An operation presenting itself as LAPSUS$ has announced what it calls “Chapter II,” declaring a return to cybercrime after a previous LAPSUS$-branded site published a PGP-signed shutdown announcement, while teasing the future release of data from an unidentified global company generating more than $50 billion in annual revenue.
The newly published statement claims the group’s previous retirement was temporary and says it intends to resume corporate intrusions and extortion. The operation also directly challenged the FBI and U.S. federal authorities while claiming it expects to continue generating millions of dollars through cybercrime.
The announcement was accompanied by a PGP signature and public key, along with a countdown for what the site describes as its next major target.
At time of publication, there is not enough independently verified evidence to establish that the operators behind the new Chapter II site are the same individuals responsible for the historical LAPSUS$ operation. The use of the LAPSUS$ name and a signed statement alone does not establish continuity unless the cryptographic identity can be reliably connected to previously authenticated material from the group.
Countdown points to unnamed global company
The Chapter II site lists an “Upcoming Target” but does not identify the company.
Instead, the operators describe it only as a global organization generating more than $50 billion in annual revenue with a significant international presence. A countdown displayed alongside the claim indicates that the group intends to release additional information in approximately 10 days.
The description is broad enough to potentially fit numerous multinational companies. There is currently no evidence supporting the identification of any specific organization as the target, and BreachNews is not speculating on its identity.
The countdown also does not establish that LAPSUS$ currently possesses data from the unnamed company. Until supporting evidence emerges or the organization confirms an incident, the claim remains unverified.
Virta Health data listed as published
The site also lists Virta Health under its disclosed targets and claims that data belonging to the digital health company has now been published.
Unlike the unidentified upcoming target, the underlying Virta Health breach is independently confirmed.
Virta Health disclosed that it identified unauthorized activity on March 24, 2026 involving a data repository separate from its current production platform. An investigation determined that files within the repository were potentially accessed between March 19 and March 22.
The potentially exposed information included combinations of names, Social Security numbers, Individual Tax Identification Numbers, dates of birth, health insurance information, medical diagnoses, conditions, treatment information, service dates and other health identifiers.
Virta Health said it secured the affected environment, engaged external cybersecurity specialists and notified law enforcement. The company later began notifying potentially affected individuals.
LAPSUS$ had already claimed responsibility for the Virta Health incident months before the new Chapter II announcement. The appearance of Virta Health under “Data Published” therefore appears connected to the previously disclosed March incident rather than evidence of a new breach of the healthcare company.
Statement directly references TeamPCP
The Chapter II announcement also makes an unusual direct reference to TeamPCP, thanking the group and claiming its earlier activity provided LAPSUS$ with operational cover.
The statement appears to suggest some level of cooperation between the 2 operations, although the exact nature of that relationship remains unclear. The claim should not be treated as independent evidence that the groups shared infrastructure, access or membership.
There is, however, previous public evidence connecting activity attributed to the 2 names. During the sprawling TeamPCP software supply chain campaign earlier in 2026, data stolen from Checkmarx infrastructure was subsequently published under the LAPSUS$ identity.
TeamPCP has been associated with a series of software supply chain compromises during 2026, including attacks involving widely used developer tooling and packages. Australian authorities also charged 2 alleged principal TeamPCP participants in August as part of an investigation into the group’s global activity.
The new LAPSUS$ statement appears to capitalize on that enforcement action, portraying TeamPCP’s disruption as having diverted attention from its own operations. There is currently no independent confirmation supporting that characterization.
Old name returns with familiar extortion rhetoric
LAPSUS$ became one of the most disruptive cybercrime groups of the early 2020s after targeting major technology and telecommunications companies through unconventional intrusion techniques.
The group became particularly associated with social engineering, credential theft, SIM swapping, help desk manipulation and attempts to recruit insiders rather than relying exclusively on traditional malware-driven intrusion chains.
Its operators frequently combined technical compromises with highly public extortion tactics, openly communicating about victims and challenging companies and law enforcement agencies.
The FBI has previously highlighted LAPSUS$ as an example of the shift toward attackers using social engineering to convince employees and help desk personnel to reset credentials or otherwise provide access to corporate environments.
The tone of the Chapter II statement closely follows that confrontational style, but stylistic similarities cannot establish who controls the new operation.
The most significant test will come when the countdown expires. If the operators publish previously undisclosed data from a major multinational company, particularly material that can be independently validated, the claim of renewed LAPSUS$ activity will become substantially more credible.
Until then, Chapter II represents an apparent attempt to revive one of cybercrime’s most recognizable brands, backed by a confirmed historical Virta Health incident and claimed connections to TeamPCP, but without enough evidence yet to conclusively establish continuity with the original LAPSUS$ operation.
