Australian Retirement Trust
April 1, 2025
•[ data leak ]
Cyber criminals used stolen credentials to access ART member accounts during coordinated attacks on Australias pension funds; no confirmed financial loss.
Oregon Department of Environmental Quality (DEQ)
April 1, 2025
•[ ransomware, data leak ]
On April 1 2025, the Oregon Department of Environmental Quality experienced a ransomware attack attributed to the Rhysida group. The incident encrypted internal servers and disabled key systems, including statewide vehicle inspection services, email, web portals, and internal databases. Rhysida claimed to have exfiltrated over 1 million files and demanded a $2.5 million ransom, though DEQ has not confirmed data theft.
Hitachi Vantara
April 26, 2025
•[ ransomware, data leak ]
Akira ransomware infiltrated Hitachi Vantaras internal network, stealing corporate data and encrypting parts of its IT environment, prompting incident response and system restoration efforts.
Multiple French government and critical infrastructure organizations
April 30, 2025
•[ espionage, data leak, vulnerability exploitation ]
On April 30 2025, Frances national cybersecurity agency (ANSSI) attributed a campaign of at least twelve cyberattacks on French entities to Russias GRU 85th Main Special Service Center (Unit 26165), known as FANCYBEAR. The espionage activity targeted government, media, energy, and critical-infrastructure organizations via exploitation of vulnerable Cisco routers to gain persistence and exfiltrate sensitive data. No operational disruption was reported.
Co-op (The Co-operative Group)
April 22, 2025
•[ data leak, social engineering ]
6.5M member records stolen following a social-engineering-enabled breach; AD password-hash database also taken; Co-op temporarily shut down some IT systems.
Commvault
February 20, 2025
•[ vulnerability, unauthorized access ]
A zero-day vulnerability (CVE-2025-3928) in Commvaults cloud backup platform was exploited, allowing unauthorized access to internal systems and credentials. Commvault stated that customer backup data was not impacted, and no data theft has been confirmed.
Undisclosed South Korean company 4
November 1, 2024
•[ watering hole, exploit, threat actor ]
Watering-hole campaign redirected visitors from financial industry websites to Lazarus-controlled exploit servers.
Undisclosed South Korean company 3
November 1, 2024
•[ watering hole ]
Lazarus used watering-hole method to infect South Korean telecom employees via compromised industry web portals.
Marks & Spencer
April 19, 2025
•[ data leak ]
A cyberattack discovered over Easter weekend (April 19 2025) caused Marks & Spencer to take systems offline as a precaution, disrupting online orders and click-and-collect services. The company confirmed that attackers accessed customer personal data through a third-party contractors environment but found no evidence of ransomware or data encryption. Personal information accessed included names, contact information, and limited transaction data, but not passwords or full card details.
Hertz Global Holdings
December 1, 2024
•[ data leak, supply chain attack, vulnerability exploit ]
Hertz confirmed that customer personal data was stolen through exploitation of zero-day vulnerabilities in its vendor Cleo Communications managed file transfer platform between October and December 2024. The company completed analysis on April 2 2025 and disclosed the breach publicly on April 10 2025. The compromised data included names, contact information, drivers license numbers, and limited payment and identification information. No encryption or operational disruption was reported.
State Bar of Texas
January 28, 2025
•[ ransomware, data leak ]
The State Bar of Texas reported a ransomware-linked intrusion attributed to INC. Unauthorized access occurred between January 28 and February 9 2025 (intrusion start used as event_date = 2025-01-28), leading to exfiltration of personal data including names, SSNs, drivers license numbers, and limited financial or medical information. Approximately 2 700 individuals were notified. The Bar reported no evidence of encryption or operational disruption.
Health New Zealand (Te Whatu Ora) Central Region
March 27, 2025
•[ data leak ]
Health New Zealand said a malicious actor accessed staff safety records.
Advanced Computer Software Group Ltd
August 4, 2022
•[ ransomware, data leak ]
Ico fined Advanced after 2022 ransomware that disrupted Nhs services and leaked data.
Converse University
November 20, 2024
•[ data leak ]
Class action alleges delayed notice following a late-2024 data breach.
Pacific Rehabilitation Centers
February 1, 2025
•[ ransomware ]
Organization reported ransomware on an employee computer; restoration and notifications followed.
Square Enix
March 26, 2025
•[ ddos ]
Ffxiv servers were targeted by Ddos around the 7.2 update release.
Troy Hunt / Have I Been Pwned Mailing List
March 25, 2025
•[ phishing, data leak, account takeover ]
Phishing led to Mailchimp account takeover and export of subscriber list.
Beacon Health Three Rivers
December 2, 2024
•[ unauthorized access, third-party breach ]
Vendor Cps Solutions reported unauthorized email access Dec 24; hospital notified patients.
Resort Data Processing
February 19, 2025
•[ data breach, hospitality ]
Hospitality PMS vendor mailed breach letters on March 20, 2025 after cyber incident.
St. Joseph’s College Of Maine
January 24, 2024
•[ data leak, unauthorized access ]
College confirmed unauthorized network access in 20232024; notices sent March 2025.
