Eastern Idaho College
May 30, 2025
•[ malware ]
Malware infection discovered around May 30, 2025 forced College of Eastern Idaho to shut down all computer systems, including internet and email services, for several days; operations gradually restored; no data theft or encryption reported.
Multiple Thai government and news websites
June 9, 2025
•[ DDoS, hacktivism, service disruption ]
Cambodian hacktivist collective AnonSecKh launched DDoS attacks on June 9 2025 against Thai government and media websites hosted on common public-sector servers; traffic floods disrupted access to more than 20 sites for about two days before mitigation by ThaiCERT; no data theft or defacement reported.
Municipality of Tirana (City of Tirana)
June 20, 2025
•[ data leak, denial of service, state-sponsored attack ]
Iran-linked MOIS cluster EUROPIUM (Homeland Justice) conducted a coordinated cyberattack on Tiranas municipal government on Jun 20 2025, taking the city website offline and disrupting services; attackers claimed data theft and wiping of city databases; Microsoft and Albanian officials attributed the activity to MOIS-linked operators; restoration completed by Jun 24 2025.
Government of Paraguay (employee workstation compromise)
June 7, 2025
•[ data leak, infostealer, credential theft ]
Infostealer malware installed on a Paraguayan government employees computer harvested credentials and tokens, enabling attackers to exfiltrate databases containing personal information on effectively the entire national population. Security researchers confirmed millions of identity recordsincluding names, national IDs, and contact detailswere leaked online in early June 2025. The Record verified the exposure and found no evidence of ransomware or system disruption.
University of California San Diego (USArhythms subdomain)
June 22, 2025
•[ botnet, infrastructure compromise, remote code execution ]
CloudSEK and HackRead report the Androxgh0st botnet compromised a UC San Diego subdomain to host command-and-control/logging infrastructure using RCE and web shells; no confirmed data theft or service disruption reported.
Main Line Health
February 10, 2025
•[ data leak ]
Main Line Health, a Pennsylvania-based healthcare provider headquartered in Montgomery County, disclosed that attackers accessed Microsoft 365 employee email mailboxes in February 2025, exposing about 60,000 patient and employee records containing personal and medical information. No system disruption or encryption was reported.
Central Kentucky Radiology
October 16, 2024
•[ data leak, healthcare, PII ]
Unauthorized actor accessed CKRs network Oct 1618 2024 and copied files; ~167k people impacted; notifications issued mid-June 2025; data stolen from Lexington-based servers; no encryption or operational shutdown confirmed.
Saudi Games 2024 Registration Platform
June 22, 2025
•[ data leak, hacktivism, database breach ]
Pro-Iranian hacktivist group Cyber Fattah claimed access to the Saudi Games 2024 registration platform backend (phpMyAdmin), leaking SQL dumps with thousands of athlete and visitor recordspassport and ID scans, medical forms, IBANsand staff/government credentials as a protest against Saudi authorities.
Rajkot Municipal Corporation (GIS Website)
June 3, 2025
•[ data leak ]
Cyberattack on the Rajkot Municipal Corporations GIS website in India resulted in exfiltration of roughly 400 GB of civic and citizen data; systems taken offline for investigation; no ransomware or encryption reported; attacker identity unconfirmed.
American Hospital Dubai
June 1, 2025
•[ ransomware, data leak ]
Ransomware group Gunra claimed on June 1 2025 to have breached AHDs Cerner Millennium EHR and exfiltrated a multi-terabyte dataset; figures include a claimed 450M records and 4,589,196 patients; no independent confirmation of volume or encryption.
HM Revenue and Customs (HMRC)
June 5, 2025
•[ data leak, compromised credentials, fraud ]
Compromised credentials and personal data from 100,000 taxpayer accounts used in fraudulent refund claims totaling 47 million.
NKS Super Speciality Hospital
June 10, 2025
•[ data leak ]
Hackers gained unauthorized access to servers of NKS Super Speciality Hospital in North Delhi around June 1011 2025, compromising patient and administrative records; hospital filed FIR; no encryption or ransom confirmed.
Hacken
June 20, 2025
•[ private key compromise, cryptocurrency theft, web3 ]
Ukrainian Web3 auditing company Hacken suffered a private-key compromise on its HAI token bridge on June 20 2025, enabling ~900 million HAI to be minted and about US$250K liquidated; token value fell ~98%, investigation ongoing.
Netherlands National Government Web Infrastructure
June 23, 2025
•[ ddos, hacktivism, disruption ]
Pro-Russian hacktivist group NoName057(16) conducted coordinated DDoS attacks against Dutch government websites hosted on shared infrastructure ahead of the NATO summit; disrupted access to at least four major portals for several hours; no data compromise reported.
Aflac
June 12, 2025
•[ social engineering, data leak ]
Threat actor Scattered Spider (UNC3944/0ktapus) used social-engineering to gain access to Aflacs U.S. network, accessing internal application servers that stored personal and claims data; no ransomware deployed and scope of exfiltration undetermined.
Cock.li
June 14, 2025
•[ data leak, vulnerability exploit, email accounts ]
The Germany-based email provider Cock.li confirmed that a hacker exploited a vulnerability in its Roundcube webmail application.
Черна писта
May 30, 2025
•[ denial of service ]
Bulgarian outlets reported a DDoS that attempted to take down the crash-map site created by 18-year-old Martin Atanasov; the hosting firm confirmed a mass attack and service impact before restoration.
ConnectWise
May 29, 2025
•[ nation-state attack, security incident, cloud security ]
ConnectWise reported a suspected nation-state breach impacting a small number of ScreenConnect cloud customers; investigation with Mandiant ongoing; no counts shared.
Legal Practice Board of Western Australia
May 28, 2025
•[ ransomware, data leak ]
The regulator confirmed a ransomware attack; threat actors claimed 300 GB exfiltration. The Board took some systems offline, investigated with external experts, and notified affected parties.
ASVT
May 27, 2025
•[ ddos, hacktivism, service disruption ]
Major DDoS on Russian ISP ASVT disrupted internet for tens of thousands in Moscow; ASVT attributed the attack to the pro-Kyiv IT Army.
