October changed after it ended
Ransomnews raised its tally of October ransomware incidents from 13 to 25 on November 11 after reviewing additional public reports. The change happened in the reporting process weeks after some of the incidents began. It illustrates a problem for security teams briefing executives on month-to-month trends: the apparent slope of a chart can change sharply when old cases acquire enough public evidence to be counted.
What qualifies for the register
The publisher says 13 cases involved explicit public confirmation of ransomware or encryption. In the other 12, an organization acknowledged an incident and a criminal group separately named it. A gang’s claim alone did not meet the register’s standard. The two types of evidence support different conclusions about the affected organization. An acknowledged intrusion paired with an extortion claim still leaves open whether systems were encrypted.
Two clocks for school districts
The report places the first public confirmation it found from Richmond Public Schools on October 21 and a subsequent listing by Interlock on November 9. For an education official following criminal claims, the second date belongs to a new allegation about an already public incident. Counting both announcements as fresh attacks would distort a district risk briefing. The same issue affects comparisons of whole months: Ransomnews says its August total rose from 51 in early September to 116 as additional cases became public.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
