Ransomware remains one of the most disruptive cybersecurity threats facing businesses, healthcare providers and government organizations. The 2020 attack on Spanish insurer SegurCaixa Adeslas demonstrated how ransomware can interrupt essential services for weeks, while Cerber and WannaCry exposed the dangers of malicious email attachments and unpatched operating systems. According to Verizon's 2026 Data Breach Investigations Report, ransomware was involved in 48% of the breaches analyzed, highlighting its continued importance in the global cybercrime landscape.
What Is Ransomware?
Ransomware is malicious software that prevents users from accessing files or computer systems, usually by encrypting data. Attackers demand payment, commonly in cryptocurrency, in exchange for restoring access or providing decryption tools.
Modern ransomware campaigns frequently involve additional forms of extortion. Criminal groups may steal confidential information before encrypting systems and threaten to publish the data if victims refuse to pay.
Common infection methods include phishing emails, compromised credentials, exploited software vulnerabilities and poorly secured remote access services.
SegurCaixa Adeslas Ransomware Attack in 2020
SegurCaixa Adeslas, one of Spain's largest insurance providers, suffered a ransomware attack detected on September 9, 2020.
The incident disrupted internal computer systems responsible for insurance policies, medical authorizations and customer administration.
Adeslas disconnected potentially affected services and restricted internet communications to contain the attack. Although these measures were intended to prevent further damage, they also interrupted routine business operations.
Customers experienced difficulties scheduling medical services, renewing insurance policies and obtaining authorization for treatment.
According to an October 16, 2020, report by El País, the insurer had been dealing with the disruption for approximately six weeks and expected to restore normal operations later that month.
The company stated that it had not paid a ransom and that sensitive customer information had not fallen into the attackers' hands.
How Was the Adeslas Ransomware Delivered?
The initial infection method was not conclusively identified in the public reporting reviewed.
Some cybersecurity observers suggested that the incident could have involved the REvil ransomware group. However, Adeslas did not publicly confirm the responsible malware family or the specific vulnerability or attack method used.
Consequently, phishing, malicious downloads or compromised remote access should not be presented as the established cause of the Adeslas incident.
Adeslas Reported Another Cybersecurity Incident in 2026
In January 2026, Adeslas disclosed a separate cybersecurity incident involving unauthorized access to a technology system used for funeral insurance policies.
According to Spain's Castilla-La Mancha cybersecurity portal, information potentially exposed included identifying details and bank account data used for insurance payments.
The company restricted the unauthorized access, activated its incident response procedures and notified the relevant authorities.
Unlike the 2020 attack, the 2026 incident did not interrupt business operations. Public reporting did not establish that ransomware was involved.
The two incidents should therefore be treated separately rather than described as repeated attacks by the same ransomware group.
What Is Cerber Ransomware?
Cerber is a ransomware family first documented in 2016. It became widely known for its ransomware-as-a-service model, in which malware operators provided criminal affiliates with ransomware tools in exchange for a share of payments.
After infecting a computer, Cerber encrypted files and displayed instructions demanding payment for decryption.
Some variants also used synthesized speech to notify victims that their files had been encrypted.
How Was Cerber Ransomware Distributed?
Microsoft Security Intelligence identified several major Cerber distribution methods:
- Malicious email attachments: Documents and script files designed to download or execute ransomware.
- Office macros: Malicious code embedded in Microsoft Word documents.
- Exploit kits: Tools such as Magnitude and Rig that targeted vulnerable software.
- Drive-by downloads: Malware delivered through compromised or malicious websites.
- Password-protected files: Attachments designed to make automated security inspection more difficult.
Cerber demonstrated how ransomware operators could distribute malware through multiple attack channels without directly conducting every infection themselves.
What Was the WannaCry Ransomware Attack?
WannaCry was responsible for a major international ransomware outbreak beginning on May 12, 2017.
The malware affected hundreds of thousands of computers worldwide, disrupting businesses, public institutions and healthcare providers.
One of its most prominent victims was the United Kingdom's National Health Service, where hospitals experienced serious operational disruptions.
WannaCry combined ransomware with worm-like capabilities, allowing it to spread automatically between vulnerable computers.
How Did WannaCry Spread?
WannaCry exploited vulnerabilities in Microsoft's Server Message Block version 1 (SMBv1) networking protocol.
The malware used the EternalBlue exploit to compromise systems that had not installed the MS17-010 security update released by Microsoft on March 14, 2017.
Once a vulnerable computer became infected, WannaCry could scan for additional systems and attempt to spread across connected networks.
This capability made the outbreak particularly destructive because each subsequent infection did not necessarily require a user to open a malicious file.
Microsoft reported that the exact initial entry method behind the outbreak had not been definitively established, although exploitation of vulnerable SMB systems was confirmed as a major propagation mechanism.
