Fear or False Comfort: Ransomware Gangs Are Now Managing the Whole Story- 310

August 5, 2026

Encryption used to be the entire product. A ransomware group broke in, locked the files, left a note, and waited for payment — the psychological work of the attack began and ended with a blank screen and a countdown. Three cases from the same reporting window show that the technical compromise has become just one input into something broader: a deliberate campaign to manage how a victim, and often the public, experiences and responds to a breach — sometimes by escalating fear and shame, and sometimes, just as deliberately, by manufacturing calm and false reassurance instead. Two of these cases escalate the fear: a hospital system's own Facebook page turned into a billboard for its attackers' claims, and a phone call from a stranger who says he's speaking for "a group of hackers." The third does something almost the opposite, and arguably more unsettling for how easily it works: a bank quietly reports that its attacker promised to delete what it stole, and that promise finds its way into an official regulatory filing as though it settled anything. All three are examples of the same underlying shift — ransomware operators managing the narrative around an incident as deliberately as they manage the intrusion itself, using fear when fear serves them and manufactured calm when calm serves them better.

The clearest case of narrative-as-weapon involves AnMed, a nonprofit medical system running four hospitals and additional clinics across Georgia and South Carolina, which was still dealing with facility closures two weeks after a cyberattack when its own Facebook page was hijacked and used to post ransom demands directly to the public. The posts, attributed to a group calling itself "The Gentlemen," claimed the attackers had exfiltrated 6 terabytes of data including records tied to sexual assault, mental health treatment, abortions, and sexual harassment incidents — categories chosen, whether or not the underlying claim is even true, specifically for their capacity to humiliate and frighten patients rather than simply to prove a breach occurred. AnMed removed the posts, disabled access to the account, and said explicitly that the claims remain unverified, which matters because the attackers offered no evidence at all — the reputational damage from merely posting the claim publicly, on a channel patients already trust and follow, functions independently of whether any of it is true. The Gentlemen is not a marginal operation improvising a new trick; CheckPoint's research puts the group's affiliate-recruitment pitch at an unusually generous 90 percent revenue share, and its rapid rise — 332 extorted victims in the first five months of this year, and the third-highest count of industrial-sector attacks of any ransomware group in the second quarter of 2026, according to the operational-technology security firm Dragos — suggests a group with the resources and organizational maturity to treat public reputational attacks as a standard part of its playbook rather than an improvised escalation. Security firm Expel has separately noted the group's technical sophistication, including abuse of an obscure third-party driver vulnerability specifically to disable victims' endpoint detection tools, reinforcing that the same organization investing in technical polish is also investing in the psychological dimension of an attack.

The second case escalates pressure through a channel that is harder to screen out than a data-leak site: a human voice. Resecurity's research into INC Ransomware's exploitation of two SonicWall Secure Mobile Access vulnerabilities — CVE-2026-15409 and CVE-2026-15410, both since added to CISA's Known Exploited Vulnerabilities catalog — found the group accelerating attacks against organizations across the US, Australia, the UAE, Colombia, and Switzerland since early August, with exploitation activity reportedly beginning back in June, weeks before the official advisory and patch were even available. What distinguishes this campaign from an ordinary technical intrusion is what happened after: victims received phone calls from a man identifying himself only as "Andrew," who told them he was calling "from a group of hackers," stated that their network had been compromised, provided an email address for negotiations, and then hung up — a scripted, impersonal, but deliberately unsettling personal contact that a ransom note left on an encrypted server simply cannot replicate. The negotiation domain used in these emails was registered through a Chinese registrar that accepts cryptocurrency payment, and notably was registered shortly after the actual intrusion, suggesting the psychological-pressure infrastructure — the calls, the domain, the negotiation channel — was built as deliberately as the technical exploit chain that got the attackers inside in the first place.

River Bank's case runs in the opposite emotional direction, and that is exactly what makes it worth examining alongside the other two rather than dismissing as unrelated. River Financial Corporation disclosed in SEC filings that a ransomware attack beginning June 16 led to data theft from its network, and that as part of its response, the company "obtained representations from the threat actor that it deleted the data in its possession" — language that made its way into an official 8-K filing even though there is no technical mechanism by which a victim organization can verify that a criminal actually deleted stolen files rather than simply saying so. Nothing about River's situation involves public shaming or intimidating phone calls; if anything, the tone here is cooperative, almost businesslike. But that is precisely the point: an attacker who convinces a victim that the danger has passed has achieved a version of narrative control that a public Facebook hijacking or an intimidating phone call cannot — a victim who believes stolen data has been deleted has less incentive to escalate its own response, notify affected individuals with maximum urgency, or continue fighting the story in public, and a criminal organization has every commercial incentive to offer that reassurance regardless of whether it reflects reality, since a calm, resolved-sounding incident invites far less scrutiny than an unresolved one. The fact that this unverifiable assurance made it into a formal regulatory filing, treated as a fact worth reporting rather than a claim worth flagging as unverifiable, shows how easily manufactured calm can travel through official channels with even less friction than manufactured fear.

Taken together, these three cases describe a single underlying capability being deployed toward opposite emotional ends depending on what each situation calls for. The Gentlemen amplified fear and shame because a hospital serving vulnerable patients has every reason to pay quickly rather than risk public exposure of records tied to sexual assault and mental health treatment. INC Ransomware added a human voice to the intimidation because a phone call from a stranger claiming inside knowledge of a network breach carries a kind of urgency that an automated ransom note does not. And whoever compromised River Bank offered calm, verifiable-sounding reassurance because a victim convinced the danger has passed is a victim less likely to keep pushing back. None of these levers has anything to do with the underlying technical compromise, and all three show ransomware operators treating the emotional and informational experience of a breach as its own deliberately managed surface — one that can be turned toward terror or toward false comfort, whichever better serves getting paid and moving on to the next target.