Recent Ransomware Attacks in 2024

After several notorious ransomware gangs were knocked out by law enforcement in 2023, ransomware attacks are on the rise again and soaring to all-time highs in 2024. Many gangs quickly reorganized and reformed, with leaders launching new platforms and expanding their web of bad actors. 

Ransomware attacks are bigger and bolder than ever this year, but even as attackers focus on new targets, small- and medium-sized enterprises (SMEs) remain under threat. With security breaches and ransom prices surging, it’s critical to stay on top of the latest attack tactics, gangs, and news. Let’s see who’s behind the most damaging ransomware attacks this year, and how you can protect your network, customers, and co-workers. 

Recent Ransomware Attacks In 2024

This year ransomware is on pace to cause over $40 billion in losses for organizations in the U.S. Ransoms, lost productivity, and system outages all factor in the equation. And large-scale breaches involving ransomware are not a phenomenon of 2024 at all. But even worse, people’s lives are increasingly put at risk by malicious attackers. These are some of the most alarming attacks of 2024.

September 2024

NHS London: Qilin ransom gang unleashed an attack that compromised the data of almost 1 million National Heathcare System patients in London hospitals. The attackers published personal information about patients with sensitive medical conditions like cancer and sexually transmitted diseases.

Stillwater Mining Company: In September, Stillwater company officials discovered the personal information of over 7,000 employees had been stolen using RansomHub RaaS (Ransomware as a Service). The attack first happened over the summer, but it took Stillwater months to catch on to the breach.

Kawasaki Motors Europe: RansomHub was also behind a major attack on Kawasaki’s European offices. Kawasaki swiftly shut its servers down to isolate the issue and perform recovery operations. RansomHub claims to have stolen almost 500 GB of data.

August 2024

City of Columbus, OH: Rhysida ransom group stole a massive 3TB of data from the City of Columbus, including sensitive employee records and data. After the city refused to meet Rhysida’s ransom price all the data was dumped onto the dark web.

Sumter County, FL Sheriff: Rhysida hit another government target, breaching the Sheriff’s Office systems and potentially compromising 150,000 citizens. Passports, SSNs, and other data was stolen. Rhysida demanded a payment of 7 bitcoin (worth almost half a million dollars).

Keytronic: Electronics manufacturing firm Keytronics reported losing over $17 million due to a ransomware attack by Black Basta, that disrupted production and office operations at its facilities in the U.S. and Mexico.

July 2024

Disney: NullBulge Group stole 1TB of data from Disney’s internal Slack platform and leaked it online. The breach included unreleased Disney projects, concepts, artwork, and code. The hackers asserted they were acting in the name of “artists’ rights.”

AT&T: Hacker group ShinyHunters stole metadata from all call logs and texts made by AT&T customers over a six-month period in 2022.

Rite Aid Pharmacy: Over 2.2 million patients were compromised by RansomHub attackers that posed as Rite Aid employees to steal their data. RansomHub threatened to leak personal information, ID numbers, and driver’s license information obtained from Rite Aid. 

June 2024

Panera Bread: An attack by an unknown group interrupted service on Panera’s website, app, phone systems, and POS systems. Thousands of employee social security numbers and other personal information was also stolen in a major data breach. Internal sources indicate Panera succumbed to the attackers’ demands, paying an undisclosed ransom.

Pandabuy: Giant Chinese shopping platform Pandabuy paid a ransom to prevent stolen customer data from being leaked — but then the hackers immediately demanded another ransom. The ongoing conflict resulted in 3 million rows of customer data being leaked onto BreachForums.

Cleveland, OH: An unknown hacking group forced Cleveland City Hall to temporarily shut down due to a ransomware attack that debilitated city computer systems.

CDK Global: BlackSuit ransomware caused a major IT outage that wreaked havoc on thousands of car dealerships in North America. CDK struggled to restore services to the dealers effectively or in a timely manner, forcing them to pay the ransom so auto dealers could get back online.

May 2024

Wichita, KS: Several government services were shut down to prevent a malware attack from spreading across its entire network. LockBit was responsible for the attack that disrupted payment systems and brought flight operations to a halt at the Wichita airport.

Ascension Health: An “honest mistake” led to a disruption of clinical operations at one of the largest Catholic health providers in the U.S. Black Basta was behind an attack that launched after an employee mistakenly downloaded a malicious file.

