Year: 2024
Court filings and enforcement actions initiated or unsealed during calendar year 2024.
Key Facts
- 17 major cases opened or unsealed in 2024.
- Cumulative losses identified for 2024 matters exceed $12.3 billion.
- Documented from federal indictments and official government disclosures.
Documented Matters for 2024
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks)
Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion)
Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.
U.S. v. Daniel Rhyne (Industrial Insider Extortion)
Core infrastructure systems engineer who staged an extortion scheme against his own industrial employer, locking coworkers out of Active Directory domain controllers, changing administrator passwords, and demanding $750,000 in cryptocurrency.
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts
Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.
CDK Global BlackSuit Ransomware Incident
Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.
AT&T Cloud Telecom Call and Text Metadata Exfiltration
Illegal exfiltration of call and text interaction metadata spanning six months for approximately 110 million AT&T wireless customers. Intrusion stemmed from an illicit access point to a third-party Snowflake cloud environment, leading to a 5.7 Bitcoin extortion fee paid through an intermediary to obtain verified video evidence of dataset deletion.
Microsoft Corporate Executive Email Intrusion (Midnight Blizzard / SVR)
Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.
Ascension Health Network Black Basta Ransomware Outage
Severe ransomware incident paralyzing Ascension Health, one of the nation largest nonprofit Catholic hospital systems across 140 facilities in 14 states, forcing clinical staff to paper medical charts, diverting emergency trauma patients, and triggering CISA joint advisories on Russian-linked Black Basta operations.
Prudential Financial ALPHV BlackCat Cloud Tenant Compromise
Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.
CrowdStrike Falcon Sensor Channel File 291 Global Windows Outage
Unprecedented global IT blackout triggered by an invalid content configuration update (Channel File 291) deployed to CrowdStrike Falcon sensor software, crashing 8.5 million Microsoft Windows devices into unbootable Blue Screen of Death loops, paralyzing commercial aviation, healthcare systems, and retail banks worldwide.
Salt Typhoon U.S. Telecommunications Wiretap Infrastructure Infiltration
Chinese state-sponsored espionage campaign (Salt Typhoon / GhostEmperor / FamousSparrow) compromising core routing and lawful intercept infrastructure of major U.S. broadband and wireless carriers (including AT&T, Verizon, and Lumen), gaining persistent access to CALEA court-ordered wiretap requests and unencrypted call metadata of senior government officials.
XZ Utils liblzma Upstream Linux Supply Chain Backdoor (CVE-2024-3094)
Sophisticated multi-year social engineering and software supply chain operation where persona Jia Tan gained co-maintainer status on the foundational open-source xz compression project, embedding a multi-stage obfuscated backdoor into liblzma tarballs that hijacked OpenSSH sshd authentication to enable unauthorized pre-auth remote code execution.
U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper)
Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.
International Sanctions on Aleksandr Ermakov (Medibank Breach)
First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.
FTC v. Global Tel*Link Corp. (Correctional S3 Bucket Leak)
Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.