OP Group
April 8, 2025
•[ ddos, hacktivism ]
Pro-Russian hacktivist group NoName057(16) launched DDoS attacks against OP Group, causing temporary disruption of online banking services in Finland.
Muswellbrook Shire Council
December 4, 2024
•[ ransomware, data leak ]
On December 4 2024, Muswellbrook Shire Council (NSW, Australia) detected a ransomware attack by the SafePay group. The attack encrypted portions of internal servers and resulted in theft and dark-web publication of sensitive employee and resident information. Council systems were progressively restored; investigation ongoing as of February 2025.
Word & Brown Insurance Administrators, Inc.
October 23, 2024
•[ data leak ]
Word & Brown Insurance Administrators, Inc. experienced unauthorized access to an employee workstation on or about October 23, 2024. The attacker accessed and copied insurance administration records containing personal and health-related information for clients and employees. No encryption or operational disruption was reported. Disclosure was filed December 23, 2024.
Laborers’ International Union of North America (LIUNA) Local 1184
November 17, 2024
•[ ransomware ]
On March 31, 2025, Laborers International Union of North America Local 1184 (LiUNA) filed a notice of data breach with the Attorney General of California after discovering that the organization was the target of a November 2024 ransomware attack.
Schuster Company
January 30, 2024
•[ data leak, personally identifiable information ]
An unauthorized third party gained access to Schuster Companys network between January 2330, 2024 and exfiltrated employee/driver personally identifiable information. The company publicly disclosed the incident on April 4, 2025.
Brown Paindiris & Scott LLP
November 9, 2023
•[ data leak ]
The Connecticut law firm Brown Paindiris & Scott disclosed a November 79, 2023 network intrusion that exposed client PII/PHI; notifications to affected individuals began in March 2025 and litigation followed.
Lyon Management Group, Inc. (Lyon Living)
March 15, 2024
•[ data leak ]
Lyon Management Group, Inc. (doing business as Lyon Living) reported that an unauthorized third party gained access to its network between March 14 and March 15, 2024, and acquired files containing personal information. The company stated that the breach involved names and other PII belonging to tenants and employees. There was no evidence of encryption or disruption, and the number of affected individuals was not disclosed.
Czech Government – Prime Minister’s X (Twitter) Account
April 8, 2025
•[ account takeover, hacktivism, disinformation ]
On April 8 2025, hacktivists compromised the official X account of Czech Prime Minister Petr Fiala and posted fabricated messages about Russian attacks and U.S. tariffs in protest of Czech government policies. Authorities confirmed the intrusion, removed the posts, and restored control within hours. No data theft or encryption occurred.
At least one government agency or state-owned enterprise in Southeast Asia
April 10, 2025
•[ data leak, espionage, government ]
The Record, citing Symantecs Threat Hunter Team, reported that the China-linked APT group Billbug (also known as Thrip and Lotus Blossom) compromised multiple government and critical infrastructure organizations in a Southeast Asian country in April 2025. The campaign involved exploitation of legitimate digital certificates and living-off-the-land tools to exfiltrate sensitive documents from government and military networks. No encryption or disruption was reported, and the activity is assessed as political espionage conducted under Chinas Ministry of State Security.
Racami LLC
April 5, 2025
•[ data leak, stolen credentials, infostealer ]
On April 5 2025, Hellcat listed Racami on its leak site, stating it had accessed and exfiltrated internal Jira project data using stolen credentials gathered through an infostealer campaign. No encryption or operational disruption was reported.
Office of the State’s Attorney for Baltimore City
March 19, 2025
•[ ransomware, data leak ]
Following a March 2025 intrusion, the Kairos ransomware group stole internal legal and police records from the Baltimore City States Attorneys Office and later published portions online; the office reported no service disruption but confirmed investigation of unauthorized access.
Hamilton County Sheriff’s Office
April 14, 2025
•[ ransomware, data leak ]
Ransomware attack by the Qilin group encrypted internal systems and took the Hamilton County (Tennessee) Sheriffs Office website offline; attackers demanded $300,000 and claimed data theft, but no exfiltration has been verified; systems fully restored by early May 2025.
Legends International
November 9, 2024
•[ data leak ]
On November 9 2024, Legends International detected unauthorized access to its internal systems. The investigation confirmed that an external actor exfiltrated files containing sensitive personal and financial data of employees and customers. No ransomware, encryption, or operational disruption was reported.
MacKay Memorial Hospital
February 6, 2025
•[ ransomware, data leak ]
Ransomware attack by Chinese actor CrazyHunter encrypted hospital systems and exfiltrated 32.5 GB of patient data; over 500 computers crashed, disrupting clinical services for several days; attacker linked to other Taiwanese targets.
SK Group (SK Inc.)
April 10, 2025
•[ ransomware, data leak ]
Qilin listed sk.com on its leak site on April 10 2025, claiming it stole approximately 1 TB of SK Group corporate data. SK has not publicly confirmed the breach or the claimed data volume, and no encryption or operational disruption has been reported.
VeriSource Services, Inc.
February 27, 2024
•[ data leak ]
VeriSource Services, Inc., a Texas-based HR and benefits administration firm, suffered a data breach in February 2024 after an unauthorized party accessed and downloaded approximately 4 million employee and dependent records from its systems. No encryption or operational disruption occurred. Disclosure was made in April 2025 following forensic review.
Yale New Haven Health
March 8, 2025
•[ data leak, healthcare ]
YNHHS reported that an unauthorized third party accessed its network and on March 8 2025 obtained copies of certain patient data. The health system disclosed the breach publicly on April 24 2025, stating 5.5M+ patients were affected. Data types vary by individual and may include demographics, patient type, medical record number, and in some cases Social Security numbers. No encryption or operational shutdown was reported.
Undisclosed South Korean company 5
November 1, 2024
•[ supply chain, malware ]
Lazarus leveraged infected supplier web pages to gain access to semiconductor sector organizations in Korea.
Undisclosed South Korean company 1
November 1, 2024
•[ watering-hole, zero-day ]
Watering-hole attack exploited zero-day vulnerabilities on legitimate South Korean websites, infecting visitors from IT and financial sectors.
Sensata Technologies
March 28, 2025
•[ ransomware, data leak ]
A ransomware attack between March 28 and April 6 2025 disrupted Sensata Technologies manufacturing, shipping, and support operations worldwide. The company confirmed that threat actors viewed and obtained internal files containing employee and personal data, including names, addresses, Social Security numbers, and financial and health information. Regulatory filings indicate at least 362 affected individuals (Maine AG notice). No ransomware group has claimed responsibility.
