Lexington-Richland School District 5
June 5, 2025
•[ ransomware, phishing, education ]
On June 3, 2025, Lexington-Richland School District 5 detected a network intrusion following a phishing email that disrupted systems, delayed summer school and staff bonuses. Over 1.03 TB of data has been confirmed under review. Though Interlock claimed responsibility, this is unverified. The district refused ransom demands and is offering credit monitoring to affected individuals.
Centre de services scolaire des Appalaches (CSSA)
August 25, 2025
•[ ransomware, education ]
INC carried out a ransomware attack on CSSA on August 25, 2025, encrypting about 70% of archives and exfiltrating ~180 GB of data. Stolen data included personal records of students and staff, plus organizational financial, legal, and administrative documents. The incident lasted days to weeks before being publicly disclosed on September 3.
City of Greenville (TX)
August 5, 2025
•[ ransomware, malware, government ]
Hackers deployed ransomware targeting Greenvilles server infrastructure, affecting city services and utility billing in Hunt County; emergency 911 was unaffected, and no personal data breach has been reported.
Woodlawn Health
July 5, 2025
•[ ransomware, malware, healthcare ]
Woodlawn Health in Rochester, Indiana suffered a ransomware attack starting July 5, 2025, which encrypted systems and disrupted clinical and administrative operations. Systems were gradually restored, and officials confirmed that some patient care was impacted. Investigations continue into whether personal or medical data was exfiltrated.
Xserver (エックスサーバー) sv13279 server
August 25, 2025
•[ ddos, technology ]
On August 25, 2025, Xserver reported that its sv13279 server was targeted by a DDoS attack beginning around 6:20 a.m. Access filtering was applied at 6:33 a.m. to mitigate the attack and restore normal service. No data was accessed or exfiltrated; the incident was limited to temporary service disruption. Actor and motive remain undetermined.
Healthcare Services Group Inc. (HSGI)
October 7, 2024
•[ hack, leak, healthcare ]
Unauthorized actor accessed HSGI network between 2024-09-27 and 2024-10-03; intrusion discovered on 2024-10-07; data exfiltration confirmed June 2025; notifications issued Aug 2025. No encryption/disruption reported.
TransUnion
July 28, 2025
•[ hack, misconfiguration, finance ]
Unauthorized access via third-party contractor application used in U.S. consumer support operations enabled viewing and copying of files.
Government entities (36, Central Asia & APAC)
May 1, 2025
•[ espionage, phishing, malware ]
Phishing lures and Telegram botbased malware were used by the ShadowSilk cluster to compromise 36 government entities across Central Asia and the Asia-Pacific region between May and July 2025. The campaign focused on espionage, enabling unauthorized access and data theft, and was publicly reported in August 2025 by The Hacker News.
Bartlesville Public Schools
April 30, 2025
•[ hack, education ]
On April 30, 2025, unauthorized intruders stole files from Bartlesville Public Schools containing names and Social Security numbers of staff and students. The breach was discovered by August 4 and reported on August 27. Affected individuals received credit monitoring support.
University of St. Thomas (Houston, TX)
August 12, 2025
•[ ransomware, malware, education ]
On August 12, 2025, the University of St. Thomas in Houston, Texas, detected unauthorized access and voluntarily shut down key systems for nine days. External sources confirmed the INC ransomware gang claimed responsibility, stating they stole 1.8 TB of sensitive university data. University operations including student portals, financial aid, and course scheduling were fully disrupted, though no encryption was reported. Public disclosure followed on August 25, 2025.
Government, tech, academic & telecom entities; global
August 22, 2025
•[ espionage, malware, government ]
CrowdStrike reports that multiple Chinese-linked groupsMurky Panda, Genesis Panda, and Glacial Pandahave exploited vulnerabilities (e.g., Citrix CVE-2023-3519, Commvault CVE-2025-3928) to deploy the CloudedHope malware for covert espionage against cloud, telecom, government, tech, academic, legal, and professional services organizations worldwide.
Maryland Transit Administration (MTA)
August 24, 2025
•[ hack, government ]
Cybersecurity incident led MTA to take Mobility paratransit scheduling, real-time tracking, and call center systems offline as a precaution. Core transit services continued to run. Specific cause and i
Surbhi Chandna Productions
August 27, 2025
•[ hack ]
Surbhi Chandnas official production accounts were hacked, disrupting operations and delaying the release of her upcoming production. The breach caused reputational and scheduling setbacks but no personal or customer data theft was reported.
Luzerne County Government
July 1, 2025
•[ hack, government ]
Luzerne County, Pennsylvania reported a data breach in July 2025 after discovering unauthorized access to county servers. Investigation suggests personal and possibly financial data were exposed, though no service disruption or encryption was reported.
Ohio Medical Alliance (Ohio Marijuana Card)
July 14, 2025
•[ leak, misconfiguration, healthcare ]
Unsecured database exposed sensitive records of an estimated 30,00040,000 Ohio medical cannabis patients. Data included names, addresses, phone numbers, email addresses, medical marijuana card numbers, state ID numbers, and medical information. The database was discovered on July 14, 2025, by a security researcher and secured on July 15; no evidence of ransomware or encryption was found.
Fogos.pt (wildfire mapping platform)
July 31, 2025
•[ ddos, technology ]
On July 31, 2025, fogos.pt, a Portuguese volunteer-run wildfire information platform, was hit by the first of two DDoS waves, peaking at 33k requests/sec and 1.7 Gbps for 7 minutes. A second wave followed on August 1 at 31k rps / 849 Mbps for 5 minutes. Both attacks were automatically mitigated by Cloudflares Project Galileo, and the site remained available throughout, with no data loss or outages.
Miracle Ear (Health Services LLC)
January 28, 2025
•[ hack, healthcare ]
Unauthorized access from Jan 228, 2025 allowed cybercriminals to view and potentially exfiltrate sensitive personal and health data of at least 13,088 individuals. No service disruption reported and no encryption involved. Regulatory notifications occurred August 12, 2025.
Gosuslugi (Russian e-Government Portal)
August 20, 2025
•[ hack, ddos, government ]
Gosuslugi, Russias national e-government portal, was hit by a large-scale DDoS attack in August 2025, causing temporary outages and degraded access to online public services. Authorities reported no compromise of personal data or backend systems.
Arch Linux Project
August 16, 2025
•[ hack, ddos, technology ]
The Arch Linux Project has been under a sustained, volumetric Layer 3/4 DDoS attack since approximately August 16, 2025, impacting its main website, Arch User Repository, and forums. Mitigation tactics such as SYN authentication, rate limiting, and mirror redirects are in use; attacker identity remains unknown.
Netstar
June 23, 2025
•[ leak, ransomware ]
Data details undisclosed publicly; breach confirmed as involving data leak following refusal to pay ransom.
