{
	"id": "fb7d5c79-1533-4b67-9af3-928099ef3560",
	"created_at": "2026-04-06T00:09:46.121951Z",
	"updated_at": "2026-04-10T03:21:57.686375Z",
	"deleted_at": null,
	"sha1_hash": "3f623d4c8405e058d555bc2a82cf1db8ea081446",
	"title": "Ransomware group attacks Scottish mental health charity",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 69850,
	"plain_text": "Ransomware group attacks Scottish mental health charity\r\nBy Jonathan Greig\r\nPublished: 2023-01-17 · Archived: 2026-04-05 20:48:47 UTC\r\nA Scottish mental health charity is in the process of recovering from a ransomware incident after it was attacked\r\nlast Thursday. \r\nThe attack on the Scottish Association for Mental Health (SAMH) was first reported by the BBC Scotland and\r\nEmsisoft threat analyst Brett Callow confirmed to The Record that the RansomExx ransomware group claimed\r\ncredit for the incident. \r\nOn Friday, the organization released a statement saying it was dealing with a cybersecurity incident that affected\r\ntheir email system at both national and local offices. The attack also took down some of their phone lines. \r\nBy Monday, SAMH chief executive Billy Watson issued a second statement condemning the attack. \r\n“We are devastated by this attack. It is difficult to understand why anyone would deliberately try to disrupt the\r\nwork of an organization that is relied on by people at their most vulnerable. Our priority is to continue to\r\ndo everything we can to deliver our vital services,” Watson said. \r\n“My thanks to our staff team who, under difficult circumstances, are finding ways to keep our support services\r\nrunning to ensure those they support experience as little disruption as possible. We are working closely with\r\nvarious agencies including Police Scotland - this is an active investigation. We will continue to take the best expert\r\nadvice to assist us in effectively dealing with this situation.”\r\nThe organization noted that its local services are still available by phone and in person across Scotland. \r\nBased in Glasgow, SAMH was founded in 1923 and provides mental health services to adults and young people in\r\n60 communities across Scotland. \r\nThe organization recently showed up on the leak site of RansomExx, and Callow said the group is generally less\r\ninterested in publicity than other ransomware groups. The group claims to have stolen about 12GB of data from\r\nSAMH during the attack. \r\nThe group has previously attacked Taiwanese computer hardware vendor GIGABYTE and was implicated in an\r\nattack on Lojas Renner, Brazil’s largest clothing department store chain. \r\n“They have, however, claimed a number of significant victims including Tyler Technologies, the Texas\r\nDepartment of Transportation and Gigabyte,” Callow said. “Like multiple other ransomware families, RansomExx\r\ndoes not encrypt systems which use Russian or CIS languages.”\r\nhttps://therecord.media/ransomware-group-attacks-scottish-mental-health-charity/\r\nPage 1 of 2\n\nNo previous article\r\nNo new articles\r\nJonathan Greig\r\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since\r\n2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.\r\nHe previously covered cybersecurity at ZDNet and TechRepublic.\r\nSource: https://therecord.media/ransomware-group-attacks-scottish-mental-health-charity/\r\nhttps://therecord.media/ransomware-group-attacks-scottish-mental-health-charity/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://therecord.media/ransomware-group-attacks-scottish-mental-health-charity/"
	],
	"report_names": [
		"ransomware-group-attacks-scottish-mental-health-charity"
	],
	"threat_actors": [],
	"ts_created_at": 1775434186,
	"ts_updated_at": 1775791317,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3f623d4c8405e058d555bc2a82cf1db8ea081446.pdf",
		"text": "https://archive.orkl.eu/3f623d4c8405e058d555bc2a82cf1db8ea081446.txt",
		"img": "https://archive.orkl.eu/3f623d4c8405e058d555bc2a82cf1db8ea081446.jpg"
	}
}