The Doors Were Already Open May 2026 Ransomware in Review

The report summarizes a multi-victim extortion and data-exfiltration campaign: a major appliance maker (Arçelik) reportedly lost thousands of Confluence spaces, pages, attachments and Jira projects containing engineering IP; Turkey’s land registry (TKGM) had citizen PII and land records exposed, attributed to an actor calling itself APT73; and multiple companies and nonprofits (Starbucks, Circle U Foods, MyPillow, North Dallas Shared Ministries, YMCA of Columbia) experienced extortion or data theft, with attackers ranging from cloud-bucket scrapers to organized extortion groups and evidence of access-broker involvement.