Amherst College
March 3, 2025
•[ data leak ]
Amherst College disclosed unauthorized access to its email and payroll system. The college initiated an investigation with third-party cybersecurity experts, confirming on March 3 2025 that an unauthorized party had viewed and possibly copied sensitive personal information. Compromised data included employee names and Social Security numbers. The college notified the Massachusetts Attorney General and affected individuals on March 28 2025.
Igra-Service
April 5, 2025
•[ DDoS, hacktivism, service disruption ]
Between April 5 and 8, 2025, the IT Army of Ukraine claimed responsibility for a DDoS operation against Russian internet provider Igra-Service in Krasnoyarsk Krai. According to reports, traffic reached up to 55 Gbit/s, disrupting internet and television access for several days and causing some collateral outages to Rostelecom networks. The action was described by participants as a protest campaign.
Finnish election information portal (vaalit.fi)
April 8, 2025
•[ ddos, hacktivism, service disruption ]
Pro-Russian hacktivist group NoName057(16) carried out a DDoS attack against Finlands official election information site vaalit.fi on April 8 2025, temporarily preventing public access.
Taaleri Plc
April 8, 2025
•[ denial-of-service, hacktivism ]
Taaleri Plcs public website experienced temporary unavailability after a denial-of-service attack by pro-Russian hacktivist group NoName057(16) on April 8 2025.
Panostaja Oyj
April 8, 2025
•[ ddos, hacktivism ]
NoName057(16) hacktivists targeted Panostaja Oyjs website in a politically motivated DDoS campaign linked to Finlands ceasefire proposal on Ukraine, causing brief outages.
OP Group
April 8, 2025
•[ ddos, hacktivism ]
Pro-Russian hacktivist group NoName057(16) launched DDoS attacks against OP Group, causing temporary disruption of online banking services in Finland.
Muswellbrook Shire Council
December 4, 2024
•[ ransomware, data leak ]
On December 4 2024, Muswellbrook Shire Council (NSW, Australia) detected a ransomware attack by the SafePay group. The attack encrypted portions of internal servers and resulted in theft and dark-web publication of sensitive employee and resident information. Council systems were progressively restored; investigation ongoing as of February 2025.
Word & Brown Insurance Administrators, Inc.
October 23, 2024
•[ data leak ]
Word & Brown Insurance Administrators, Inc. experienced unauthorized access to an employee workstation on or about October 23, 2024. The attacker accessed and copied insurance administration records containing personal and health-related information for clients and employees. No encryption or operational disruption was reported. Disclosure was filed December 23, 2024.
Laborers’ International Union of North America (LIUNA) Local 1184
November 17, 2024
•[ ransomware ]
On March 31, 2025, Laborers International Union of North America Local 1184 (LiUNA) filed a notice of data breach with the Attorney General of California after discovering that the organization was the target of a November 2024 ransomware attack.
Schuster Company
January 30, 2024
•[ data leak, personally identifiable information ]
An unauthorized third party gained access to Schuster Companys network between January 2330, 2024 and exfiltrated employee/driver personally identifiable information. The company publicly disclosed the incident on April 4, 2025.
Brown Paindiris & Scott LLP
November 9, 2023
•[ data leak ]
The Connecticut law firm Brown Paindiris & Scott disclosed a November 79, 2023 network intrusion that exposed client PII/PHI; notifications to affected individuals began in March 2025 and litigation followed.
Lyon Management Group, Inc. (Lyon Living)
March 15, 2024
•[ data leak ]
Lyon Management Group, Inc. (doing business as Lyon Living) reported that an unauthorized third party gained access to its network between March 14 and March 15, 2024, and acquired files containing personal information. The company stated that the breach involved names and other PII belonging to tenants and employees. There was no evidence of encryption or disruption, and the number of affected individuals was not disclosed.
Czech Government – Prime Minister’s X (Twitter) Account
April 8, 2025
•[ account takeover, hacktivism, disinformation ]
On April 8 2025, hacktivists compromised the official X account of Czech Prime Minister Petr Fiala and posted fabricated messages about Russian attacks and U.S. tariffs in protest of Czech government policies. Authorities confirmed the intrusion, removed the posts, and restored control within hours. No data theft or encryption occurred.
At least one government agency or state-owned enterprise in Southeast Asia
April 10, 2025
•[ data leak, espionage, government ]
The Record, citing Symantecs Threat Hunter Team, reported that the China-linked APT group Billbug (also known as Thrip and Lotus Blossom) compromised multiple government and critical infrastructure organizations in a Southeast Asian country in April 2025. The campaign involved exploitation of legitimate digital certificates and living-off-the-land tools to exfiltrate sensitive documents from government and military networks. No encryption or disruption was reported, and the activity is assessed as political espionage conducted under Chinas Ministry of State Security.
Racami LLC
April 5, 2025
•[ data leak, stolen credentials, infostealer ]
On April 5 2025, Hellcat listed Racami on its leak site, stating it had accessed and exfiltrated internal Jira project data using stolen credentials gathered through an infostealer campaign. No encryption or operational disruption was reported.
Office of the State’s Attorney for Baltimore City
March 19, 2025
•[ ransomware, data leak ]
Following a March 2025 intrusion, the Kairos ransomware group stole internal legal and police records from the Baltimore City States Attorneys Office and later published portions online; the office reported no service disruption but confirmed investigation of unauthorized access.
Hamilton County Sheriff’s Office
April 14, 2025
•[ ransomware, data leak ]
Ransomware attack by the Qilin group encrypted internal systems and took the Hamilton County (Tennessee) Sheriffs Office website offline; attackers demanded $300,000 and claimed data theft, but no exfiltration has been verified; systems fully restored by early May 2025.
Legends International
November 9, 2024
•[ data leak ]
On November 9 2024, Legends International detected unauthorized access to its internal systems. The investigation confirmed that an external actor exfiltrated files containing sensitive personal and financial data of employees and customers. No ransomware, encryption, or operational disruption was reported.
MacKay Memorial Hospital
February 6, 2025
•[ ransomware, data leak ]
Ransomware attack by Chinese actor CrazyHunter encrypted hospital systems and exfiltrated 32.5 GB of patient data; over 500 computers crashed, disrupting clinical services for several days; attacker linked to other Taiwanese targets.
SK Group (SK Inc.)
April 10, 2025
•[ ransomware, data leak ]
Qilin listed sk.com on its leak site on April 10 2025, claiming it stole approximately 1 TB of SK Group corporate data. SK has not publicly confirmed the breach or the claimed data volume, and no encryption or operational disruption has been reported.
