UK Legal Aid Agency says about 250,000 records stolen in its April 2025 breach predate 2007, the oldest from 1978. The bulk of the data still falls between January 2007 and 16 May 2025, three years earlier than the 2010 start the agency confirmed in May.
Perspective Coverage
4 publishers
- Builder
- Builder 5%
- Operator
- Operator 74%
- Investor
- Investor 21%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives45
- Confidence74
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence60
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Reality
- Evidence66
- Adoption18
- Hype gap+12
- Incentives40
- Confidence62
Black Kite's 2026 report locates the target set in the mid-market supplier layer that larger manufacturers buy from, and the Bank of England has already tied one carmaker's shutdown to a slowdown in UK growth figures.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence62
Storm-2570 brings the same intrusion toolkit to Qilin, DragonForce, Anubis and BERT attacks
Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence55
TeamPCP poisoned more than 1,000 packages with tactics anyone can copy
Google places the spree with a single operator in South Africa, which makes one arrest plausible, while Palo Alto Networks counts three core members. Either way, the packages moved because almost nobody checks what they ingest.
Reality
- Evidence58
- Adoption74
- Hype gap+10
- Incentives68
- Confidence55