Cyberattack Hits Major Spanish Fishing Port

A ransomware attack recently disrupted operations at the Port of Vigo in Spain, forcing authorities to shut down affected IT systems and switch to manual processes. Critical platforms used for managing cargo and logistics were taken offline, creating delays and operational inefficiencies. Although ships continued to move and port activity did not fully stop, the reliance on paper-based workflows slowed coordination and highlighted how dependent modern ports are on digital infrastructure.

This incident reinforces the growing cybersecurity risks facing critical infrastructure. Ports, like many logistics hubs, rely heavily on interconnected systems to manage supply chains, making them attractive targets for cybercriminals. Even when physical operations remain functional, the disruption of digital systems can spread across industries, affecting trade flows, scheduling, and economic stability. Ongoing investigations aim to determine how the attackers gained access and whether sensitive data was compromised.

The importance of strong cybersecurity becomes even clearer when viewed alongside past disruptions such as the Suez Canal blockage, where a single incident caused massive delays and cost the global economy billions, including significant impacts on Europe. While that event was not cyber-related, it demonstrated how fragile and interconnected global trade systems are. A similar level of disruption caused by cyberattacks could have equally severe—or even more widespread—economic consequences, underscoring the urgent need for robust cyber resilience in critical infrastructure.

https://bit.ly/4mhw1CF

Keynotes:

"A ransomware attack has disrupted digital systems at Spain’s Port of Vigo, forcing authorities to disconnect parts of its network and temporarily manage cargo operations manually..."

"...Officials told local media the incident locked some equipment and involved a ransom demand."

"...Some operators have been instructed to rely on manual procedures and paper documentation to continue working."

"Ports and maritime organizations have increasingly become targets for ransomware gangs in recent years because of their critical role in global trade."

"In 2023, Japan’s Port of Nagoya temporarily suspended operations following a ransomware attack attributed to the LockBit cybercrime group. Ports across Belgium, the Netherlands, Germany, Portugal, Japan, Australia and in U.S. cities like Houston have all faced attack."

Askul Ransomware and Data Breach

Let’s start with the cliché that too often proves true: "Put essential cybersecurity measures in place before the moment arrives when prevention is no longer possible."

Askul, a major Japanese e-commerce and logistics company, has finally restarted part of its online services after a ransomware attack shut them down for 45 days. During this time, the company could not process normal orders or ship products to customers. Can you imagine your company not earning revenue for more than six weeks because of one cyber incident?

The attack did more than disrupt operations — it also led to a data breach. Customer names and contact information were exposed, and some of the leaked data even appeared online. Askul had to fall back to a temporary, very limited ordering system using fax, offering only 37 basic items. What would your organization do if it suddenly had to return to pen-and-paper processes just to keep business moving?

As of early December (2025), Askul restored its Warehouse Management System with stronger security controls and reopened online ordering for corporate clients. However, deliveries are still slower than before, and its consumer-facing services are not yet operational. The company also delayed its financial reporting as it tries to understand the full impact of the disruption. Would your business survive a similar delay in sales, logistics, and reporting?

This incident shows how a single ransomware attack can have long-lasting effects, not only on technology but on revenue, trust, and daily operations. It’s a reminder that cybersecurity is not just an IT problem — it is a business survival problem. If this happened to you tomorrow, would your company be ready?

https://bit.ly/4oJ4edM

Headlines:

"On October 19 (2025), the company found itself infected by ransomware and the next day advised it couldn’t accept orders or ship products. On October 22 (2025) the company said its Warehouse Management System was the problem, which meant it had to suspend its logistics services.

On October 30th (2025), the company revealed the attack led to a major data breach, with customers’ names and contact details leaked..."

"The incident is broadly comparable to the ransomware attack on British retailer Marks & Spencer, which cost it £136 million ($177.2 million) to clean up and saw profits slump.

Askul will have a similar bill to pay, and it may well be larger because the company’s initial outage ran for a few days more than Marks & Spencer’s, and full recovery also looks like it will take longer."

PowerSchool Hack

A 19-year-old college student from Massachusetts, has been sentenced to four years in prison after pleading guilty to hacking PowerSchool, a software platform used by schools across the United States to manage student information. He gained unauthorized access to the system and stole a massive amount of sensitive data belonging to 60 millions students and 9 million teachers; including personal identifiers, medical details, and educational records.

After gaining access, he contacted the company and demanded $2.85 million in Bitcoin (30 bitcoin), threatening to release the stolen data online if his ransom demand was not met.

PowerSchool confirmed that multifactor authentication (MFA) was not enabled on some of its systems at the time of the incident. This admission became a key detail in understanding how he was able to compromise the system so effectively.

https://bit.ly/4hcfhKo

Headlines:

"...He accessed databases belonging to the company PowerSchool that had information on more than 60 million students and nine million teachers."

"Sensitive data, including students’ Social Security numbers, special education status, medical conditions and parental restraining orders, were exposed in the hack, which PowerSchool made public in January."

"Last month, Texas sued PowerSchool, saying the company broke state laws relating to deceptive trade practices and identity theft protection, including by misleading consumers into believing its shoddy security practices were 'state-of-the-art.'

PowerSchool has acknowledged the hack was enabled by the fact that it did not use multifactor authentication."

