HighEarly warningRansomwareUnited states · English

Government ransomware attacks rose 13% globally to 187 incidents in first half of 2026, with The Gentleman most active

First seen 21 Jul, 14:00 WIBLatest 21 Jul1 articles · 1 publishers

victim: latvia’sactor: lockbitVerify evidence

Confidence index · preliminarycomputed by the pipeline (V0.7)low

Corroborated by distinct domains

Independent sources

Victim identified

Full text available

Clustering consistency

Status and preventive steps

Early warningMachine output from news coverage; not verified by the public or institutions

Preventive steps

Apply least-privilege access, back up data, and train staff to spot phishing.
Back up data regularly to a separate location that is not always connected.
Patch internet-facing devices such as VPNs, firewalls, and mail servers promptly.

Literacy audienceExecutives and managersIT staff and system administratorsSocial media and messaging users

Literacy topics

Extracted claims

Victimconfidence 0.60

Latvia’s

Actorconfidence 0.60

LockBit, Qilin

Attack typeconfidence 0.90

Ransomware

Event datenot found

not identified

LocationUnited states

Target groupBusinesses

Status

Conclusion

1 articles, by publication time

Relations between articlesSingle source; no article pairs to compare.

Hashes prepared1full text hashed 1

first evidence_uida1c9734aff1b6ed5701e0fc3

1 of 1 evidence records are in Merkle batches

each flow's preventive output; this is where they differ · D1 changed 4 times · since 29 Sept

	D1Machine12 Oct	D2Public surveynone yetHelp review	D3Institutionnone yet	D4Official recordnone yet
Literacy audience	Executives and managersIT staff and system administratorsSocial media and messaging users	–	–	–
Literacy topics	1.Backups and recovery after ransomware 2.System updates and security patches 3.Protecting personal data, OTPs, and PINs	–	–	–
Preventive steps	Apply least-privilege access, back up data, and train staff to spot phishing. Back up data regularly to a separate location that is not always connected. Patch internet-facing devices such as VPNs, firewalls, and mail servers promptly. Report to Patroli Siber Polri	–	–	–
Institution's reason	–	–	–	–

Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents

semantic similarity of the coverage, across languages