Pulmonary Physicians Of South Florida
February 19, 2025
•[ ransomware, data leak ]
Ransomware Group Listed Provider And Posted Screenshots Suggesting Patient Records Exposure.
Tj-Actions
March 14, 2025
•[ data leak, supply chain attack, credential exposure ]
A popular GitHub Action called tj-actions/changed-files was compromised: an attacker modified its code and version tags so that when used in CI/CD workflows it executed a script that dumped runner memory and exposed secrets (AWS keys, GitHub PATs, npm tokens, private RSA keys) in publicly accessible logs. The incident, tracked as CVE-2025-30066 (and linked to CVE-2025-30154 for a related Action), affected thousands of repositories across many organizations. Users are advised to stop using the impacted versions, rotate all credentials, and review any workflows that ran between March 1415, 2025.
Polish Space Agency (Polsa)
March 2, 2025
•[ cyberattack, network intrusion, service disruption ]
The Polish Space Agency (POLSA) went offline after detecting a cyberattack that forced it to disconnect its internal network from the internet to contain the incident. National cybersecurity teams, including CSIRT NASK and CSIRT MON, were engaged to assist in investigating and restoring operations. While POLSA did not disclose specific details, internal sources suggested that email systems were compromised. As a member of the European Space Agency, POLSA temporarily suspended several digital services while ensuring containment, system recovery, and investigation into potential espionage or disruption motives behind the attack.
Bell & Graham
January 16, 2025
•[ ransomware, data leak ]
On 2025-01-16, Bell & Graham confirmed that the SafePay ransomware group stole approximately 15 GB of client data from its on-premises servers. The firm stated that files were taken but not encrypted, and live cloud systems were unaffected.
Oral Roberts University
December 15, 2024
•[ data leak ]
Between December 15 and December 17, 2024, an unauthorized actor accessed ORU systems and took certain files. Investigation determined some files contained names and Social Security numbers. Notifications were mailed by February 19, 2025.
Black Hills Regional Eye Institute
January 4, 2025
•[ data leak ]
In early January 2025, the Black Hills Regional Eye Institute detected unauthorized access lasting five days (Jan 48). A forensic review confirmed exfiltration of patient and employee data including PII and PHI. The breach affected about 106 k individuals and was disclosed August 29 2025. No encryption reported; data stolen for likely financial gain.
Ottawa Family Physicians
December 10, 2024
•[ data leak, unencrypted data, healthcare ]
Between December 1015, 2024, an unauthorized actor accessed Ottawa Family Physicians systems and exfiltrated patient data from an internal server. The EMR database was not affected. Data types included personal identifiers, financial, and health information. No encryption was used, and no operational disruption occurred. The incident was reported to HHS on February 13, 2025.
Pump.fun X account
February 26, 2025
•[ account takeover, social engineering, cryptocurrency scam ]
The official X account of Pump.fun was hijacked on February 26, 2025, and used to promote a fake governance token named PUMP and other scam cryptocurrencies, misleading users and causing financial harm before the fraudulent posts were removed and access was restored.
Undisclosed U.S. Engineering and Construction Firm
December 29, 2024
•[ ransomware, data leak ]
On December 29 2024, Anubis listed an unnamed U.S. firm from the engineering and construction sector on its leak site. KELA reported the inclusion, and SecurityWeek referenced the finding. Stolen material reportedly included project and client documentation. No encryption or service interruption confirmed.
Anne Arundel County
February 22, 2025
•[ data leak ]
Between Jan 28 and Feb 22 2025, attackers accessed and downloaded files from a limited portion of Anne Arundel Countys network, including health-related systems. County officials confirm data was not encrypted, but certain files were exfiltrated. A subsequent HHS/OCR filing in May 2025 listed roughly 500 affected individuals.
Santa Barbara County Department of Social Services
January 1, 2025
•[ skimming, theft, data leak ]
County reported widespread EBT skimming causing mass card cancellations and benefit delays for students and residents.
Hewlett Packard Enterprise
February 5, 2025
•[ data leak ]
HPE filed notice with MA AG after a cybersecurity incident allowed access to consumer data; notification letters sent Feb 5, 2025.
Ally Financial
February 27, 2025
•[ data leak ]
Class action alleges a data breach at Ally Financial exposed personal data of ~4.2M customers; litigation filed Feb 2025.
Catholic Charities of Southern Nevada
June 22, 2024
•[ data leak, PII/PHI exposure ]
Suspicious activity detected June 22, 2024; later notice confirms sensitive PII/PHI impacted.
Phoenix Rehabilitation & Nursing Center
July 20, 2024
•[ data leak, third-party breach ]
Third-party vendor breach exposed PHI/PII for Phoenix Rehab; access confirmed July 20, 2024; notifications sent Jan 28, 2025.
Charleston Area Medical Center
October 2, 2024
•[ phishing, data leak ]
Phishing attack on multiple email users; unauthorized access to one mailbox between Oct 23, 2024, possibly exposing personal and health information. No other systems impacted.
Italian Banks
February 21, 2025
•[ ddos, hacktivism ]
ProRussia hacktivist group NoName057 launched DDoS attacks against Italian banks (Mediobanca, Nexi, Intesa, Monte dei Paschi) in retaliation for statements by the Italian president; no significant disruption according to national cybersecurity agency
Leonardo S.p.A.
February 21, 2025
•[ ddos, hacktivism ]
Pro-Russian hacktivist group NoName057(16) launched DDoS attacks against multiple Italian entities; on Feb 21, 2025 (Day 5) several sites including Leonardo and Edison were unreachable. ACN provided support and mitigation guidance; no data theft reported.
the private provider (contractor) supplying NHS services
February 20, 2025
•[ ransomware, data leak ]
A private provider serving the NHS was hit by ransomware, disrupting network operations and potentially exposing patient or internal data, causing service interruptions in NHS operations dependent on it.
NewsBank
June 20, 2024
•[ data leak, employee data, class action ]
Employee data breach at NewsBank discovered around July 1, 2024; investigation found unauthorized access June 20July 1, 2024 to systems holding employee PII (names, SSNs, DL, financial/credit-debit data; possible medical info). Class action reported Feb 20, 2025; no actor publicly identified.
