Incident archive
For each incident we record the ransom demand, whether it was paid, the operational downtime that followed, and the estimated revenue impact — so you can weigh prevention against consequence.
Showing 14 of 14 incidents
Incidents shown
Avg. downtime (days)
Est. revenue lost
Paid the ransom
Disclosed ransom payments in this selection total US$37.4m.
Case-by-case
Estimates are drawn from public disclosures, regulator statements and company reporting.
Healthcare payments · United States · 2024 · ALPHV / BlackCat
A Citrix portal without MFA allowed ransomware deployment that froze US claims and pharmacy payment processing for weeks.
Logistics & ports · Australia · 2023 · Unattributed ransomware affiliate
Intrusion forced the operator to disconnect port systems, halting container movement across Sydney, Melbourne, Brisbane and Fremantle.
Software supply chain · United States · 2023 · Cl0p
A zero-day SQL injection flaw in the MOVEit managed file transfer product was mass-exploited to steal customer data downstream.
Consumer finance · Australia · 2023 · Unattributed
Stolen employee credentials were used to pivot into two service providers, exposing driver licence and passport numbers.
Postal & logistics · United Kingdom · 2023 · LockBit
LockBit encrypted systems supporting international export, halting overseas parcel and letter dispatch.
Hospitality & gaming · United States · 2023 · Scattered Spider / ALPHV
A social-engineering call to the IT service desk delivered privileged access, disabling hotel keys, slots and booking systems.
Healthcare insurance · Australia · 2022 · REvil-linked extortion crew
Stolen credentials from a third-party contractor gave attackers access to customer health claims data, which was later leaked on the dark web after the ransom was refused.
Telecommunications · Australia · 2022 · Unattributed individual
An unauthenticated public-facing API endpoint exposed identity documents and contact details for current and former customers.
Manufacturing · Japan · 2022 · Unattributed ransomware crew
A ransomware hit on a plastic parts supplier forced Toyota to stop all 14 domestic plants for a day.
Energy · United States · 2021 · DarkSide
A single legacy VPN account without MFA let DarkSide deploy ransomware, shutting the largest US fuel pipeline.
Food processing · United States · 2021 · REvil
Ransomware halted beef and pork processing across North America and Australia, closing 47 Australian facilities.
Public health · New Zealand · 2021 · Conti-linked affiliate
Ransomware disabled clinical systems across five hospitals, forcing paper-based care and deferred surgeries.
Public health · Singapore · 2018 · State-linked APT
Attackers used an unpatched workstation to reach the outpatient prescription database in a targeted espionage operation.
Shipping · Denmark · 2017 · NotPetya (Sandworm)
Destructive wiper malware spread through a compromised Ukrainian tax software update and destroyed 49,000 laptops and 4,000 servers.
Downtime and revenue-loss figures are estimates compiled from public disclosures, regulator statements and company reporting. Where a company did not disclose specifics, the figure is modelled from comparable incidents in the same sector and attack class. Treat these numbers as planning guidance for risk conversations, not as audited financials.
We build detection, response and recovery cover so a ransom demand is never your only option.
