Transport Authority
February 17, 2025
•[ ddos, hacktivism, service disruption ]
On February 17, 2025, hacktivist group NoName05716 launched a DDoS attack on Italys Transport Authority, causing temporary service slowdowns. The attack was part of a broader campaign targeting Italian institutions in retaliation for political statements by President Sergio Mattarella.
IMI plc
February 6, 2025
•[ data leak ]
IMI plc disclosed unauthorised access to its systems, engaged external cybersecurity experts, and stated it will provide further updates; no details on data stolen, systems impacted or threat actor identified were included.
Grubhub
January 25, 2025
•[ data leak, third-party breach ]
Grubhub disclosed that a third-party vendor account was compromised, allowing limited access to contact and partial payment information for customers, drivers, and merchants. Full card, bank, and SSN data were not accessed. No attribution to a specific threat group. Incident contained.
Doxbin
February 12, 2025
•[ data leak ]
Hackers compromised Doxbin, locked out admins, deleted accounts, and leaked a database containing user records and a blacklist file.
Undisclosed cryptocurrency market-making firm
October 20, 2024
•[ data exfiltration, cryptocurrency, state-sponsored attack ]
Recorded Future observed C2 reconnaissance followed by FTP exfiltration from a market-making firm in the UAE during the Contagious Interview campaign (OctNov 2024). Attributed to the NGB 3rd Technical Surveillance Bureau (North Korea).
Users of Indian banking mobile apps
February 11, 2025
•[ malware, phishing, data leak ]
Android malware campaign disguised as Indian bank apps, distributed via phishing links and fake APKs to install FinStealer; exfiltration of banking credentials and personal information confirmed by CYFIRMA and other researchers.
Ya-moon
June 1, 2024
•[ data leak ]
A hacker alias Valerie claims a breach of the Ya-moon forum in June 2024, publishing user data and chat logs.
Ionic Money
February 3, 2025
•[ DeFi exploit, impersonation, protocol manipulation ]
On February 3 2025, attackers exploited Ionic Money on the Mode Network by impersonating members of Lombard Finance and convincing the project to list a fake token (LBTC). They minted counterfeit collateral, borrowed legitimate assets, and drained about $8.6 million in funds, later laundering part of it through Tornado Cash. The incident was a decentralized finance exploit involving protocol manipulation, with no system encryption or service disruption.
Chemical, Food, and Pharmaceutical Enterprises in Russia
February 5, 2025
•[ infostealer, phishing, data leak ]
Nova Infostealer campaign led by Rezet, also known as Rare Wolf, targeted Russian chemical, food, and pharmaceutical firms, harvesting credentials and internal documents through phishing and malicious installers.
Multiple Organizations in Asia
February 6, 2025
•[ espionage, backdoor, credential theft ]
Evasive Panda, a Chinese state-sponsored group operating under the Ministry of State Securitys Guangdong State Security Department / Technical Reconnaissance Bureau, deployed a custom SSH backdoor across enterprise network devices to exfiltrate credentials and maintain long-term covert access in espionage operations identified by Cisco Talos in February 2025.
Westend Dental
October 20, 2020
•[ ransomware, data leak, exposed PHI ]
A ransomware attack attributed to Medusa Locker encrypted patient data on Westend Dentals servers in October 2020. The breach went unreported for years, leading to a 20242025 Indiana AG and HHS settlement requiring patient notification. There is no clear evidence of exfiltration beyond encryption, but PHI exposure was confirmed.
Fillmore County Hospital
October 27, 2024
•[ phishing, data leak ]
An unauthorized party accessed an employee email account on 2024-10-27. Investigation completed 2024-12-18. Affected data includes personal, medical, payment, and insurance information. Individuals were notified 2025-02-13.
Town of Bourne
January 11, 2025
•[ ransomware, data leak ]
Unauthorized access to Bournes IT network was disclosed after a Jan 11, 2025 cyberattack. MA AG filings list 625 affected MA residents with SSN/financial/drivers-license data. RansomHub later claimed the attack and 100 GB theft; encryption not confirmed.
The Watergate Hotel
April 6, 2024
•[ data leak ]
An unauthorized actor accessed and exfiltrated data from The Watergate Hotels network beginning April 6, 2024. The compromised information includes names, SSNs, drivers license numbers, and medical and financial data of approximately 2,220 people. No encryption or service disruption reported.
Stock Development LLC
March 2, 2024
•[ ransomware, data leak ]
Stock Development confirmed network intrusion spanning April 2023 to March 2024. LockBit claimed the breach, posting 1 TB of stolen data. Victims notified beginning January 2025; about 13,147 individuals confirmed. No public confirmation of encryption or forensic attribution beyond the claim.
Kosovo Central Election Commission (KQZ)
February 11, 2025
•[ malware, infostealer ]
Cybersecurity experts observed that the official CEC website was infected with Lumma stealer via fake CAPTCHA payloads, distributing unauthorized links and malware to visitors. The site was targeted during and after elections, with evidence of malware distribution. No actor attribution was confirmed.
Paysera
February 21, 2025
•[ denial of service ]
No customer data or funds affected; the DDoS attack slowed access to Paysera systems starting ~13:30, with most issues resolved by ~15:30 and full restoration by midnight. ([turn0search0]:contentReference[oaicite:0]{index=0})
Innovative Renal Care
February 21, 2024
•[ data leak ]
Between February 21 and March 1, 2024, an unauthorized party accessed Innovative Renal Cares computer network and copied sensitive files. The breach exposed personal and health-related data including names, Social Security numbers, financial details, medical information, and prescriptions. The company filed a notice with the Massachusetts Attorney General on February 14, 2025, and began sending notification letters to impacted individuals. No encryption of systems or files was reported.
PrivatBank
February 6, 2025
•[ phishing, malware, data leak ]
A criminal group identified as UAC-0006 used phishing emails with password-protected attachments to deliver SmokeLoader malware targeting PrivatBank customers. The campaign aimed to steal credentials and financial data, active since November 2024.
Unimicron Technology Corporation
January 30, 2025
•[ ransomware, data leak ]
Unimicron Technology Corporation disclosed a ransomware incident on January 30, 2025, affecting its Shenzhen subsidiary. The Sarcoma ransomware group claimed responsibility and alleged 377 GB of stolen data. Unimicron confirmed ransomware encryption but has not verified any data exfiltration. Investigation ongoing.
