Recent Breaches
-
October 20, 2025 • Attackers accessed Somalias national e-visa application serverhosted on a misconfigured shared cPanel environmentallowing unauthorized retrieval of more than 125,000 visa applications and associated passport, biometric, contact, and payment data. U.S. and UK government alerts on November 13, 2025, warned that at least 35,000 travelers may have had their information compromised as the breach continued into mid-November.
-
November 5, 2025 • Qilin ransomware group listed Habib Bank AG Zurich on its leak site on November 5, 2025, claiming theft of more than 2.5 TB of data and nearly 2 million files. Cybernews verified screenshots showing stolen passport numbers, account balances, transaction notifications, and internal tool source code.
-
October 1, 2025 • cl0p exploited an Oracle-hosted cloud application used by GlobalLogic for HR data management, exposing approximately 10,000 employee records including names, email addresses, phone numbers, and employee identifiers, as part of a broader extortion campaign targeting Oracle cloud tenants.
-
November 17, 2025 • Eurofiber France confirmed that an unauthorized party accessed a customer account system and that verified customer data was offered for sale online; the company reported exposure of contact and account information but no operational disruption or compromise of passwords or payment data.
-
November 10, 2025 • A phone phishing scam enabled unauthorized access to Princeton Universitys Advancement database containing alumni, donor, student, parent, and some faculty information; the breach lasted under 24 hours and the university has not determined what data was viewed or extracted.
-
November 7, 2025 WOG reported a massive cyberattack that temporarily disrupted its online services; specialists restored most functions the same day and all services were fully operational shortly after.
-
December 27, 2023 • Alpha Omega Winery in Napa County, California experienced a data-focused cyber incident on or about December 2728, 2023 involving unauthorized access to systems containing sensitive personal and medical information; although the organization described the event as ransomware, no encryption, extortion, or operational disruption was confirmed, and affected individuals were notified in November 2025.
-
November 3, 2025 • Millicom was contacted by ShinyHunters on November 3 following an intrusion in which threat actors exfiltrated hundreds of millions of customer-related records; negotiations failed after Millicom attempted to make installment payments, leading the group to list the stolen data for sale on November 13.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed government agency where sensitive information was stolen via exploitation of application server infrastructure.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed chemical manufacturer where sensitive information was stolen via exploitation of application server infrastructure.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed financial institution where sensitive information was stolen via exploitation of application server infrastructure.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed major technology firm where sensitive information was stolen via exploitation of application server infrastructure.
-
November 6, 2025 • Checkout.com reported that an extortion actor accessed a legacy cloud file storage system and claimed to have obtained data; the company confirmed unauthorized access but no operational disruption or verified data theft.
-
October 25, 2025 • DoorDash reported that an unauthorized party accessed a company system on October 25 and obtained personal contact and order information; the company stated that sensitive personal or financial data was not accessed and no operational disruption occurred.
-
November 4, 2025 • Threat actor Kazu claimed theft of 353GB (?1.24M files) from Doctor Alliance LLC and demanded a $200,000 ransom; sample includes scanned patient PHI.
-
June 17, 2025 • According to Amazons threat intelligence team, Iranian-linked group MuddyWater provisioned attack infrastructure in mid-May 2025 and then used it on June 17, 2025 to access a compromised server streaming live CCTV footage from Jerusalem. Analysts assess that the group leveraged this access to gather real-time visual intelligence to refine targeting for a June 23 missile attack launched by Iran, in what Amazon terms cyber-enabled kinetic targeting. The case highlights how cyber intrusions against surveillance systems can directly support physical military operations without necessarily causing digital outages or data theft in the traditional sense.
-
August 29, 2025 • Healthcare management firm Personic Management Company (Personic Health) reported that an unauthorized actor accessed a third-party software platform used to process patient information on August 29, 2025. The intrusion, discovered on September 1, enabled the attacker to obtain data containing patients names and associated protected health information from Personic-affiliated providers. After engaging external cybersecurity experts and notifying law enforcement, Personic filed breach notices with state regulators and began sending letters to impacted individuals, warning them about identity-theft risks and the potential misuse of their medical data.
-
May 15, 2025 • Doctors Hospital at Renaissance (DHR Health) notified the U.S. Department of Health & Human Services that it had experienced a data breach impacting sensitive personal and protected health information. An unauthorized party accessed systems storing patient records, potentially exposing names, Social Security numbers, clinical details, and insurance data for an undisclosed number of individuals. The hospital has since notified the Texas Attorney General and begun mailing breach letters, while law firm investigators explore potential compensation claims for patients whose information may be at heightened risk of identity theft and medical fraud.
-
August 14, 2025 • Norway Savings Bank reported that a third-party data services provider suffered a security incident on August 14, 2025, allowing an external actor to access portions of its hosted environment that contained bank customer data. The breach potentially exposed personal and financial information for about 44,259 Maine residents, including identifiers and account details, although no misuse had been confirmed at the time of disclosure. The banks own systems were not directly compromised, but it engaged cybersecurity experts, reviewed transaction patterns, and began offering credit monitoring and identity-theft protection to affected customers.
-
October 27, 2025 • Italian furniture retailer Poltronesof disclosed that its IT environment suffered a ransomware attack on October 27, 2025, in which intruders compromised group servers and encrypted virtual machines, making several internal systems temporarily unavailable. The companys incident-response team isolated affected infrastructure and launched a forensic investigation, but it warned that attackers may have exfiltrated customer data including identification and contact details. While payment information was reportedly not impacted, customers were advised to be vigilant for phishing attempts and to change passwords used with company services.