Siddhi Green Excellence Pvt. Ltd (India) reported a ransomware incident involving threat actor Orova, impacting its systems and operations in the country. With a long history since 2001—from treatability studies and technical consultancy to expanded environmental services—Siddhi Green faced this disruption as part of the Orova ransomware claim. #India

AuditTeam ransomware claimed to have impacted st***co in Italy by encrypting data and demanding payment for decryption. The attackers’ demand and data theft threat allegedly affected operations in IT #Italy

TEK SPB, a St. Petersburg heat-engineering company (tek-spb.ru), was targeted by the AuditTeam ransomware group, impacting its operations related to design and deployment of heat points and metering units. AuditTeam’s intrusion disrupted TEK SPB’s systems and services within the company’s critical infrastructure, impacting Russia #Russia

Studio Notarile Associato Salvatore Costantino E Anna Favarato, Follina in Italy reported a ransomware incident by the emperador threat actor involving several thousand customer documents and employee data. The case indicates impacts to records across the notary’s office, affecting customers in #Italy

TOWILL, a U.S.-based geomatics and GIS services provider supporting U.S. federal agencies including the Army Corps of Engineers and the Department of Defense, reportedly faced a ransomware incident attributed to the threat actor bravox. The attack resulted in disruption of services impacting organizations in the United States. #UnitedStates

Great Bay Bio in Hong Kong reported a ransomware incident attributed to the threat actor nightspire, though the specific impacted data is not available at this time. The attack remains under investigation by the victim, with available information limited. #HongKong

Cassias MG Government in Brazil was targeted by threat actor emperador using ransomware against government credentials and network access, later involving justice panels and sectors such as finance, police, and sensitive records. The data exposure included personal identity and civil documents (e.g., RG/CIN, birth certificates, CPF), along with medical information from Brazil’s SUS, threatening operational continuity under a negotiation deadline! #Brazil

Fanatics, a global sports commerce/e-commerce platform in the United States, reported that threat actor N0n gained destructive control over its cloud data estate, initiating deletion of 46,902 order files (108 GB) containing customer personal data, accounts-payable invoices, customer balances, bank transaction archives, tax exemption certificates, and fraud-prevention datasets. The incident is active with a deadline of 2026-09-23 01:01 UTC, threatening availability and exposure of sports commerce information. #UnitedStates

The ransomware claim by shinyhunters threatens the victim with encryption and extortion, demanding payment of “2.333% of my networth” (an eight-figure amount) and urging the victim to email [email protected] to negotiate. The note includes a “clock is ticking” ultimatum and lists the impacted country(s) as: # (unknown)