Forum Communications Company
January 14, 2025
•[ data leak ]
Forum Communications reported January access to files; 28,830 notified March 19.
Holt Group
March 27, 2025
•[ ransomware, data leak, legal action ]
Holt Group breach tied to Cactus with large data leak; suit filed.
Meigs Ems
March 20, 2025
•[ data leak, medical ]
Ambulance service asked patients to be vigilant after discovering a cyber breach.
Qantas
June 30, 2025
•[ data leak, third-party ]
Qantas detected unusual activity on a thirdparty contactcenter platform; a significant amount of customer data may be stolen; airline core systems remained secure.
Lorain County Government
May 30, 2025
•[ government, ransomware ]
Lorain County, Ohio detected a network security incident on May 30 2025 that forced courts and several county departments offline; officials reported no evidence of data theft or encryption, and investigations remain ongoing.
Glasgow City Council
June 19, 2025
•[ data leak, government, supply chain attack ]
Glasgow City Council detected malicious activity on servers managed by supplier CGI on 19 June 2025; online payment and school-absence systems were taken offline; possible theft of customer data under investigation; no financial systems affected.
Truth Social
June 21, 2025
•[ ddos, hacktivism, outage ]
Truth Social experienced a global outage on June 21 2025 attributed by self-identified Iran-aligned hacktivist group 313 Team to a DDoS attack; NetBlocks confirmed connectivity loss unrelated to ISP filtering; services restored within hours; no data theft confirmed.
Defense and critical-infrastructure entities in Ukraine
May 1, 2025
•[ phishing, unauthorized access, data leak ]
Rare Werewolf APT, a Russia-aligned espionage group, conducted spear-phishing and remote-administration toolbased intrusions in MayJune 2025 targeting defense and critical-infrastructure entities in Ukraine, resulting in unauthorized access and data exfiltration.
Zenith American Solutions, Inc.
September 6, 2024
•[ phishing, data leak ]
Unauthorized access to Zenith American Solutions network discovered September 6 2024 after an employee email account was compromised via phishing; over 12,000 individuals names, dates of birth, Social Security numbers, and benefit-plan documents potentially accessed. The firm notified regulators January 2025 and publicly disclosed in June 2025. No actor attribution or ransom demand reported.
Orion Telekom
June 13, 2025
•[ ddos, service disruption ]
Russian internet provider Orion Telekom reported repelling a DDoS attack without data loss; temporary service interruptions were observed.
Newsler.ru
June 1, 2025
•[ ddos ]
Newsler.ru, a regional Russian news outlet, experienced a DDoS attack on June 1, 2025 generating over 1,000 requests per second and disrupting access for about 1.5 hours; mitigation restored full service; attacker identity not confirmed.
NetVision (Cellcom Israel)
June 17, 2025
•[ phishing, vulnerability exploitation, hacktivism ]
Pro-Palestinian hackers exploited a vulnerability in NetVisions legacy email infrastructure to send forged phishing messages impersonating Israeli government domains; servers used for distribution of malicious emails; no confirmed data theft or ransom demand reported.
Cumberland County Hospital
February 21, 2025
•[ data leak ]
Unauthorized access between Feb 21 Apr 3 2025 to hospital file servers outside the EMR system exposed personal and medical data of about 36 k patients and employees; no operational disruption reported; public disclosure Jun 2 2025.
Eastern Idaho College
May 30, 2025
•[ malware ]
Malware infection discovered around May 30, 2025 forced College of Eastern Idaho to shut down all computer systems, including internet and email services, for several days; operations gradually restored; no data theft or encryption reported.
Multiple Thai government and news websites
June 9, 2025
•[ DDoS, hacktivism, service disruption ]
Cambodian hacktivist collective AnonSecKh launched DDoS attacks on June 9 2025 against Thai government and media websites hosted on common public-sector servers; traffic floods disrupted access to more than 20 sites for about two days before mitigation by ThaiCERT; no data theft or defacement reported.
Municipality of Tirana (City of Tirana)
June 20, 2025
•[ data leak, denial of service, state-sponsored attack ]
Iran-linked MOIS cluster EUROPIUM (Homeland Justice) conducted a coordinated cyberattack on Tiranas municipal government on Jun 20 2025, taking the city website offline and disrupting services; attackers claimed data theft and wiping of city databases; Microsoft and Albanian officials attributed the activity to MOIS-linked operators; restoration completed by Jun 24 2025.
Government of Paraguay (employee workstation compromise)
June 7, 2025
•[ data leak, infostealer, credential theft ]
Infostealer malware installed on a Paraguayan government employees computer harvested credentials and tokens, enabling attackers to exfiltrate databases containing personal information on effectively the entire national population. Security researchers confirmed millions of identity recordsincluding names, national IDs, and contact detailswere leaked online in early June 2025. The Record verified the exposure and found no evidence of ransomware or system disruption.
University of California San Diego (USArhythms subdomain)
June 22, 2025
•[ botnet, infrastructure compromise, remote code execution ]
CloudSEK and HackRead report the Androxgh0st botnet compromised a UC San Diego subdomain to host command-and-control/logging infrastructure using RCE and web shells; no confirmed data theft or service disruption reported.
Main Line Health
February 10, 2025
•[ data leak ]
Main Line Health, a Pennsylvania-based healthcare provider headquartered in Montgomery County, disclosed that attackers accessed Microsoft 365 employee email mailboxes in February 2025, exposing about 60,000 patient and employee records containing personal and medical information. No system disruption or encryption was reported.
Central Kentucky Radiology
October 16, 2024
•[ data leak, healthcare, PII ]
Unauthorized actor accessed CKRs network Oct 1618 2024 and copied files; ~167k people impacted; notifications issued mid-June 2025; data stolen from Lexington-based servers; no encryption or operational shutdown confirmed.
