Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Rising encryptionless extortion incidents against enterprises in 2025

Trend
First reported
Last updated
Happening score
H score 27
2 unique sources, 3 articles

Summary

Hide ▲

Encryptionless extortion surged in 2025 as attackers increasingly skipped ransomware encryption and instead stole data to pressure victims across enterprise environments. The trend matters because data theft became the main extortion lever, making attacks harder to notice when no encryption step is used. Research tied the pattern to almost 1500 incidents in 2025 versus 28 in 2024, showing the tactic has expanded sharply. The update also points to ShinyHunters activity against Salesforce instances, as well as exploitation of CVE-2025-61882 in Oracle E-Business Suites, unpatched zero-days, and software supply-chain weaknesses as examples of how access is being gained.

Related Happenings

Oracle E-Business Suite unauth HTTP takeover security flaw (CVE-2026-46817)

Vulnerability
H score52 First: 29.06.2026 16:46 Last: 29.06.2026 16:46 Sources 1

About this happening: **Oracle E-Business Suite** **CVE-2026-46817** is under **active exploitation**, putting **Oracle Payments** deployments at takeover risk. The flaw allows **unauthenticated HTTP a...

Open Happening

Oracle PeopleSoft broad zero-day exploitation campaign

Exploitation Wave
H score82 First: 29.06.2026 13:00 Last: 29.06.2026 13:00 Sources 1

About this happening: A **broad PeopleSoft zero-day exploitation campaign** exposed **multiple organizations** to compromise after attackers abused a **previously unknown Oracle PeopleSoft vulnerabilit...

Open Happening

Major U.S. services company hit by ransomware attack linked to DragonForce

Incident
H score38 First: 16.06.2026 13:18 Last: 16.06.2026 13:18 Sources 1

About this happening: A **DragonForce ransomware** incident hit a **major U.S. services firm** in **December 2025**, with attackers maintaining access for **one to two months** and hiding **command-and...

Open Happening

Oracle PeopleSoft PeopleTools zero-day RCE (CVE-2026-35273)

Vulnerability
H score58 First: 11.06.2026 22:39 Last: 11.06.2026 22:39 Sources 1

About this happening: **Oracle PeopleSoft PeopleTools CVE-2026-35273** is a critical **zero-day RCE** affecting **PeopleSoft Enterprise PeopleTools 8.61 and 8.62**. Oracle released **emergency mitigati...

Latest development: 29.06.2026 23:40

Nissan says it suffered a data breach affecting current and former employees after attackers exploited an Oracle PeopleSoft zero-day associated with CVE-2026-35273. Oracle informed Nissan that personnel records of hundreds of companies may have been obtained and that Nissan was specifically targeted, with potentially exposed data including contact details, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary data for employees in the United States, Canada, Mexico, and Brazil.

Open Happening

ShinyHunters Oracle PeopleSoft data theft and extortion campaign

Campaign
H score60 First: 10.06.2026 21:31 Last: 10.06.2026 21:31 Sources 1

About this happening: **ShinyHunters**/**UNC6240** used **CVE-2026-35273** in **Oracle PeopleSoft Enterprise PeopleTools** as a **zero-day** to break into exposed systems, steal data, and extort victim...

Latest development: 29.06.2026 23:40

Nissan says attackers exploited an Oracle PeopleSoft vulnerability in a ShinyHunters-linked campaign and that the company was specifically targeted, with personal information for current and former employees in the United States, Canada, Mexico, and Brazil potentially exposed. Nissan says the material may include employee contact information, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary information, and the company has activated incident response, engaged external cybersecurity experts, secured affected systems, and is working with Oracle.

Open Happening

Timeline

  1. 15.01.2026 17:45 4 articles · 5mo ago

    Encryptionless extortion campaigns surge in 2025

    Campaign Scope Update

    Research from Symantec and Carbon Black describes a sharp rise in encryptionless extortion campaigns against enterprises in 2025, with attackers increasingly skipping ransomware encryption and instead stealing data, then threatening to publish it to force payment. Leak-site analysis places these incidents at almost 1500 in 2025 versus 28 in 2024, and the report highlights unpatched zero-day exploitation, software supply-chain weaknesses, ShinyHunters activity against Salesforce instances, and CVE-2025-61882 in Oracle E-Business Suites as examples of the tactic.

    Show sources
    Open in new tab