Undisclosed cryptocurrency market-making firm
October 20, 2024
•[ data exfiltration, cryptocurrency, state-sponsored attack ]
Recorded Future observed C2 reconnaissance followed by FTP exfiltration from a market-making firm in the UAE during the Contagious Interview campaign (OctNov 2024). Attributed to the NGB 3rd Technical Surveillance Bureau (North Korea).
Users of Indian banking mobile apps
February 11, 2025
•[ malware, phishing, data leak ]
Android malware campaign disguised as Indian bank apps, distributed via phishing links and fake APKs to install FinStealer; exfiltration of banking credentials and personal information confirmed by CYFIRMA and other researchers.
Ya-moon
June 1, 2024
•[ data leak ]
A hacker alias Valerie claims a breach of the Ya-moon forum in June 2024, publishing user data and chat logs.
Ionic Money
February 3, 2025
•[ DeFi exploit, impersonation, protocol manipulation ]
On February 3 2025, attackers exploited Ionic Money on the Mode Network by impersonating members of Lombard Finance and convincing the project to list a fake token (LBTC). They minted counterfeit collateral, borrowed legitimate assets, and drained about $8.6 million in funds, later laundering part of it through Tornado Cash. The incident was a decentralized finance exploit involving protocol manipulation, with no system encryption or service disruption.
Chemical, Food, and Pharmaceutical Enterprises in Russia
February 5, 2025
•[ infostealer, phishing, data leak ]
Nova Infostealer campaign led by Rezet, also known as Rare Wolf, targeted Russian chemical, food, and pharmaceutical firms, harvesting credentials and internal documents through phishing and malicious installers.
Multiple Organizations in Asia
February 6, 2025
•[ espionage, backdoor, credential theft ]
Evasive Panda, a Chinese state-sponsored group operating under the Ministry of State Securitys Guangdong State Security Department / Technical Reconnaissance Bureau, deployed a custom SSH backdoor across enterprise network devices to exfiltrate credentials and maintain long-term covert access in espionage operations identified by Cisco Talos in February 2025.
Westend Dental
October 20, 2020
•[ ransomware, data leak, exposed PHI ]
A ransomware attack attributed to Medusa Locker encrypted patient data on Westend Dentals servers in October 2020. The breach went unreported for years, leading to a 20242025 Indiana AG and HHS settlement requiring patient notification. There is no clear evidence of exfiltration beyond encryption, but PHI exposure was confirmed.
Fillmore County Hospital
October 27, 2024
•[ phishing, data leak ]
An unauthorized party accessed an employee email account on 2024-10-27. Investigation completed 2024-12-18. Affected data includes personal, medical, payment, and insurance information. Individuals were notified 2025-02-13.
Town of Bourne
January 11, 2025
•[ ransomware, data leak ]
Unauthorized access to Bournes IT network was disclosed after a Jan 11, 2025 cyberattack. MA AG filings list 625 affected MA residents with SSN/financial/drivers-license data. RansomHub later claimed the attack and 100 GB theft; encryption not confirmed.
The Watergate Hotel
April 6, 2024
•[ data leak ]
An unauthorized actor accessed and exfiltrated data from The Watergate Hotels network beginning April 6, 2024. The compromised information includes names, SSNs, drivers license numbers, and medical and financial data of approximately 2,220 people. No encryption or service disruption reported.
Stock Development LLC
March 2, 2024
•[ ransomware, data leak ]
Stock Development confirmed network intrusion spanning April 2023 to March 2024. LockBit claimed the breach, posting 1 TB of stolen data. Victims notified beginning January 2025; about 13,147 individuals confirmed. No public confirmation of encryption or forensic attribution beyond the claim.
Kosovo Central Election Commission (KQZ)
February 11, 2025
•[ malware, infostealer ]
Cybersecurity experts observed that the official CEC website was infected with Lumma stealer via fake CAPTCHA payloads, distributing unauthorized links and malware to visitors. The site was targeted during and after elections, with evidence of malware distribution. No actor attribution was confirmed.
Paysera
February 21, 2025
•[ denial of service ]
No customer data or funds affected; the DDoS attack slowed access to Paysera systems starting ~13:30, with most issues resolved by ~15:30 and full restoration by midnight. ([turn0search0]:contentReference[oaicite:0]{index=0})
Innovative Renal Care
February 21, 2024
•[ data leak ]
Between February 21 and March 1, 2024, an unauthorized party accessed Innovative Renal Cares computer network and copied sensitive files. The breach exposed personal and health-related data including names, Social Security numbers, financial details, medical information, and prescriptions. The company filed a notice with the Massachusetts Attorney General on February 14, 2025, and began sending notification letters to impacted individuals. No encryption of systems or files was reported.
PrivatBank
February 6, 2025
•[ phishing, malware, data leak ]
A criminal group identified as UAC-0006 used phishing emails with password-protected attachments to deliver SmokeLoader malware targeting PrivatBank customers. The campaign aimed to steal credentials and financial data, active since November 2024.
Unimicron Technology Corporation
January 30, 2025
•[ ransomware, data leak ]
Unimicron Technology Corporation disclosed a ransomware incident on January 30, 2025, affecting its Shenzhen subsidiary. The Sarcoma ransomware group claimed responsibility and alleged 377 GB of stolen data. Unimicron confirmed ransomware encryption but has not verified any data exfiltration. Investigation ongoing.
zkLend
February 12, 2025
•[ smart contract exploit, cryptocurrency theft, defi ]
Smart-contract vulnerability exploited in zkLends DeFi protocol allowed unauthorized withdrawal of ~3,600 ETH (~USD 9.5 m); zkLend offered a 10 % white-hat bounty for fund return.
University Diagnostic Medical Imaging (UDMI)
November 26, 2024
•[ data leak ]
On November 26 2024, University Diagnostic Medical Imaging in New York detected unauthorized access to its systems that exposed patient information including names, addresses, dates of birth, referring physicians, and treatment data. The breach affected 138,080 individuals and was disclosed publicly in February 2025.
Islamic Emirate of Afghanistan – Ministries and Agencies
February 6, 2025
•[ data leak ]
Hackers breached Taliban-run Afghan government systems (TalibLeaks) and published tens of gigabytes of confidential records from 21 ministries online.
Users of fake DeepSeek sites
February 6, 2025
•[ phishing, data leak ]
Phishing campaign using dozens of fake DeepSeek-branded websites to steal user credentials and cryptocurrency through fraudulent login and wallet interfaces.
