Hertz Global Holdings
December 1, 2024
•[ data leak, supply chain attack, vulnerability exploit ]
Hertz confirmed that customer personal data was stolen through exploitation of zero-day vulnerabilities in its vendor Cleo Communications managed file transfer platform between October and December 2024. The company completed analysis on April 2 2025 and disclosed the breach publicly on April 10 2025. The compromised data included names, contact information, drivers license numbers, and limited payment and identification information. No encryption or operational disruption was reported.
State Bar of Texas
January 28, 2025
•[ ransomware, data leak ]
The State Bar of Texas reported a ransomware-linked intrusion attributed to INC. Unauthorized access occurred between January 28 and February 9 2025 (intrusion start used as event_date = 2025-01-28), leading to exfiltration of personal data including names, SSNs, drivers license numbers, and limited financial or medical information. Approximately 2 700 individuals were notified. The Bar reported no evidence of encryption or operational disruption.
Health New Zealand (Te Whatu Ora) Central Region
March 27, 2025
•[ data leak ]
Health New Zealand said a malicious actor accessed staff safety records.
Advanced Computer Software Group Ltd
August 4, 2022
•[ ransomware, data leak ]
Ico fined Advanced after 2022 ransomware that disrupted Nhs services and leaked data.
Converse University
November 20, 2024
•[ data leak ]
Class action alleges delayed notice following a late-2024 data breach.
Pacific Rehabilitation Centers
February 1, 2025
•[ ransomware ]
Organization reported ransomware on an employee computer; restoration and notifications followed.
Square Enix
March 26, 2025
•[ ddos ]
Ffxiv servers were targeted by Ddos around the 7.2 update release.
Troy Hunt / Have I Been Pwned Mailing List
March 25, 2025
•[ phishing, data leak, account takeover ]
Phishing led to Mailchimp account takeover and export of subscriber list.
Beacon Health Three Rivers
December 2, 2024
•[ unauthorized access, third-party breach ]
Vendor Cps Solutions reported unauthorized email access Dec 24; hospital notified patients.
Resort Data Processing
February 19, 2025
•[ data breach, hospitality ]
Hospitality PMS vendor mailed breach letters on March 20, 2025 after cyber incident.
St. Joseph’s College Of Maine
January 24, 2024
•[ data leak, unauthorized access ]
College confirmed unauthorized network access in 20232024; notices sent March 2025.
Forum Communications Company
January 14, 2025
•[ data leak ]
Forum Communications reported January access to files; 28,830 notified March 19.
Holt Group
March 27, 2025
•[ ransomware, data leak, legal action ]
Holt Group breach tied to Cactus with large data leak; suit filed.
Meigs Ems
March 20, 2025
•[ data leak, medical ]
Ambulance service asked patients to be vigilant after discovering a cyber breach.
Qantas
June 30, 2025
•[ data leak, third-party ]
Qantas detected unusual activity on a thirdparty contactcenter platform; a significant amount of customer data may be stolen; airline core systems remained secure.
Lorain County Government
May 30, 2025
•[ government, ransomware ]
Lorain County, Ohio detected a network security incident on May 30 2025 that forced courts and several county departments offline; officials reported no evidence of data theft or encryption, and investigations remain ongoing.
Glasgow City Council
June 19, 2025
•[ data leak, government, supply chain attack ]
Glasgow City Council detected malicious activity on servers managed by supplier CGI on 19 June 2025; online payment and school-absence systems were taken offline; possible theft of customer data under investigation; no financial systems affected.
Truth Social
June 21, 2025
•[ ddos, hacktivism, outage ]
Truth Social experienced a global outage on June 21 2025 attributed by self-identified Iran-aligned hacktivist group 313 Team to a DDoS attack; NetBlocks confirmed connectivity loss unrelated to ISP filtering; services restored within hours; no data theft confirmed.
Defense and critical-infrastructure entities in Ukraine
May 1, 2025
•[ phishing, unauthorized access, data leak ]
Rare Werewolf APT, a Russia-aligned espionage group, conducted spear-phishing and remote-administration toolbased intrusions in MayJune 2025 targeting defense and critical-infrastructure entities in Ukraine, resulting in unauthorized access and data exfiltration.
Zenith American Solutions, Inc.
September 6, 2024
•[ phishing, data leak ]
Unauthorized access to Zenith American Solutions network discovered September 6 2024 after an employee email account was compromised via phishing; over 12,000 individuals names, dates of birth, Social Security numbers, and benefit-plan documents potentially accessed. The firm notified regulators January 2025 and publicly disclosed in June 2025. No actor attribution or ransom demand reported.
