Royal Mail in the UK has been struck by a ransomware attack that has rendered international mail un-deliverable since Thursday. As such, Royal Mail is urging people not to send mail abroad until an effective resolution has been found.
The UK’s National Cyber Security Centre and National Crime Agency are investigating a cyber incident. It appears to have been carried out by an organized cybercrime group known as Lockbit, which some cybersecurity experts speculate has members in Russia.
January 2023
January was a busy month for cybercrime, with several major ransomware attacks reported. While some of these incidents can be directly attributed to criminal gangs, others may not be so obvious.
The Darkside gang launched their first attack of the month against state-owned Brazilian energy company Copel, who were claimed to have stolen around 1000GB of data. A screenshot of some of this was posted on their leak site and they demanded an undisclosed ransom in return.
Another attack involved German chemical distribution company Brenntag, targeted by the DarkSide gang who demanded an undisclosed ransom in Bitcoin. On their leak site, the group posted some of the exfiltrated data – such as financial spreadsheets and bank balances – from their leak site.
Vestas, a Danish wind turbine manufacturer, experienced an attack that shut down some IT systems and confirmed it to be ransomware. A spokesperson stated they were back up and running within 48 hours – though whether a ransom had been paid was not disclosed.
On August 19th, RR Donnelly, an integrated services company providing communications, commercial printing and marketing to enterprise clients was victimized by the Conti criminal gang. At first they claimed they weren’t aware of any stolen client data during the attack but soon after the gang claimed responsibility and added the company to their leak site.
Ransomware struck Tournai Hospital in Belgium recently and forced them to redirect patients elsewhere. While no ransom was demanded from the hospital, medical staff were unable to access patient records due to this incident.
January 2024
Royal Mail has experienced a serious cyber attack in January. As a result, customers have been advised against sending any international mail until its systems have been restored. Furthermore, the postal agency has informed data protection authorities of the problem and is now testing workarounds for affected systems.
This month’s ransomware attack timeline sees the City of Angers in France make a major appearance. This major incident left most of the city’s government services suspended for several days.
Royal Mail has been affected by an attack from LockBit ransomware group and instructed to stop all incoming mail until a resolution has been found. They have also informed both U.K.’s National Cyber Security Center and National Crime Agency of the issue.
Other notable victims this month include South Africa’s state-owned electricity company ESKOM, Fitzgibbon Hospital in Missouri and McMenamins hotel and brewery chain in Portland Oregon. All attacks involved exfiltrating personal information including employee and patient data that was posted onto a leak site as proof of the attack.
In an interview with the BBC, Royal Mail’s head of information governance Andrew Thompson confirmed there had been no customer data breaches. However, they were still working with external experts and security agencies to resolve the problem. In the meantime, several workarounds had been put in place so international mail could continue being sent on time until a full system restoration occurs.
This month saw a surge in activity by global ransomware extortion rings. The Clop gang leaked sensitive data from Accellion file transfer service and demanded PS3 million as ransom; then REvil took control and held Apple to an additional $50 million ransom after refusing their demands. Finally, these attackers published blueprints on the Dark Web in an effort to extract another $4 million in ransom.
January 2025
Ransomware attacks occurred across a range of public and private organisations in January, including education, government and telecommunications. A high-profile incident at Colonial Pipeline disrupted gas supplies across multiple US states.
In the UK, Daylesford Organic was victim to ransomware that left its customers’ data compromised. Nevertheless, they took swift action by hardening their security and engaging cyber incident response experts in order to contain the attack.
This month, North Orange County Community College in California experienced a cyberattack that compromised the personal, financial and medical information of some students, staff members and former students. While exact numbers remain unknown, it is believed to be a large number of people.
Scotland experienced yet another ransomware attack on an education organization when The Scottish University was hit by it. Despite suspending all IT systems, no data had been exfiltrated or stolen and further investigation will take place into the incident.
Royal Mail was the latest victim of a ransomware attack this month, crippling their international export services. The criminal group behind the incident claimed they were connected to Russia and warned their data would be released on a leak site; however, they did not specify how much they were demanding in compensation for their services.
Ecuadorian state-run telecommunications company CNT was the next victim of a cyberattack which shut down most of their systems. Additionally, both payment portal and customer support systems were affected by the malware.
January 2026
Royal Mail, the world’s largest postal service, has issued a warning not to send mail abroad due to a ransomware attack that crippled its IT system. The company is now working hard to restore its networks.
In addition to disrupting the UK postal system, this cyber incident also stopped international exports. According to The Telegraph newspaper, LockBit ransomware is believed to be at fault.
Ransomware is one of the most prevalent types of malware that infects computer networks, threatening to publish or block access to victim’s data unless a ransom is paid. This can cause significant reputational harm as well as financial loss.
In January 2026, numerous businesses around the world were hit by malicious activity. From hotels and restaurants to hospitals and even the German power grid – all were affected.
Bakker Logistiek, a leading logistics services provider in the Netherlands, was struck by a ransomware attack which caused severe disruptions to their business operations. They are working closely with an information technology firm and legal counsel to investigate what happened and restore systems.
The Conti gang also perpetrated an attack against LA: Spine Diagnostic & Pain, a Louisiana chiropractic practice. They leaked 5% of their exfiltrated data onto their leak site.
Another noteworthy incident occurred in Brazil, when state-owned energy company Companhia Paranaense de Energia (Copel) experienced a major ransomware attack affecting all of its IT systems. During the attack, Copel said it had lost over 1000 gigabytes of data.
This ransomware incident highlighted the significance of organizations investing in their cybersecurity infrastructure and developing an Incident Response Plan. Furthermore, it underscored how essential it is to provide teams with quality training so as to avoid such attacks from occurring.
January 2027
In January 2027, several organizations around the world suffered cyberattacks. One of the most infamous incidents was a ransomware attack against Royal Mail that left them bankrupt.
Due to the attack, Royal Mail, the UK’s largest postal service, was unable to despatch international letters and parcels overseas. This caused major disruption for businesses. However, Royal Mail is making some progress towards restoring its services.
According to a January 19 bulletin on the postal service website, they have been working with external experts and security authorities to find ways to recover international mail. It said they have begun moving a limited number of parcels in addition to letters.
Royal Mail remains optimistic that its export services can be restored quickly. They continue testing workarounds and assure customers there is no risk for their businesses.
Another attack targeted Ecuador’s state-run telecommunications firm Corporacion Nacional de Telecomunicacion (CNT). CNT reported being the victim of RansomEXX ransomware and has had to shut down part of their operations.
Sinclair Broadcast Group was next to suffer an attack, shutting down 185 television stations across America. The company confirmed it had been hit by ransomware and data had been stolen during this incident.
PGT Innovations, a Florida company responsible for window and door manufacturing, announced they had been hit by ransomware but that no personal data had been compromised. They stated they were working with cybersecurity experts and legal counsel to investigate the incident and secure any affected data.
RR Donnelly, a leading integrated services company that offers communications, commercial printing and marketing to enterprise clients was also targeted by the ransomware gang. At first it appeared no client data had been exfiltrated but later revealed 2.5GB had been taken. As such the company has begun negotiations in an attempt to prevent its release.
