The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Whether peers vote through frontier AI incident reporting or data-centre shutdown powers at the bill's Lords report stage on 26 October.
From the 12 Oct briefing · Deadline: 26 October
How large a revenue hit Boston Scientific puts on the outage at its third-quarter call on 28 October.
From the 12 Oct briefing · Deadline: 28 October
Whether CISA turns another named-actor advisory into same-day three-day KEV deadlines, which would make the 8 October pairing a method rather than a one-off.
From the 12 Oct briefing · Deadline: 8 October
Whether CISA lists a sixth NetScaler flaw since late August, or tells agencies to rotate the directory bind passwords the September attacks exposed.
From the 12 Oct briefing · Deadline: late August
Whether CISA publishes any Phase II compliance signal, or opens Phase III preparation, under BOD 26-04.
From the 5 Sept briefing
ReliaQuest's next assessment of the FrostArmada tradecraft overlap on the hotel WiFi domain name system campaign.
From the 5 Sept briefing
The September three-day share of KEV additions, after August's fall to 71 per cent.
From the 5 Sept briefing
Whether Italy holds third place in leak-site claims or reverts towards its July position.
From the 5 Sept briefing
Whether the UAE Cyber Security Council makes a third consecutive monthly disclosure.
From the 5 Sept briefing
Whether BlackFog's July report, when it lands, confirms the leak-site inversion or names a monthly leader other than The Gentlemen .
From the 3 Aug briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.