Threat Watch · Jun 30, 2026
ℹ️ Data source: RansomLook
api/posts?days=1. The feed did not advance this run, returning exactly the same 6 posts as 06-29, with the latestdiscoveredstill at 2026-06-28T12:52Z. Treat this as no new data today (feed stalled).
Overview
- Total new posts: 0(the API did not advance; the 6 entries below are the same batch carried over from 06-28)
- Groups involved: 5(redact ×2, play ×2, safepay / cmd organization 1 each)
- Watchlist hits: 2(both group:play, carried over)
Watchlist Hits (carried over, not new today)
| Group | Victim | Sector | Geo | Hit | Discovered |
|---|---|---|---|---|---|
| play | Kuhnline | manufacturing/services | US? | group:play | 2026-06-27T20:59 |
| play | J&J Gaming | gaming/hospitality | US | group:play | 2026-06-27T20:59 |
All Posts (within the API window, identical to 06-29)
| Group | Victim | Sector | Geo | Discovered |
|---|---|---|---|---|
| redact | FCCI Insurance Group | insurance (property & casualty) | US | 2026-06-27T20:20 |
| redact | Hologic | healthcare/medical diagnostics | US | 2026-06-27T20:22 |
| play | Kuhnline | manufacturing/services | US? | 2026-06-27T20:59 |
| play | J&J Gaming | gaming/hospitality | US | 2026-06-27T20:59 |
| safepay | hellmold-plank.de | services/SMB | DE | 2026-06-27T20:59 |
| cmd organization | Fidelity Security Group | physical security/guarding | ZA? | 2026-06-28T12:52 |
Anomalies / Trend Notes
- Feed stalled:
days=1has returned the same batch as 06-29, with the latestdiscoveredfrozen at 06-28T12:52Z. This is the intermittent stalling this API exhibits (it also stalled across 06-27/06-28 previously). Do not read today's figures as "ransomware activity is declining" — the correct reading is that the collection source has not updated. - If it is still stalled tomorrow, consider temporarily enabling the fallback RSS feed listed in
sources.yaml(https://www.ransomlook.io/rss.xml) or cross-checking againstransomware.live. - Continuing watch: the
redactgroup posted two large US targets back to back (Hologic in medical diagnostics, FCCI in insurance); track whether it is entering a new active phase.playmaintains its high-frequency output. cmd organization → Fidelity Security Groupis a physical security/guarding company (likely South African); do not confuse it with Fidelity Investments.