Keir Giles (UK academic)
May 22, 2025
•[ social engineering, phishing, data leak ]
Targeted social-engineering campaign impersonating U.S. State Department tricked Keir Giles into generating app-specific passwords, allowing a nation-state actor to access his Gmail account data stored on Google servers; no evidence of intrusion into affiliated institutional networks.
Radford City Public Schools
June 10, 2025
•[ cyberattack ]
Cyberattack on Radford City Public Schools in Virginia disrupted portions of the districts internal network on June 10, 2025; systems taken offline for investigation; no ransomware encryption or data theft reported.
Select Medical Holdings Corporation
January 15, 2025
•[ data leak ]
Select Medical, a healthcare management company headquartered in Pennsylvania, disclosed unauthorized access to its internal network first detected in January 2025. Approximately 40,000 individuals PHI was exfiltrated, including names, Social Security numbers, and medical information. No ransomware or operational disruption was reported.
Virgin Islands Lottery
March 17, 2025
•[ ransomware ]
Ransomware attack discovered March 17 2025 encrypted the Virgin Islands Lotterys servers, phones, and software, halting operations across both districts. Attackers demanded a $1 million ransom, which was not paid. Systems were rebuilt from backups and restored by May 31 2025. No confirmed data theft or group attribution publicly reported.
Scania AB
May 28, 2025
•[ data leak, extortion ]
Scania confirms insurance claim data breach in extortion attempt
Nobitex Cryptocurrency Exchange
June 18, 2025
•[ hacktivism, cryptocurrency, theft ]
Predatory Sparrow (pro-Israel hacktivist group) breached Irans Nobitex cryptocurrency exchange on June 18 2025, transferring roughly $90 million USD in assets to unrecoverable wallet addresses; action was intended to punish Iranian regime-linked financial infrastructure; no evidence of ransom or profit motive.
Erie Insurance
June 7, 2025
•[ data leak, ransomware ]
Erie Insurance detected unauthorized network activity on June 7 2025, prompting containment measures and temporary isolation of systems. The insurer reported the incident to regulators and stated there was no evidence of ransomware or confirmed data theft, though review of potential personal-information exposure remained ongoing.
Zoomcar Holdings, Inc.
June 9, 2025
•[ data leak ]
Unauthorized third-party access discovered on June 9 2025 exposed personal data of approximately 8.4 million Zoomcar users. The company confirmed no financial or password data was affected and reported no service disruption. No actor has claimed responsibility, and investigation is ongoing.
Cartier
May 15, 2025
•[ data leak ]
Cartier disclosed that an unauthorized party gained temporary access to its systems in mid-May 2025 and obtained limited client information (names, email addresses, countries). No financial data, passwords, or banking information were compromised.
Tupolev
June 3, 2025
•[ data leak, website defacement, state-sponsored ]
Ukrainian intelligence (GUR) compromised Tupolevs internal servers and exfiltrated 4.4 GB of files including personnel records, procurement documents, internal memos, and meeting minutes. The companys website was briefly defaced following the breach.
Endue Software
February 17, 2025
•[ data leak ]
Law firm press release announcing an investigation into a reported Endue Software data breach.
UCLH & University Hospital Southampton NHS Trusts
May 29, 2025
•[ vulnerability exploit, data leak ]
Hackers exploited a critical Ivanti EPMM flaw affecting two NHS trusts; data theft involved staff device details, with no patient data accessed according to UCLH; NHSE investigating.
Victoria's Secret
May 29, 2025
•[ ransomware ]
Victoria's Secret took down its website and limited some store services as part of response to a security incident; recovery in progress at time of report.
The Salvation Army
May 29, 2025
•[ ransomware, data leak ]
Media cite Chaos ransomware listing The Salvation Army and claim of data exfiltration, but no verified confirmation from the organization at time of reporting.
Multiple Thai bank ATMs
May 28, 2025
•[ skimming, malware ]
Police arrested a Bulgarian for allegedly installing devices/malware on ATMs; article cites arrests rather than a confirmed disruptive/theft effect on a named victim org. Not coded as a cyberattack event.
York County
May 27, 2025
•[ data leak, third-party ]
County alerted residents to a possible data privacy event involving a vendor.
The Coca-Cola Company
May 22, 2025
•[ ransomware, data leak ]
Everest ransomware actors claimed theft of data on ~959 Coca-Cola employees in the Middle East (UAE, Oman, Bahrain); separate group also claimed a breach at Coca-Cola Europacific Partners. Coded as exploitive data theft based on reporting.
Undisclosed United States local governments
May 22, 2025
•[ data leak, zero-day exploit ]
Exfiltration via now-patched Trimble Cityworks zero-day; multiple U.S. local governments breached.
International Criminal Court (ICC)
June 30, 2025
•[ cyberattack, espionage ]
ICC reported a cyberattack detected and contained.Impact and data access undisclosed. This follows a 2023 espionage incident.
City of Durant
June 1, 2025
•[ ransomware, data leak ]
City of Durant experienced a cyber intrusion on June 1 2025 attributed to INC
