Broadcom Inc
September 15, 2024
•[ ransomware, data leak ]
Ransomware on ADP partner Business Systems House led to theft of Broadcom employee data; leaks appeared in Dec 2024 and full impact was clarified to Broadcom in May 2025.
Chapman & Roberts PA
July 1, 2024
•[ data leak, law firm, pii ]
Greensboro immigration law firm disclosed a breach dating back to July 2024 that exposed client/individual PII; notifications issued in May 2025.
Behavioral Health Resources
November 20, 2024
•[ data breach, data leak ]
Unauthorized actor accessed Behavioral Health Resources network in Nov 2024, exfiltrating client PII and medical records; organization confirmed breach via Maine AG filing and began notifications in Apr 2025.
NRC Media B.V. (publisher of NRC Handelsblad)
April 28, 2025
•[ DDoS, hacktivism ]
On April 28, 2025, the Dutch news organization NRC Media suffered a DDoS attack that rendered nrc.nl unreachable for nearly a full day; pro-Russian hacktivist group NoName057(16) claimed responsibility, linking the attack to Dutch support for Ukraine.
Alternate Solutions Health Network, LLC
May 30, 2024
•[ phishing, data leak ]
On or around May 30 2024, an unauthorized actor accessed an employee email account at Alternate Solutions Health Network. The account was secured after discovery; investigation concluded February 14 2025 and confirmed exposure of PHI. Notifications were issued beginning April 14 2025.
Undisclosed Online Betting Organization
April 3, 2025
•[ DDoS, gambling, sports ]
A multivector DDoS attack was recorded on April 3 2025 targeting an online betting platform; the flooding began at ~67 Gbps at 11:15 UTC, escalated to ~217 Gbps by 11:23, peaked at ~965 Gbps (~0.965 Tbps) by 11:36, then declined to ~549 Gbps by 12:41 before ending; the timing coincided with a major NHL milestone (Alexander Ovechkin tying the all-time goals record).
St. Anthony Hospital (SSM Health)
August 6, 2024
•[ malware, data leak, insider threat ]
On August 6 2024, Jeffrey Bowie, CEO of cybersecurity firm Veritaco, allegedly installed malware on computers at St. Anthony Hospital (SSM Health) in Oklahoma City. The malware took screenshots roughly every 20 minutes and transmitted them to an external address. The activity was detected and contained quickly, and hospital officials reported no patient or clinical data access. Bowie was arrested on April 16 2025.
TickChak (external ticketing platform used by IDF units)
April 16, 2025
•[ data leak, hacktivism ]
A hacktivist using the alias Persian Prince accessed and leaked data from TickChak, an Israeli ticketing platform reportedly used by IDF units. The leak, publicized on April 16 2025, exposed personal details of tens of thousands of soldiers, including names, national ID numbers, and phone numbers. No ransom or sale was reported; the data was posted publicly to protest Israeli military actions.
OCH Regional Medical Center
September 6, 2023
•[ data leak ]
OCH data breach exposed 67K patient files
CMC Corporation
April 12, 2025
•[ ransomware, data leak ]
Ransomware group Crypto24 carried out a double-extortion attack against Vietnam-based CMC Corporation on April 12, 2025, exfiltrating roughly 2 TB of internal data and encrypting subsidiary servers for less than one day.
Democratic Party of Korea
April 13, 2025
•[ ddos ]
The Democratic Party of Korea reported three distributed denial-of-service (DDoS) attacks on April 13, 2025, disrupting access to its official website during an internal vote on presidential primary rules; no data loss or operational damage occurred.
Fanpage.it / Francesco Cancellato
January 31, 2025
•[ spyware, espionage, zero-click ]
Francesco Cancellato, editor-in-chief of Fanpage.it, was targeted with the Israeli-made Graphite spyware developed by Paragon Solutions, delivered via WhatsApp zero-click exploit. Citizen Lab and CPJ linked the campaign to a likely state client of Paragon, with political-espionage motives tied to Fanpages undercover investigation exposing neo-fascist youth elements within Italys ruling party. No confirmed infection or data exfiltration publicly reported.
Ukrainian government and military entities
April 1, 2025
•[ malware, data leak, espionage ]
Russian FSB 18th Center for Information Security (Gamaredon) deployed updated GammaSteel malware to exfiltrate sensitive data from Ukrainian government and defense networks in an ongoing espionage campaign; no operational disruption reported.
City of Forest Park
July 24, 2024
•[ data leak ]
City of Forest Park disclosed that a July 24, 2024 network intrusion led to unauthorized access and potential exposure of personal data; as of disclosure, no misuse or data volume reported and no encryption indicated.
Finnish Parliamentary Parties
April 8, 2025
•[ ddos, hacktivism ]
Pro-Russian hacktivist group NoName057(16) conducted DDoS attacks against websites of Finnish parliamentary parties, temporarily disrupting access for several hours.
Great Plains Federal Credit Union
April 8, 2025
•[ malware, jackpotting ]
On April 8, 2025, two ATMs at Great Plains Federal Credit Union branches in Salina, Kansas, were compromised in a jackpotting incident; attackers installed malware on the ATM OS to force illicit cash dispensing. Amount stolen not disclosed; no data theft reported.
Kelly & Associates Insurance Group, Inc.
December 12, 2024
•[ data leak ]
Kelly Benefits (Kelly & Associates Insurance Group, Inc.) disclosed that an unauthorized actor accessed its network between Dec 1217, 2024 and stole data affecting ~553,660 people. No encryption or operational disruption was reported; notifications began April 9, 2025.
Hazleton Anesthesia Services
November 21, 2024
•[ data leak ]
On Nov 21, 2024, Somnia (management company) identified suspicious activity in its email environment and later confirmed unauthorized access to a limited number of accounts that included Hazleton Anesthesia Services. Review completed Mar 10, 2025; public substitute notice issued Mar 31, 2025. No encryption or operational disruption reported.
Individual retail investors using Japanese online brokerage platforms
April 5, 2025
•[ credential stuffing, account abuse ]
Between April 58 2025, foreign criminal actors compromised login credentials of Japanese retail investors and placed unauthorized securities trades through online brokerage portals; Japans Financial Services Agency and police launched an investigation into coordinated credential-stuffing and account abuse.
Aigües de Mataró
April 21, 2025
•[ ransomware ]
Ransomware encrypted Aiges de Matars corporate servers on April 21 2025, taking the website offline and delaying customer services. The utility reported no evidence of data exfiltration; water service and quality remained unaffected. No actor has claimed responsibility.
