BitoPro Exchange
May 8, 2025
•[ cryptocurrency theft, unauthorized access, money laundering ]
Unauthorized access on May 8 2025 to BitoPro exchange hot wallets resulted in theft of about NT$345 million (US$11.5 million) in cryptocurrency; funds laundered via Tornado Cash, Thorchain, and Wasabi; attribution linked to North Koreas Lazarus Group (APT38); no operational disruption reported.
Oxford City Council
June 7, 2025
•[ data leak ]
On June 7 2025, Oxford City Council discovered unauthorized access to legacy IT systems containing historic data from election administration records (20012022). The council confirmed that core services were unaffected and found no evidence of large-scale data extraction or leaks. The attackers have not been identified.
WestJet Airlines
June 13, 2025
•[ data leak ]
On June 13 2025, WestJet experienced unauthorized access causing internal system and app disruption. A subsequent investigation confirmed that a sophisticated criminal actor exfiltrated passenger and employee data, including contact and travel records, though flight operations were unaffected. The company disclosed the data theft on September 29 2025.
United Natural Foods, Inc. (UNFI)
June 5, 2025
•[ ransomware ]
UNFI detected unauthorized activity in its IT systems on June 5 2025, believed to involve a financially motivated criminal intrusion that disrupted electronic ordering and product distribution to thousands of retail clients. The outage caused an estimated $350$400 million in lost sales before core systems were restored on June 26 2025; no data theft has been confirmed.
Ordine degli Psicologi della Lombardia
May 30, 2025
•[ ransomware, data breach ]
Italys data protection authority fined the Lombardy Psychologists Order 30,000 following a data breach; the Order states the incident traces to a serious ransomware attack in 2023, with no operational details disclosed in the article.
CCTV Pelintas, City of Pematangsiantar
May 13, 2025
•[ website defacement ]
City communications said a cyberattack began at 14:42 WIB on May 13, redirecting the public CCTV site to a gambling page; mitigation completed the same day with services restored after SSL propagation.
South African Airways
May 7, 2025
•[ cyberattack, service disruption ]
SAA reported a cyberattack that temporarily disrupted its website, mobile app, and multiple internal operational systems; containment actions minimized impact on core flight operations.
LockBit ransomware operation
May 7, 2025
•[ ransomware, data leak, deface ]
LockBits dark-web panels were defaced and a MySQL database dump with internal operational data was posted by an unknown actor.
WDEF-TV
May 6, 2025
•[ ransomware, data leak ]
WDEF Chattanooga TV station was listed by the Lynx ransomware group; actors posted sample HR/contract files while the station assessed impact.
Peruvian Government portal
May 5, 2025
•[ ransomware, data leak ]
Rhysida posted claims and alleged documents and demanded 5 BTC, but Perus government denied compromise of the federal platform; officials say only Piuras tax website had a separate March 29 cyber incident restored within 48 hours.
Romanian state websites
May 4, 2025
•[ ddos, hacktivism, government ]
Russia-aligned hacktivist group NoName057(16) claimed DDoS attacks on Romanian state and candidate websites on election day; Romanias DNSC confirmed the incidents and said sites were restored.
Albamon
May 2, 2025
•[ data leak ]
Albamon disclosed unauthorized access affecting 22,473 resume entries; the company reported the breach to KISA and notified impacted users.
Arriva Nederland
May 1, 2025
•[ ddos, hacktivism ]
Arrivas Dutch website was taken offline in a DDoS attack claimed by Russia-aligned hacktivists, with outages acknowledged locally; services were restored after mitigation.
R.C. Manubhai
May 1, 2025
•[ ransomware, data leak ]
Qilin ransomware listed Fijian hardware chain R.C. Manubhai on its leak site, sharing samples (passport scans, salary/loan data) and claiming broader exfiltration; victim confirmation not published at time of report.
PESEL state registry
May 1, 2025
•[ denial of service ]
A suspected cyberattack temporarily blocked access to Polands state registry systems, including the PESEL database used across government services; local reporting pointed to DDoS disruption with services restored the same day.
Western New Mexico University
April 13, 2025
•[ cyberattack, service disruption ]
Cyberattack beginning April 13 disrupted WNMUs website and other systems; campus Wi-Fi remained down and desktops required IT clearance; temporary website and workarounds used during finals period.
Department of Pensions
April 2, 2025
•[ ransomware, data theft ]
Department reported a ransomware attack first notified to CERT on April 2; officials overhauling systems and advising pensioners, with no detailed disruption reported; treated as data-theft incident pending further specifics.
Multiple e-commerce stores using Magento extensions
April 1, 2025
•[ supply-chain attack, malware, webshell ]
Supply-chain compromise of 21 Magento extensions backdoored since 2019, activated in April 2025; between 5001,000 e-stores impacted; at least one webshell observed.
Local media outlets in Azerbaijan
February 20, 2025
•[ targeted attack, data destruction, state-sponsored attack ]
Azerbaijans parliament commission head said APT29/Cozy Bear was behind a Feb 20 cyberattack that targeted internal servers at Baku TV and spread to other outlets, aiming to disrupt media infrastructure and alter/delete information; officials framed motive as retaliation over Russia-related media actions.
Valsoft Corporation
February 1, 2025
•[ data leak ]
Valsoft disclosed a February 2025 breach where attackers accessed company files for several days; personal information for over 160,000 people was compromised.
