Other Ukraine
September 17, 2025
•[ ddos ]
TASS says Medvedchuks Other Ukraine website suffered a fresh DDoS on 09/17/2025 (second that week), following a run of attacks on 09/0909/11; technicians worked to restore access; no attribution or data theft.
Several Russian schools
January 6, 2025
•[ hack, ddos, education ]
{"richText":[{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"StormWall reports "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"hundreds of teen-run DDoS attacks"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" against Russian school IT systems in 2025 (peak MayJune), with "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"1020 Gbps"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" traffic causing "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"service disruptions"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" and aiming to "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"sabotage lessons/Unified State Exam"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"."}]}
The Property Business Australia
September 16, 2025
•[ leak ]
Kairos listed The Property Business Australia on its leak site around 09/16/2025, claiming exfiltration of sensitive agent/tenant/landlord data; CyberDaily published on 09/17; trackers cite 164 GB leaked. Samples include ID and payment images. No victim confirmation or outage reported yet.
Trusteed Plans Service Corporation
December 26, 2024
•[ leak, finance ]
TPSC detected a breach on 12/26/2024; investigation found unauthorized access and data acquisition. A data review completed 08/07/2025 identified 19,775 impacted individuals. Notices sent 09/1509/16/2025 detail exposure of PII/PHI (DOB, SSN, health info; sometimes insurance IDs). No outage or misuse evidence reported.
Miljodata
September 14, 2025
•[ hack, leak, technology ]
Cyberattack on Miljdata led to theft and dark-web leak of data on >1.5M people; Datacarry claimed responsibility; prosecutor rules out state involvement at this time. Data includes PII/personal numbers; hundreds of municipalities and some companies (e.g., Volvo, SAS) impacted.
Retina Group of Florida
September 11, 2024
•[ hack, healthcare ]
RG of FL reported a Hacking/IT Network Server breach (HHS) affecting 152,691 people; activity occurred Nov 69, 2024, detected Nov 9; data potentially include PII/PHI (names, DOB, SSN, DL, medical info); notifications began mid-Sept 2025.
SSC-ICT (serving several Dutch government agencies)
September 15, 2025
•[ hack, ddos, government ]
A sustained DDoS campaign targeted SSC-ICT systems, degrading VPN and internal site access for ~57k Dutch civil servants; ministries advised staff to work in office; Interior Ministry confirmed attacks, impact assessed as limited; no attribution.
VAS AG
September 14, 2025
•[ ransomware, malware, manufacturing ]
{"richText":[{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"VAS AG reported a "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"ransomware"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" incident on 09/14/2025 disrupting daily operations; systems were disconnected from the internet, authorities notified, and recovery underway; no attribution or data-theft confirmation yet."}]}
Collins Aerospace
September 20, 2025
•[ hack ]
{"richText":[{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"Cyberattack on Collins Aerospaces "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"MUSE"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" software caused check-in/bag-drop outages and knock-on flight disruptions at Heathrow, Brussels, Berlin (and minor impact at Dublin/Cork). RTX said issues were limited and mitigated via manual check-in; cancellations/delays continued into Sunday. Attribution/technique unknown."}]}
Unnamed high-profile Ukrainian entities
January 2, 2025
•[ espionage, malware, government ]
{"richText":[{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"ESET observed coordination where "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"Gamaredon tools (PteroGraphin/PteroOdd/PteroPaste)"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" deployed or restarted "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"Turlas Kazuar"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" on Ukrainian systems during "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"FebApr 2025"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":", marking the first documented collaboration between these FSB-linked groups; focus is "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"espionage access"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" rather than disruption."}]}
Goshen Medical Center
February 15, 2025
•[ ransomware, leak, malware ]
BianLian-attributed intrusion at Goshen Medical Center; files accessed on 02/15/2025, detected 03/04/2025; 456,385 affected with PHI/PII including SSNs and DL numbers; listed on BianLians leak site in March; no outage confirmed.
Medical Associates of Brevard
January 18, 2025
•[ ransomware, malware, healthcare ]
{"richText":[{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"BianLian claimed MAB in Jan 2025; MABs review (by 07/07/2025) identified affected individuals and data types; HHS breach portal lists "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"246,711"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" affected in a "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"Hacking/IT Network Server"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":" incident reported "},{"font":{"bold":true,"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"09/05/2025"},{"font":{"size":11,"color":{"theme":1},"name":"Aptos Narrow"},"text":"; no outage confirmed."}]}
Unnamed hotels in Brazil
June 13, 2025
•[ phishing, financial, malware ]
TA558 used LLM-generated JS/PowerShell loaders in phishing emails (Portuguese/Spanish) to deploy Venom RAT against hotels (Brazil/Spanish-speaking markets), aiming to siphon guest credit-card data from hotel systems/OTAs; observed in summer 2025, with no named victims or outages.
PyPI
May 9, 2024
•[ hack, malware, technology ]
GhostAction abused malicious GitHub Actions workflows to exfiltrate thousands of secrets (incl. PyPI tokens). PyPI found no evidence of malicious package publishes, revoked affected tokens, and issued guidance; campaign window early Sept 2025
Survival Flight
July 17, 2025
•[ leak, healthcare ]
Survival Flight discovered a cyber incident on 07/17/2025 impacting IT systems; notice lists likely exposure of patient PHI. DataBreaches reports WorldLeaks claim (~2.8 TB) and previewed data including internal business files plus some patient/member financial/insurance info. Second Survival Flight incident in <1 year.
Unnamed U.S. Banking Organization
May 9, 2025
•[ social, misconfiguration, finance ]
ReliaQuest links Scattered Spider to renewed activity against U.S. financial services, including a bank intrusion achieved via social engineering + Azure AD SSPR, followed by lateral movement (Citrix/VPN), ESXi compromise, and cloud data access attempts (Snowflake/AWS).
SonicWall
May 9, 2025
•[ hack, brute-force, technology ]
Threat actors brute-forced the MySonicWall portal and accessed cloud backup firewall preference files for a subset of customers (<5%). SonicWall terminated access, issued Essential Credential Reset guidance, and involved law enforcement. Risk centers on reuse of secrets/config intelligence for follow-on compromises.
Tiffany & Co
May 12, 2025
•[ leak, retail ]
Tiffany determined on 09/09/2025 that an unauthorized party accessed gift cardrelated customer data from an incident occurring ~05/12/2025; 2,590 customers affected; exposed data include PII and gift card number + PIN; separate earlier Korea/vendor incident noted but relation unclear.
Anchorage Neighborhood Health Center
May 9, 2025
•[ leak, healthcare ]
Anonymous group claims theft of ANHC patient records (10k, later 60k); FBI aware; at least one patient contacted with personal data. ANHC initiated investigation and took systems offline; scope/details pending.
FinWise
May 31, 2024
•[ insider, finance ]
Former FinWise employee accessed AFF customer files after termination, impacting 689k individuals; discovered June 18, 2025; investigation and credit monitoring offered; multiple lawsuits filed.
