Wexford County Register of Deeds
November 5, 2024
•[ cyberattack, data loss, government ]
The Wexford County, Michigan, Register of Deeds office experienced a cyber incident on 2024-11-05. Access was shut off, systems went offline, and a small portion of documents (less than 5%) from a defined time period were not recoverable.
Angel One Ltd.
February 27, 2025
•[ unauthorized access, data leak ]
Indian stock brokerage Angel One disclosed on February 27, 2025, that unauthorized actors accessed some of its Amazon Web Services (AWS) resources following a dark web alert. The company confirmed exposure of limited client information but no compromise of funds or credentials. Investigation and containment measures were initiated immediately.
Missouri Department of Conservation
February 28, 2025
•[ data leak, hipaa breach ]
Missouri Department of Conservation reported suspicious cybersecurity activity on February 28, 2025. Forensic investigation found that a threat actor accessed internal servers containing employee and former employee health-plan data. The agency confirmed that files with HIPAA-protected information were exposed but not encrypted. No operational disruption occurred.
Cleveland Municipal Court
February 23, 2025
•[ ransomware, data leak ]
Cleveland Municipal Court experienced a full shutdown beginning 2025-02-23 due to a Qilin ransomware attack that encrypted court systems and exfiltrated roughly 44 GB of data. Operations were halted for about 17 days. The attacker demanded $4 million and threatened to leak stolen court documents.
Infini (Infini Earn)
February 24, 2025
•[ insider threat, financial theft, cryptocurrency ]
A former developer or compromised admin key was used to withdraw $49.5 million from Infinis smart-contract vault on February 24 2025. The attacker converted USDC to ETH and moved the funds off-chain. Infini, a Hong Kong-based stablecoin bank, offered a 20% bounty for fund return and filed legal action against a former developer in Hong Kong.
Niva Bupa Health Insurance Company Ltd
February 21, 2025
•[ data leak ]
Niva Bupa received a threat email from an unidentified actor claiming possession of customer data and referencing a leak site; the company reported the incident and obtained a Delhi High Court order to block the site while investigating. No data theft has been confirmed as of Oct 2025.
Sayanmoloko / Semyonishna Dairy Plant
December 1, 2024
•[ ransomware ]
The Sayanmoloko Semyonishna dairy plant in Khakassia, Russia, experienced a ransomware attack in December 2024 attributed to a LockBit variant. The attack encrypted labeling and tracking systems, hijacked printers to output anti-war leaflets, and disabled the company website while milk processing continued. Operations were restored within several days.
Fashion Box S.p.A.
January 29, 2025
•[ brute-force, data leak ]
Fashion Box S.p.A., owner of the Replay brand, disclosed a brute-force intrusion on January 29 2025 that allowed unauthorized access to internal servers and the exfiltration of corporate information and personal data of employees and external stakeholders. The company notified multiple European data-protection authorities. No encryption was confirmed. An undisclosed amount of personal and corporate data was taken.
Organizations in Myanmar
January 15, 2024
•[ espionage, backdoor, malware ]
Mustang Panda leveraged mavinject.exe and DLL side-loading to inject a ToneShell family backdoor into processes on targeted Myanmar organisation endpoints to enable espionage and persistent access.
Central New York Cardiology
February 27, 2025
•[ data leak, healthcare ]
Practice reported a data breach impacting extensive patient PHI/PII per public notice.
Christensen Group Insurance
October 10, 2022
•[ phishing, data leak ]
Company posted 24-02-2025 notice about 2022 email-account breach; data breach letters now being sent.
State information resources (Azerbaijan)
February 26, 2025
•[ ddos ]
Special Service reported massive DDoS on state resources; mitigation by filtering malicious traffic may temporarily block real IPs.
DISA Global Solutions
February 9, 2024
•[ data leak ]
Breach window Feb 9Apr 22, 2024; ~3.3M impacted; disclosures via state AG filings and reports in FebMar 2025.
Kewadin Casinos
February 10, 2025
•[ ransomware ]
Cyber incident forced shutdown of all five Kewadin casinos; phased reopening announced Feb 25Mar 3.
Northern Caribbean University
February 24, 2025
•[ data leak ]
Cyberattack crippled key systems; NCU warned students of possible data release.
Racine Unified School District
December 3, 2024
•[ data leak ]
Security breach of RUSD internal network; forensic probe said staff data may have been accessed; student data hosted externally unaffected.
India Post
February 17, 2025
•[ data leak, vulnerability, idor ]
IDOR flaw allowed retrieval of KYC documents by altering IDs in URLs; reports indicate thousands of records were exposed.
Cocospy & Spyic
February 14, 2025
•[ data leak, stalkerware, vulnerability ]
Vulnerability allowed unauthenticated access to servers exposing stalkerware customer lists and victims uploaded data.
Invest Hong Kong
February 22, 2025
•[ ransomware, data leak ]
Follow-up coverage of InvestHK ransomware; checking possible client/staff info exposure; later update: no evidence of leakage.
Patelco Credit Union
June 29, 2024
•[ ransomware, data leak, regulatory action ]
Ransomware encrypted Patelco systems on June 29, 2024, causing a near-total outage of digital banking through mid-July and exposing substantial member PII; DFPI later issued a consent order and $100,000 fine with mandated cybersecurity improvements.
