Palo Alto Networks (investigator)
July 17, 2025
•[ ransomware, malware, technology ]
Ransomware deployment (4L4MD4R) via exploitation of Microsoft SharePoint ToolShell vulnerabilities; attackers disabled defenses, bypassed certificate validation, and encrypted files; ransom note threatened deletion upon decryption attempts.
99 Cents Only
August 1, 2025
•[ ransomware, retail ]
INC Ransom claims to have breached Dollar Tree
Bouygues Telecom
August 4, 2025
•[ hack, technology ]
Bouygues Telecom, Frances third-largest mobile operator, detected a cyberattack on August 4, 2025, which exposed personal and contractual customer data including IBANs for approximately 6.4 million accounts; passwords and payment card details were not compromised.
Pandora (jewelry retailer)
July 20, 2025
•[ leak, retail ]
Pandora confirmed that a third-party vendor holding marketing/customer data was compromised, exposing PII of around 30,000 individuals; no passwords, financial, or payment data stolen.
Chanel
July 25, 2025
•[ social, retail ]
Threat actors accessed Chanels Salesforce-hosted database at a third-party provider via social-engineering/OAuth tactics; data theft detected July 25, 2025; U.S. customer contact details exposed; no operational disruption reported.
Air France/ KLM
July 28, 2025
•[ leak ]
In August 2025, KLM confirmed that a third-party customer service system it used had been breached, exposing passenger data. The stolen information included names, contact details, and travel information of customers, though no internal KLM operational or financial data was reported compromised. The airline did not disclose how many individuals were affected, but emphasized that flight operations were not disrupted.
IMDataCenter
July 15, 2025
•[ leak, hack, misconfiguration ]
Unsecured AWS S3 bucket exposed ~38GB of records; hacker downloaded ~75GB, including ~20M emails, ~37M phone numbers, 50k SSNs/DOBs; affects multiple industries (healthcare, airlines, universities, dealerships). Bucket later secured; lawsuits pending.
Electronic School (ГИС "Электронная школа"), Novosibirsk
January 15, 2025
•[ hack, ddos, education ]
On January 15, 2025, a powerful DDoS attack targeted Novosibirsks Electronic School digital diary platform. The attack, described as one of the most massive in the region, caused several hours of disruption before service was restored.
Ministry of Defence of Ukraine – Anti-Corruption Council election system
January 7, 2025
•[ hack, ddos, government ]
DDoS attack on Ukraines MoD online election for its Anti-Corruption Council. Over 1.1 million malicious requests blocked, including 300k from Belarus IPs. Attack attempted to disrupt voting but was contained the same day, and election integrity was maintained with ~101k Ukrainians successfully voting.
Tecta America Corporation
October 1, 2024
•[ hack ]
Tecta America discovered suspicious network activity around October 1, 2024. Investigation revealed that between September 20October 2, an unauthorized actor accessed or acquired files. Impacted data includes names, Social Security numbers, drivers licenses, and financial account info for approximately 22,573 individuals Notifications sent January 2, 2025, and credit monitoring offered.
Town of Webster, New York
November 15, 2024
•[ financial, social, phishing ]
The Town of Webster fell victim to a phishing scam in November 2024, when scammers impersonated a contractor and tricked officials into diverting $520,275.67. Criminal investigation recovered over $300,000, and cyber insurance is expected to cover the remainder. No sensitive or confidential data was compromised.
Fraunhofer Institute for Industrial Engineering IAO
December 27, 2024
•[ ransomware, malware, technology ]
On December 27, 2024, Fraunhofer IAO in Stuttgart suffered a ransomware attack that encrypted and disrupted internal systems. The institute reported the incident to the Bavarian Data Protection Authority and law enforcement within statutory deadlines. While research data is typically anonymized, unauthorized disclosure cannot be ruled out, though no confirmed exfiltration has been identified.
Senior Citizens, Inc.
March 11, 2024
•[ hack, healthcare ]
Senior Citizens, Inc., a nonprofit in Savannah, Georgia, detected suspicious network activity on March 11, 2024. Investigation revealed that an unauthorized party accessed and acquired files containing names and Social Security numbers. Affected individuals were identified by November 26 and breach notifications were mailed beginning December 31, 2024, offering identity monitoring.
Pembina Trails School Division
December 2, 2024
•[ ransomware, financial, leak ]
Canadian school division compromised by Rhysida ransomware Dec 2, 2024. Attack disrupted thousands of devices and exposed ~35,000+ student records and staff payroll/financial data. Group attempted $1.7M ransom before leaking stolen data on the dark web.
AuthoraCare Collective
August 18, 2024
•[ hack, healthcare ]
Between August 1822, 2024, an unauthorized actor accessed AuthoraCare Collectives network, compromising protected health information of approximately 58,019 people. The review concluded on October 21, 2024, and notification letters were issued January 2, 2025. AuthoraCare offered credit monitoring services to those affected.
Rivers Casino Philadelphia
October 14, 2024
•[ ransomware, malware, retail ]
Rivers Casino Philadelphia disclosed that between Oct 1422, 2024, an unauthorized actor accessed and exfiltrated patron data, including names, SSNs, bank account details, and drivers license numbers. Notifications were issued Dec 30, 2024, with public filings Feb 16, 2025. The ransomware group Cicada3301 claimed responsibility, stating it stole 2.56 TB of data. Rivers Casino offered identity protection services to affected patrons.
CR&R Environmental Services (CR&R Incorporated)
October 30, 2024
•[ hack, financial ]
CR&R discovered unauthorized access on October 30, 2024, affecting ~9,895 individuals. Notifications were issued December 26, 2024. Data included sensitive PII such as SSNs, drivers license and financial account data.
Northwest Asthma & Allergy Center
November 12, 2024
•[ hack, phishing, healthcare ]
An unauthorized party accessed an employees email account on November 12, 2024, compromising sensitive patient data at Northwest Asthma & Allergy Center. The breach was discovered and contained by November 13. At least ~1,000 patients were notified by January 2, 2025, and the incident was reported to HHS OCR. Investigation did not find evidence of exfiltration beyond what was accessible via the compromised mailbox.
Crown Mortgage Company
December 20, 2024
•[ ransomware, finance ]
Unauthorized access was discovered on Dec 20, 2024, at Crown Mortgage Company, exposing customer names and Social Security numbers. Breach notifications were sent on Jan 2, 2025, and the company offered 24 months of identity monitoring. A ransomware group has claimed responsibility, but this remains unconfirmed.
Individual
January 27, 2025
•[ social, phishing, finance ]
Police began investigating when a 90-year-old man told authorities he gave $49,900 to a courier purportedly acting on behalf of PayPal. Victim was deceived via fake PayPal email & link leading to remote access of computer/password theft