Ohio Lottery: 500,000 people were affected by an attack on the Ohio State Lottery. Hacker group DragonForce took credit, and said they gained access to employee and player data including contact information, birthdates, winnings, and social security numbers.

Ticketmaster: ShinyHunters stole credit card details, contact and personal information from over 550 million Ticketmaster/Live Nation customers. The group put the data up for sale on the dark web, priced at half a million dollars.

Aril 2024

Omni Hotels: Daixin ransomware launched an attack that took down Omni Hotels’ network nationwide and impacted reservations, hotel room locks, and POS systems. Daixin posted screenshots of sensitive stolen data from over 3.5 million Omni guests.

Group Health Cooperative (Wisconsin): A BlackSuit data breach stole personal and medical documents from more than 500,000 patients. Systems were shut down for several hours as internal IT teams worked to contain the attack. 

United Nations Development Programme: UN systems were breached by 8Base, disrupting UN operations in Copenhagen. During the attack 8Base claimed to steal massive amounts of confidential information, including accounting records, contracts, invoices, and other official documents.

UnitedHealth Group: BlackCat ransom group, also known as ALPHV, stole 6TB of sensitive patient data. United Health stated the breach caused more than $800 million in financial damages — in addition to meeting BlackCat’s demands for a $22 million ransom.

March 2024

Duvel Brewery: Beer production was brought to a halt at one of Belgium’s largest breweries after a ransomware attack by Stormous.

Crinetics Pharmaceuticals: Internal IT teams uncovered suspicious activity in an employee account — but by the time they had isolated the threat, LockBit posted that they’d breached Crinetics systems and stolen major amounts of data. LockBit demanded a $4 million ransom.

MarineMax: Rhysida ransomware struck the world’s largest luxury yacht dealer, stealing financial information and company records as well as information from a database of the world’s wealthiest customers. Rhysida put the data up for sale for the price of 15 bitcoin.

February 2024

Lurie Children’s Hospital: The Chicago children’s hospital had to take IT systems offline and was forced to delay care for many of its patients. Rhysida set a price of $3.7 million for 600GB of data that may include as many as 200,000 patients. After Lurie refused to meet the price, the data was leaked online.

California SEIU 1000: A union that represents 100,000 California workers suffered network outages after an attack by LockBit. The ransomware gang stole employee SSNs, financial documents, and salary information.

Trans-Northern Pipelines: The Canadian petroleum pipeline operator was hit by a ALPHV ransomware attack. Trans-Northern said their security teams quickly isolated the incident without major issues, but ALPHV claims to have stolen almost 190GB of company data and documents.

January 2024

Fulton County, GA: A LockBit attack crippled Fulton County government systems for weeks, causing problems for utilities, court, and tax networks. Everything from marriage licenses to police operations were affected, and many offices had to resort back to using paper forms during the outage. LockBit claimed they gained access to “confidential documents” and threatened to leak them.

loanDepot: An unknown group disrupted payment systems that disrupted mortgage payments for millions of loanDepot customers. The hackers also stole the data of over 16 million customers, potentially including bank account information. 

Bucks County, PA: Hackers knocked out 911 terminals inside fire, police, and emergency vehicles in a Pennsylvania county home to 650,000 residents. The National Guard was brought in to assist with emergencies as the county attempted to resolve the issue.

Schneider Energy: Cactus ransomware stole terabytes of company data in a breach. The attack compromised over 2,000 enterprise clients including Walmart, PepsiCo, Hilton, and DuPont. It’s unknown whether ransom demands were met. 

Notable Ransomware Groups

Even after coordinated federal and international crackdowns, ransomware gangs are as powerful as ever. Groups that were previously broken up emerged under new criminal organizations, and newer gangs rose to prominence in some of the highest-profile attacks of the year. These are a few of the most dangerous names in ransomware. 

LockBit is a Russian gang with global reach that roared back with a vengeance in 2024 after suffering a defeat when law enforcement took down its platform. LockBit provides RaaS (Ransomware as a Service) and has been the most deployed ransomware since 2022. Because of LockBit’s popularity, attacks can vary greatly in tactics and techniques.

