England Hockey is investigating a potential ransomware breach after the AiLock gang claimed to have stolen 129GB of data and threatened to publish it unless a ransom is paid. The governing body for field hockey in England — supporting more than 800 clubs, 150,000 players, and thousands of coaches and officials — confirmed it is working with law enforcement to determine whether its systems were compromised and what data may have been affected. AiLock, a relatively new ransomware operation first observed in 2025, uses double-extortion tactics, threatening to leak stolen data and leverage privacy-law violations to pressure victims into paying.

The attack follows a familiar ransomware playbook: infiltrate enterprise networks, exfiltrate sensitive data, encrypt systems, and issue strict negotiation deadlines — often 72 hours to begin negotiations and five days to pay before data is leaked. AiLock’s malware reportedly encrypts files using ChaCha20 and NTRUEncrypt, appending a .AILock extension and leaving ransom notes across affected directories. Even before breaches are confirmed, organizations and members may face secondary risks such as phishing, credential theft, and social engineering, especially when attackers claim to possess large volumes of internal data.

Defending against ransomware campaigns like this requires deep, real-time visibility across networks, endpoints, and user activity. Organizations need continuous monitoring of authentication logs, network sessions, data transfers, and system behavior to detect early signs of intrusion and data exfiltration before ransomware is deployed. By correlating L2–L7 network analytics, endpoint telemetry, and full-session forensics into a single, unified platform like NIKSUN, security teams can identify lateral movement, suspicious file encryption patterns, and outbound data flows — allowing them to block the attack chain early and preserve a forensic record for investigation and compliance. Read more about this story on our LinkedIn page