UK Fines Law Firm 60,000 Pounds for Ransomware Data Breach

Two things:

1) DO NOT ignore two-factor authentication for any user. Just one weak link can cause you £60,000 (or more).

2) Report breaches on time, in accordance with the law(s) you are required to obey.

The U.K. ICO (Information Commissioner's Office) fined a law firm £60,000 after a 2022 ransomware attack leaked sensitive client data, including DNA tests and information about children and victims. The investigation found that the law firm failed to protect data properly, used an outdated account without two-factor authentication, and waited too long to report the breach. The ICO said protecting personal information is a legal duty, and the firm’s mistakes led to serious risks. The firm can appeal the fine but has not commented yet.

https://bit.ly/3YFvYFO

Headlines:

"Firm Failed to Close Outdated User Account, Waited 43 Days to Notify Regulators"

"Hackers in a 2022 ransomware attack stole 32.4 gigabytes of data from the law firm and later posted on the darkweb. The breach affected 791 people and contained information about 306 clients including DNA testing data, details on children and victims of sexual offenses."

Legacy Medical Devices Remain Easy Targets for Cyber Threats

 

Do you think that your health data secure?

Most of the people don't really think about this question. But imagine, what would you do if your health data ended up on the internet one day? Once it's exposed, you can't undo it. That's scary and disturbing, isn't it?

Anyone who worked with medical systems knows that it is quite difficult to patch the vulnerabilities on these systems. Main reasons are: 1) Many of the systems run on outdated software that no longer supports new patches. 2) Updates are too risky because they can interrupt care or cause devices to fail during use. So, many of these devices stay unpatched and highly vulnerable to cyber attacks.

Researchers from Claroty's Team82 analyzed over 2.25 million Internet of Medical Things (IoMT) devices and more than 647,000 operational technology (OT) devices across 351 healthcare organizations. They found that 99% of these organizations had vulnerabilities with publicly available exploits, as listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. (Yes, 99%. We can say (almost) "all of them")

You can find the report in the following link:

https://bit.ly/4j1es7d

https://bit.ly/3FOYOgp

Headlines:

"...the firm was able to analyze the security state of more than 2.25 million IoMT devices and more than 647,000 OT devices across 351 healthcare organizations – and found that 99% of the organizations are vulnerable to publicly available exploits..."

Change Healthcare’s Ransomware Attack

Let's repeat the painful truth once more: Lack of cybersecurity countermeasures can cost you much more than you expected.

The cyber attacks (especially ransomware attacks) on the health sector have been increasing in recent years. Health sector players have to take this fact into consideration in order to avoid being the next cyber victim of the cyber crime market.

UnitedHealth states that the total costs of the February cyber attack for the first quarter of 2024 stands at $872 million. The total cost reached "$1 billion" with the remediation costs, including a $22 million payment to the ALPHV/BlackCat-affiliated ransomware group. (If you hire 20 cyber security experts each for $250,000, it will cost you $5 million per year.)

This attack also had effects on their shares. ($0.74 per share.)

https://bit.ly/3wcOdHF

"It's a charge that eclipsed that of casino group MGM, which didn't pay a ransom following an attack on its systems last year, and which faces recovery costs of $100 million to rebuild its systems and paying for the fallout from outages, operational disruptions, allegedly leaked data and more."

"The company warned that, financially, the total cost of the cyberattack is estimated to be between $1.35 billion and $1.6 billion for calendar year 2024."

Ransomware Gang Stole Health Data of 533,000 People

 Yet another hack and another health service provider: Group Health Cooperative of South Central Wisconsin (GHC-SCW).

The ransomware gang could not encrypt the data this time but they could steal it well.

The BlackSuit ransomware gang claimed to sell patients' MRN numbers, SSN numbers, patient IDs, telephone numbers, residential addresses, medical history, and potentially other sensitive information.

https://bit.ly/3vTq8pi

"According to the attackers' claims, the stolen files also contain affected patients' financial information, employees' data, business contracts, and e-mail correspondence."

Stanford University Was Victim of a Ransomware Attack

 

Being the 3rd best university in the world doesn't make you invincible to hackers. Stanford University, which is 3rd in the world university rankings in 2023, was victim of a ransomware attack, the university announced. The data breach first occurred on May 12, 2023 and could only be detected until September 27, 2023. (After 139 days)

It is not fully clear what information was compromised but Akira, the ransomware attacker group, claimed that they have stolen 430GB worth of data, including personal information and confidential documents from Stanford University.

It seems that only a few organizations will be an exception of being ransomware victims in the future.

Be aware that cyber security threats are real and they will have a cost for you if you will be hit by them. Take necessary countermeasures against cyber threats. Most of the people are not aware of this fact but yep, they are for REAL!

https://bit.ly/48YocJK

"...toward the end of October 2023 after Akira posted Stanford to its shame site..."

"...the data breach occurred on May 12 2023 but was only discovered on September 27 of last year..."

"Akira's post dedicated to Stanford on its leak site claims it stole 430 GB worth of data, including personal information and confidential documents."

"Akira has been in operation since March 2023 and according to previous negotiations with anonymized victims that have since been published online, the group's ransom demands were varied, from multiple millions of dollars to low six-figure sums."