ALPHV/BlackCat was formed after a gang known as BlackMatter’s servers were taken down by a sting in 2021. ALPHV makes some of the most technically advanced ransomware out there, capable of evading even the top cybersecurity systems. They’re thought to have the most experienced and tech savvy network of affiliates, and attack both Windows and Linux systems. ALPHV is one of the only ransom gangs to use a “triple extortion” technique leveraging stolen data, encryption, and denial of service attacks.

Rhysida is a fast-rising, aggressive ransomware gang responsible for some of the most damaging attacks in 2024. Rhysida’s malware was initially considered to be novice, but it rapidly became more elaborate and difficult to detect. Rhysida has led the offensive against healthcare systems and government offices.

Hunters International, ShinyHunters, 8Base, and BlackSuit are other established ransomware gangs that thrived in 2024. DragonForce and RansomHub are newer names emerging as more formidable threats this year.

Latest Ransomware Trends

Several ransomware trends took hold this year, with attackers focusing on bigger targets and demanding bigger payouts to match. Attacks on infrastructure became more common — attackers went hard after healthcare systems, government offices, and supply chain vendors.

Like everyone else, hackers increasingly deployed AI to help them carry out attacks. AI allows malware to adapt in real time to evade security, or can be used to clone voices, email, or other communications to make phishing seem more legit.

Ransomware as a Service continued to grow in popularity, as ransomware providers made their platforms more accessible to bad actors with fewer technical skills. Ransomware also got more sophisticated across the board, taking advantage of zero-day vulnerabilities more frequently and utilizing remote access tools to improve the effectiveness of attacks.

As always, phishing attacks on individual employees were one of the most effective ways for ransomware gangs to exploit systems. Attackers often breached security through individuals in BYOD situations or on SaaS cloud platforms with fewer safeguards.

With ransomware becoming more accessible and sophisticated, it’s predicted that attacks will only get more frequent — and more disruptive — as we head into 2025.

Ransomware Prevention and Protection

Ransomware can be tough to defend against because it can infiltrate an entire network through just one user. The more you can do to protect your users and network, the better chance you’ll have to successfully fend off bad actors.

Best Practices for Preventing Ransomware

These are some tried-and-true methods to help prevent a ransomware attack and keep your network running securely.

• Use Zero Trust security policies following a “trust nothing, verify everything” principle.

• Secure your network with unique passwords and multi-factor authentication (MFA).

• Keep security patches up to date on all software and services like email, servers, and VPNs.

• Back up data frequently, on multiple different media formats and keep one off-site copy.

• Educate users about device safety and how to recognize the latest phishing scams.

• Utilize AI to fight malware or other malicious threats.

Choosing the Right Security Solutions

The most effective security solutions vary from organization to organization. By taking the time to analyze the specifics around the way your company uses technology, you’ll gain the insights to develop a rock-solid defense strategy.

• Map attack surfaces and be aware of the latest ransomware attack vectors to identify vulnerabilities and determine best defenses.

• Evaluate security risks of SaaS or other third-party platforms your organization is using.

• Evaluate vulnerabilities unique to remote work and BYOD.

• Consider access controls like single sign-on (SSO), conditional access, password management, or passwordless authentication to improve individual user security.

• Unify IT stacks to reduce exploitable security gaps.

Recovery and Response Strategies

No matter how good your defenses are, sometimes ransomware sneaks into your system. By having a response plan ready to go, you can mitigate attacks quickly and stave off major damage.

• Create an incident response plan with standardized protocols for identifying and managing breaches.

• Isolate the infected system to prevent ransomware from spreading.

• Remove ransomware with antivirus and antimalware software, then clean the infected system.

• Restore data from a clean backup source. Refrain from using backups that were made while the system was under attack as they could contain encrypted files that could relaunch the attack.

• Review your security response and make improvements where vulnerabilities are detected.

• Explore insurance coverage against ransomware and other cyberattacks.

If considering a ransom payment, be aware that meeting attackers’ demands usually encourages future attacks.

Secure Identities, Devices, and Access with JumpCloud

JumpCloud brings together a variety of services that bolster your defenses against all sorts of attacks, including ransomware attacks. Whether you leverage JumpCloud to manage your device fleet, end user identities, single sign-on access, or any combination thereof, JumpCloud has the capabilities to help you lock down and protect your organization and minimize your exposure to these types of attacks. 

Learn more about how JumpCloud reduces attack surfaces, makes authentication more reliable and efficient, protects against phishing attacks, and unifies platform and device management across your network.