Adeslas, Cerber and WannaCry Compared
| Threat | Year | Main Attack Method or Impact |
|---|---|---|
| Adeslas | 2020 | Ransomware disrupted insurance operations; initial entry method unconfirmed |
| Cerber | 2016 | Email attachments, exploit kits and malicious websites |
| WannaCry | 2017 | Worm-like propagation through unpatched Windows SMB systems |
These cases demonstrate that ransomware infections can originate through different weaknesses, including user-targeted attacks, vulnerable applications and insufficiently secured networks.
Latest Ransomware Trends in 2026
Cybersecurity reporting in 2026 shows that ransomware operations increasingly rely on software exploitation, stolen access credentials and data theft.
Ransomware Involved in 48% of Breaches
Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of the breaches examined, compared with 44% in the previous report.
The report also found that 69% of ransomware victims in its dataset did not make a ransom payment.
The median reported payment declined to approximately $139,875, compared with $150,000 in the previous reporting period.
These figures describe the incidents included in Verizon's research rather than all cyberattacks worldwide.
Software Vulnerabilities Become a Leading Entry Point
Verizon reported that exploitation of software vulnerabilities accounted for 31% of initial access in breaches, surpassing stolen credentials in its dataset.
Attackers increasingly target weaknesses in internet-facing systems, including VPNs, network security appliances and remotely accessible applications.
The findings highlight the importance of rapidly addressing known vulnerabilities, particularly those already being exploited.
Medusa Ransomware Continues Targeting Organizations
On August 18, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA), FBI and Department of Health and Human Services updated their advisory on Medusa ransomware.
The agencies reported that Medusa operators had affected more than 500 victims as of April 2026.
Affected sectors included healthcare, manufacturing, education, government services, information technology and financial services.
Medusa operators used phishing, initial access brokers and unpatched internet-facing vulnerabilities to compromise organizations.
Once inside networks, attackers could use legitimate remote administration tools, steal information and encrypt systems as part of a double-extortion operation.
How Modern Ransomware Attacks Are Delivered
Although ransomware techniques continue to evolve, several attack methods remain especially important:
- Phishing and social engineering: Fraudulent messages persuade users to disclose credentials or run malicious software.
- Vulnerability exploitation: Attackers take advantage of unpatched applications and exposed network devices.
- Compromised credentials: Stolen passwords provide access to business systems and remote services.
- Third-party compromise: Criminals abuse access through vendors, contractors or service providers.
- Remote administration tools: Legitimate software is misused to move through networks after initial access.
These techniques may be combined during the same incident, making ransomware attacks difficult to detect before encryption or data theft occurs.
How to Prevent Ransomware Attacks
Organizations can reduce ransomware risk by implementing layered security measures:
- Patch vulnerable systems: Prioritize actively exploited security weaknesses in operating systems, applications and network appliances.
- Enable multifactor authentication: Protect administrative accounts, VPN connections and remote access services.
- Maintain secure backups: Keep isolated or immutable copies of important data and regularly test recovery procedures.
- Segment networks: Limit unnecessary connections between servers, workstations and sensitive systems.
- Restrict privileges: Apply least-privilege access policies to reduce the damage from compromised accounts.
- Monitor suspicious behavior: Use endpoint detection, centralized logs and alerts for unusual administrative activity.
- Train employees: Improve awareness of phishing, malicious attachments and credential theft.
- Prepare incident response procedures: Establish clear responsibilities for containment, investigation, recovery and notifications.
What Should Organizations Do After a Ransomware Attack?
Organizations experiencing a suspected ransomware attack should activate their incident response plan and isolate compromised systems to limit further damage.
Security teams should preserve logs and forensic evidence, investigate unauthorized access and determine whether confidential information has been stolen.
Before restoring operations, affected organizations should address the underlying security weaknesses and verify that attackers no longer have access.
Recovery should rely on trusted backups and appropriately validated systems.
Depending on applicable laws, organizations may also need to notify law enforcement, regulators, customers or affected business partners.
Paying a ransom does not guarantee successful decryption, complete data recovery or the deletion of stolen information.
Conclusion
The Adeslas ransomware attack in 2020 illustrated how cyber incidents can disrupt essential business services for extended periods. Earlier threats such as Cerber and WannaCry demonstrated the consequences of malicious email attachments, exploit kits and unpatched network systems.
Cybersecurity data published in 2026 shows that ransomware continues to affect organizations worldwide, with attackers increasingly exploiting software vulnerabilities and combining encryption with data theft.
While attack techniques change, effective protection still depends on fundamental security practices: timely patching, strong authentication, secure backups, network segmentation and tested incident response plans.
- Log in to post comments