Undisclosed Ukrainian critical infrastructure organization
April 1, 2025
•[ malware, data exfiltration, wiper ]
The FSBs 18th Center for Information Security (Gamaredon) deployed PathWiper malware against an undisclosed Ukrainian critical-infrastructure operator in early April 2025, exfiltrating large volumes of operational data before executing a destructive wiper that caused temporary service degradation.
Civic Platform (Platforma Obywatelska)
April 2, 2025
•[ cyberattack, APT ]
The GRUs 85th Main Special Service Center (Unit 26165) (FANCYBEAR) targeted IT systems belonging to Polands ruling Civic Platform party in early April 2025; no operational disruption confirmed.
City of Lubbock Utilities
January 6, 2025
•[ data leak, skimming ]
The City of Lubbock Utilities, Texas, reported that malicious code was injected into its third-party online utility payment portal between December 18, 2024 and January 6, 2025. The injected script presented a fake payment window that captured customers cardholder information. According to the Texas state breach portal and public notices, 12,503 Texans were affected. Compromised data included names, billing addresses, payment card numbers, expiration dates, and CVV codes. Officials confirmed no impact to internal systems or encryption of city data.
German Association for Eastern European Studies (DGO)
March 27, 2025
•[ data leak, espionage, government ]
SVR (COZYBEAR) infiltrated email servers of the German Association for Eastern European Studies in late March 2025, exfiltrating correspondence and membership data; the German Interior Ministry formally attributed the intrusion to Russias foreign intelligence service on April 22 2025.
Harbin Asian Winter Games Organizing Committee
February 7, 2025
•[ cyberattack, state-sponsored attack ]
China accuses US of launching 'advanced' cyberattacks, names alleged NSA agents
City of Abilene
April 18, 2025
•[ ransomware, data leak ]
On April 18 2025, the City of Abilene, Texas, detected unresponsive servers and shut down affected systems. Reports state certain systems were taken offline and none of the card systems at government offices were working; emergency services remained up and running. The Qilin ransomware group later claimed responsibility; roughly 477 GB of data were reported stolen and some data encrypted/deleted.
Kintetsu World Express
April 23, 2025
•[ ransomware ]
Ransomware attack discovered April 23 2025 disrupted logistics processing across multiple global offices of Kintetsu World Express; several servers and workstations were encrypted, delaying shipments and customs documentation; no data theft confirmed.
LeoVegas Group
April 5, 2025
•[ data leak, infostealer, compromised credentials ]
On April 5 2025, Hellcat listed LeoVegas Group on its leak site, claiming exfiltration of internal data through compromised Jira credentials obtained from an infostealer. Hudson Rock verified the inclusion of LeoVegas in the same credential set. No encryption confirmed.
DaVita Inc.
April 12, 2025
•[ ransomware, data leak ]
On April 12, 2025, DaVita reported a ransomware incident that encrypted elements of its network and disrupted some operations. Subsequent disclosures confirmed theft of personal and medical information impacting over one million individuals.
Caisse Nationale de Sécurité Sociale (CNSS)
April 8, 2025
•[ data leak, hacktivism ]
Moroccos CNSS confirmed a major data breach claimed by the hacktivist group Jabaroot. The attackers accessed and leaked millions of social-security records belonging to private-sector employees and companies. CNSS stated no operational disruption or encryption occurred.
Professional Finance Company
February 5, 2025
•[ ransomware, data leak ]
A ransomware attack detected February 5 2025 disrupted Professional Finance Companys billing and collection systems and resulted in confirmed theft of patient financial and medical data for roughly 125,000 individuals. The firm disclosed the incident publicly in April 2025 and reported it to HHS as both a ransomware and data-exfiltration event.
Insignia Financial
April 1, 2025
•[ credential stuffing, data leak ]
Insignia Financial confirmed attempts to access customer portals using stolen credentials during April 2025 campaign; extent of compromise under investigation.
Deutsche Gesellschaft für Osteuropakunde (DGO)
March 30, 2025
•[ espionage, data leak, state-sponsored attack ]
In late March 2025, German officials reported a cyber-espionage incident targeting the Deutsche Gesellschaft fr Osteuropakunde (DGO), a nonprofit academic association focused on Eastern Europe. Investigators attributed the intrusion to Russias Foreign Intelligence Service (SVR), also known as Midnight Blizzard, APT29, or NOBELIUM. Attackers accessed email servers and internal communications for intelligence-gathering purposes. No data encryption or operational disruption was reported, indicating a stealthy exploitation of application servers.
Undisclosed South Korean company 6
November 1, 2024
•[ malware, watering hole attack, compromised web server ]
Lazarus Group compromised web servers frequented by IT professionals, infecting visitors through malicious redirects.
Baltimore City Public Schools
February 13, 2025
•[ ransomware, data leak ]
The Cloak ransomware group exfiltrated sensitive personal and student data from Baltimore City Public Schools in February 2025. While the attack was ransomware-related, no encryption or service disruption occurred; over 31,000 people were notified of data theft.
SK Telecom
April 19, 2025
•[ malware, data leak ]
Malware on internal servers enabled theft of USIM identifiers and related network data over an extended period.
Laboratory Services Cooperative (LSC)
December 30, 2024
•[ data leak ]
Laboratory Services Cooperative, a U.S. medical testing provider based in Texas, disclosed that unauthorized actors accessed and exfiltrated PHI and PII data of approximately 16 million individuals. No encryption or operational disruption occurred, and no threat actor has been publicly identified.
Fourlis Group (IKEA franchise operator)
November 27, 2024
•[ ransomware, data leak ]
A ransomware attack on November 27 2024 disrupted Fourlis Groups IT infrastructure supporting IKEA operations in Greece and other regional markets. The company reported that forensic investigators did not prove the leakage of personal data, confirming no verified exfiltration. The attack caused significant operational disruption, with reported recovery costs of approximately 20 million ( US $23 million) but no ransom payment.
Nsw Online Registry (Department Of Communities And Justice)
March 26, 2025
•[ data leak ]
Major breach led to downloads of sensitive court files including Avos and affidavits.
Columbia Eye Clinic
January 9, 2025
•[ data leak ]
Clinic confirmed January 913 network access to files with patient information.
