Business Registration Service (Kenya)
January 31, 2025
•[ data leak, criminal actors ]
Kenyas Business Registration Service confirmed a major data breach on January 31 2025 that exposed registry and beneficial-owner data, including national ID numbers, addresses, phone numbers, and company ownership details. Media reports suggest over two million company and shareholder records were compromised and sold on the dark web. The attack was financially motivated and attributed to criminal actors; the government continues to assess the extent of the breach.
Linate Airport
February 17, 2025
•[ ddos, hacktivism ]
On February 17, 2025, hacktivist group NoName05716 launched a DDoS attack on Linate Airport in Italy, causing temporary slowdowns. The attack was part of a broader campaign targeting Italian institutions in retaliation for political statements by President Sergio Mattarella.
Malpensa Airport
February 17, 2025
•[ ddos, hacktivism ]
On February 17, 2025, hacktivist group NoName05716 launched a DDoS attack on Malpensa Airport in Italy, causing temporary slowdowns. The attack was part of a broader campaign targeting Italian institutions in retaliation for political statements by President Sergio Mattarella.
Medusind Solutions
December 29, 2023
•[ data leak, healthcare ]
Medusind Solutions, a healthcare billing and revenue cycle management provider, suffered a data breach on December 29, 2023, when unauthorized actors accessed its systems and exfiltrated sensitive patient data. Compromised data included names, addresses, insurance details, and other medical information of patients from multiple provider clients. The company disclosed the breach on January 10, 2024. There was no service disruption reported, but patient data privacy was significantly impacted.
Sault Ste. Marie Tribe of Chippewa Indians
February 9, 2025
•[ ransomware, data leak ]
RansomHub executed a ransomware attack on February 9, 2025, affecting six tribal facilities including five Kewadin casinos, the health center complex, and tribal administration systems. The attack encrypted and exfiltrated 119 GB of data, disrupting operations for approximately five days.
University of The Bahamas
February 2, 2025
•[ ransomware ]
The University of The Bahamas suffered a ransomware attack starting on 2025-02-02 that disrupted online systems including email, telephone, and academic platforms while in-person classes persisted. The school serves ~5,000 students across three campuses.
Bohemia Interactive
February 6, 2025
•[ DDoS, service disruption ]
Bohemia Interactives DayZ and Arma servers experienced a distributed denial of service attack beginning 2025-02-06, disrupting connectivity for players. Some claims attributed the incident to the group Xiangjang_zhi, though no official confirmation exists.
Undisclosed online casino operator
October 20, 2024
•[ Data exfiltration, State-sponsored attack, Reconnaissance ]
Recorded Future analysis identified reconnaissance and FTP exfiltration traffic from a Costa Rican online casino targeted in the Contagious Interview campaign (OctNov 2024), attributed to the NGB 3rd Technical Surveillance Bureau (North Korea).
Multiple South Korean government and business entities
February 12, 2025
•[ phishing, espionage ]
Spear-phishing campaign leveraging LNK and PowerShell scripts deployed by North Koreas RGB 3rd Technical Surveillance Bureau (Kimsuky) targeting South Korean government, defense, and cryptocurrency sectors.
Virginia Attorney General’s Office
February 11, 2025
•[ data leak, ransomware, cyber intrusion ]
In February 2025, the Virginia Attorney Generals Office voluntarily shut down nearly all internal systems after detecting a sophisticated cyber intrusion. The criminal group Cloak later claimed responsibility, asserting it had stolen 134 GB of internal documents and posted samples to its leak site. Officials confirmed system shutdowns for containment but did not verify any file encryption or ransom demand, indicating an exfiltration-only intrusion rather than an active ransomware lockout.
St. Andrew’s Resources for Seniors System
February 8, 2024
•[ data leak ]
An unauthorized actor accessed certain employee email accounts; suspicious activity was detected on 2024-02-08. Review concluded 2025-01-06, and notifications began 2025-02-07.
AultCare Corporation
September 25, 2024
•[ phishing, data leak ]
An unauthorized party accessed an employee email account and a SharePoint instance on 2024-09-25. AultCare reviewed affected content and began notifying brokers and affected individuals by 2025-01-21.
News.bg and other Bulgarian media outlets
February 2, 2025
•[ denial of service, hacktivism ]
Massive SSL-based distributed denial-of-service (DDoS) attacks targeted News.bg and several other Bulgarian media websites beginning on February 2, 2025. The attacks, described as large-scale and difficult to trace, disrupted access for several days until at least February 6, 2025. Mitigation involved blocking international traffic. Attribution remains undetermined; motive appears protest-related.
Biomedical Caledonia Medical Laboratory
November 1, 2024
•[ data leak, hacked, third-party breach ]
In November 2024, unauthorized actors accessed Biomedical Caledonia Medical Laboratorys systems through an external vendor, prompting an investigation and cybersecurity upgrades. The lab confirmed the intrusion but did not disclose specific data types or quantities affected. No evidence of encryption or operational disruption has been reported.
Coinbase users
December 1, 2024
•[ phishing, social engineering ]
Between December 2024 and January 2025, criminal phishing campaigns impersonating Coinbase support stole approximately $65 million in cryptocurrency from hundreds of users worldwide. Attackers used fake login pages, wallet-draining scripts, and social-engineering messages to capture credentials and bypass two-factor authentication. Coinbase confirmed that its own systems were not breached.
Port of Taranto
February 17, 2025
•[ ddos, hacktivism ]
On February 17, 2025, hacktivist group NoName05716 launched a DDoS attack on the Port of Taranto in Italy, causing temporary disruptions. The attack was part of a broader campaign targeting Italian institutions in retaliation for political statements by President Sergio Mattarella.
Transport Authority
February 17, 2025
•[ ddos, hacktivism, service disruption ]
On February 17, 2025, hacktivist group NoName05716 launched a DDoS attack on Italys Transport Authority, causing temporary service slowdowns. The attack was part of a broader campaign targeting Italian institutions in retaliation for political statements by President Sergio Mattarella.
IMI plc
February 6, 2025
•[ data leak ]
IMI plc disclosed unauthorised access to its systems, engaged external cybersecurity experts, and stated it will provide further updates; no details on data stolen, systems impacted or threat actor identified were included.
Grubhub
January 25, 2025
•[ data leak, third-party breach ]
Grubhub disclosed that a third-party vendor account was compromised, allowing limited access to contact and partial payment information for customers, drivers, and merchants. Full card, bank, and SSN data were not accessed. No attribution to a specific threat group. Incident contained.
Doxbin
February 12, 2025
•[ data leak ]
Hackers compromised Doxbin, locked out admins, deleted accounts, and leaked a database containing user records and a blacklist file.
