Ransomware

University Hospitals has no estimated restoration date for its public websites and MyChart, which were taken offline after unusual server activity on October 22; its clinician intranet remains operational. The incident is a market signal for healthcare cybersecurity, incident response, and recovery capabilities, but no UH solicitation or confirmed procurement has been identified.

RAID-AI offers a free, manual self-assessment for identifying ransomware-resilience gaps across AI systems, mapping controls to NIST Cybersecurity Framework 2.0 and CISA Cybersecurity Performance Goals 2.0. It is a voluntary reference—not a solicitation or funded procurement—but may inform agencies’ security evaluations and contractors’ AI assessment and remediation services.

Ransomware disrupted Richmond Public Schools and the Oneonta City School District in October 2026, prompting different continuity responses. No solicitation, award, spending amount, or confirmed data loss was reported, but the incidents highlight potential needs for school-sector incident response, recovery, and operational continuity services.

Researchers say China-linked Storm-2603 compromised at least four organizations, including a water utility, and used SharePoint access to disable security tools before deploying ransomware. The incident highlights procurement priorities for utilities: timely patching, resilient endpoint protection, Active Directory security, and controls that remain effective under attack.

CISA, the FBI, the U.S. Secret Service, and international partners report that SafePay has affected about 600 organizations worldwide since August 2024, including critical-infrastructure operators. Contractors should review the advisory’s indicators and mitigations, urgently patch cited Cisco, Veeam, and SonicWall vulnerabilities, and assess protections for remote access, networks, and backups.

Three ex-negotiators from DigitalMint and Sygnia received four-year prison sentences for their involvement in ransom schemes affecting major U.S. organizations. This event exposes insider threat vulnerabilities in cybersecurity contracts, prompting a reevaluation of vendor selection and oversight strategies across the sector.

The emergence of the self-destructing Mistic backdoor emphasizes the need for stronger cybersecurity measures in government procurement. As threat actors evolve their methods, agencies must invest in advanced solutions to protect networks against sophisticated intrusion tactics.

Microsoft's recent investigation reveals two ransomware groups targeting SharePoint servers using known vulnerabilities and legitimate tools. Federal agencies and contractors must enhance their cybersecurity strategies, focusing on solutions that address multi-vector ransomware threats.

Wavestone's latest Cyber Benchmark report indicates a slight rise in cybersecurity maturity across large organizations, reaching 55.3%. However, persistent gaps in AI security and ransomware protection suggest ongoing procurement opportunities for providers of cybersecurity services and regulatory compliance solutions.

The National Institute of Standards and Technology has unveiled a draft guide aimed at enhancing ransomware response and recovery in industrial control systems. This initiative, developed alongside leading technology firms, signals an increased focus on cyber resilience and will impact procurement strategies in the manufacturing sector.