for cloud security strategy, signaling that traditional perimeter defenses are insufficient and that comprehensive identity governance, multi-factor authentication, and behavioral monitoring are now essential operational requirements.
Coordinated hacking groups are successfully targeting financial and investment firms through voice phishing—calling employees on personal devices while impersonating IT staff to steal credentials and sensitive data for extortion purposes. This campaign, tracked by Google across four identified groups (Falcon, Helix, Pink, and Redact) potentially operating under the umbrella UNC6671, has extracted approximately $10 million in cryptocurrency and demonstrates that basic social engineering remains highly effective against even sophisticated organizations, posing significant data breach and financial risk to enterprises across multiple sectors. For IT organizations, this highlights a critical vulnerability in employee authentication processes and the need for security controls that extend beyond traditional perimeter defenses to protect against targeted human-centric attacks.
Proofpoint's research reveals that over one-third of companies paying ransomware demands face repeat extortion attempts, fundamentally undermining the negotiation strategy many organizations employ during attacks. Hackers retain stolen data even after payment and employ multi-vector extortion tactics, making ransom payments a high-risk investment that funds criminal operations while providing no guarantee of data deletion or immunity from future attacks. This data validates long-standing government warnings and requires IT leaders to prioritize prevention, detection, and response capabilities over ransom payment strategies.
Education technology platform Instructure has suffered a second breach in which hackers defaced school login pages and are threatening to release stolen data from 231 million individuals across 9,000 schools unless a ransom is paid by May 12. This represents a critical supply chain vulnerability affecting thousands of educational institutions and demonstrates the persistent risk of ransomware extortion against widely-adopted SaaS platforms. IT leaders must immediately assess their exposure to Instructure/Canvas compromises and implement emergency incident response protocols to protect student and staff data.
The Anodot breach exposed over a dozen companies to extortion after hackers stole authentication tokens enabling unauthorized access to customers' cloud-stored data, demonstrating a critical supply chain security vulnerability where compromising a single software vendor can cascade into breaches of multiple enterprise customers. This incident underscores the elevated risk of targeting data integration and monitoring platforms that hold privileged access credentials across entire customer ecosystems. IT organizations must urgently reassess their third-party vendor security posture and implement stricter controls around credential management, particularly for SaaS platforms with broad data access permissions.
Cybercriminals stole 7.7 terabytes of sensitive LAPD data including personnel files, internal affairs investigations, and unredacted criminal complaints through a compromised third-party digital storage tool, exposing a critical vulnerability in law enforcement's third-party vendor management practices. This breach by the World Leaks extortion gang underscores the urgent need for IT organizations to implement comprehensive third-party risk management, data classification, and access controls, as sensitive government data is increasingly targeted by sophisticated ransomware groups operating across multiple industries. The incident demonstrates that even mission-critical public sector organizations remain vulnerable to supply chain compromises and highlights the strategic imperative for CIOs to audit and secure all external tools and integrations regardless of perceived isolation from core systems.