Recent Breaches
-
November 20, 2025 • A ransomware attack against Danish automotive IT provider DocuBizz resulted in theft of drivers license information, CPR numbers, bank account numbers, and other customer data belonging to car dealerships and their clients. No encryption or service disruption has been confirmed.
-
November 13, 2025 • On November 13, 2025, additional Danish government websites experienced outages due to external denial-of-service attacks. The Danish Civil Protection Agency confirmed that several sites and companies were affected, and the pro-Russian hacktivist group NoName057(16) claimed responsibility for the coordinated campaign. No data loss was reported.
-
November 13, 2025 • On November 13, 2025, Danish defense contractor Terma experienced a disruption to its public-facing website due to an external denial-of-service attack. The incident was attributed to the pro-Russian hacktivist group NoName057(16). Terma confirmed that no data were lost.
-
November 13, 2025 • On November 13, 2025, the website of Denmark's Ministry of Transport was disrupted by an external denial-of-service attack. The pro-Russian hacktivist group NoName057(16) claimed responsibility for the attack as part of a broader campaign targeting Danish digital infrastructure. No data loss was reported.
-
November 13, 2025 • On November 13, 2025, Denmark's national citizen service portal Borger.dk was targeted and disrupted by an external denial-of-service attack. The pro-Russian hacktivist group NoName057(16) claimed responsibility on Telegram. No data loss occurred.
-
November 14, 2025 • On November 14, 2025, the Storeblt website operated by Sund & Blt was rendered inaccessible due to an external denial-of-service attack. Sund & Blt confirmed the DDoS incident, and DR reported that the pro-Russian hacktivist group NoName057(16) claimed responsibility on Telegram as part of a broader campaign targeting Danish entities. No data loss occurred.
-
August 26, 2025 • Marshfield Clinic Health System reported that an unauthorized party accessed certain systems on August 26 and may have viewed personal and clinical information; the organization noted no operational disruption, no misuse evidence, and no confirmed actor attribution.
-
August 20, 2025 • A ransomware group known as Sinobi claimed on August 20, 2025, to have obtained data belonging to Pittsburgh Gastroenterology Associates. Reports indicate approximately 198GB of patient data were exfiltrated following unauthorized access to internal systems. The organization reported no service disruption or encryption, confirming only exfiltration of stored patient files.
-
April 29, 2025 • Healthcare Therapy Services, Inc. reported that on April 29 it discovered unusual activity involving its email systems; investigation concluded on September 9 that patient personal and protected health information may have been affected, including SSNs, drivers license numbers, financial account information, and medical information; no misuse or operational disruption was reported.
-
October 20, 2025 • Attackers accessed Somalias national e-visa application serverhosted on a misconfigured shared cPanel environmentallowing unauthorized retrieval of more than 125,000 visa applications and associated passport, biometric, contact, and payment data. U.S. and UK government alerts on November 13, 2025, warned that at least 35,000 travelers may have had their information compromised as the breach continued into mid-November.
-
November 5, 2025 • Qilin ransomware group listed Habib Bank AG Zurich on its leak site on November 5, 2025, claiming theft of more than 2.5 TB of data and nearly 2 million files. Cybernews verified screenshots showing stolen passport numbers, account balances, transaction notifications, and internal tool source code.
-
October 1, 2025 • cl0p exploited an Oracle-hosted cloud application used by GlobalLogic for HR data management, exposing approximately 10,000 employee records including names, email addresses, phone numbers, and employee identifiers, as part of a broader extortion campaign targeting Oracle cloud tenants.
-
November 17, 2025 • Eurofiber France confirmed that an unauthorized party accessed a customer account system and that verified customer data was offered for sale online; the company reported exposure of contact and account information but no operational disruption or compromise of passwords or payment data.
-
November 10, 2025 • A phone phishing scam enabled unauthorized access to Princeton Universitys Advancement database containing alumni, donor, student, parent, and some faculty information; the breach lasted under 24 hours and the university has not determined what data was viewed or extracted.
-
November 7, 2025 WOG reported a massive cyberattack that temporarily disrupted its online services; specialists restored most functions the same day and all services were fully operational shortly after.
-
December 27, 2023 • Alpha Omega Winery in Napa County, California experienced a data-focused cyber incident on or about December 2728, 2023 involving unauthorized access to systems containing sensitive personal and medical information; although the organization described the event as ransomware, no encryption, extortion, or operational disruption was confirmed, and affected individuals were notified in November 2025.
-
November 3, 2025 • Millicom was contacted by ShinyHunters on November 3 following an intrusion in which threat actors exfiltrated hundreds of millions of customer-related records; negotiations failed after Millicom attempted to make installment payments, leading the group to list the stolen data for sale on November 13.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed government agency where sensitive information was stolen via exploitation of application server infrastructure.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed chemical manufacturer where sensitive information was stolen via exploitation of application server infrastructure.
-
September 15, 2025 • Anthropic reported that GTG-1002, a China-linked nation-state threat actor, conducted an AI-automated intrusion campaign detected in mid-September 2025; one successful breach involved an undisclosed financial institution where sensitive information was stolen via exploitation of application server infrastructure.