At least one undisclosed government and/or tech company
November 4, 2024
•[ state-sponsored, malware, backdoor ]
Government cybersecurity reporting described PRC state-sponsored actors using BRICKSTORM malware to maintain long-term persistence in victim environments, primarily affecting government services/facilities and IT sector organizations. In a documented case, actors accessed a DMZ web server (with a web shell present), moved laterally using service account credentials, copied Active Directory databases, pivoted into VMware vCenter, accessed domain controllers and an ADFS server, and exported cryptographic keys. BRICKSTORM provided stealthy backdoor access for command-and-control and remote operations and was used for persistence from at least April 2024 through at least September 3, 2025. The specific victim organization name was not disclosed in the reporting.
Mallorca Public Transport System
November 25, 2025
•[ ddos, hacktivism ]
Security reporting described a claimed DDoS attempt attributed to the pro-Russian hacktivist collective NoName057(16) targeting public-facing transport websites linked to Mallorcas TIB. Available reporting indicated analysts believed the group attempted to overload public web endpoints with DDoS traffic, but no verified outages or service interruptions were observed for TIB platforms, and there were no reported impacts on trains, buses, or metro operations.
Ladies' College
June 24, 2024
•[ ransomware, weak passwords, mfa missing ]
The Ladies College reported that on June 24, 2024 it lost access to several on-premises servers and quickly determined that an unauthorized party had gained access and deployed ransomware that encrypted systems. Regulators concluded the school failed to properly secure remote access, used a weak administrator password without MFA, and was vulnerable to brute-force compromise; monitoring alerts existed but lacked effective notification. The investigation found no evidence that data was accessed or copied off the network, though the incident impacted availability and encrypted some limited personal data. The school self-reported and later implemented remedial security measures.
Kerala State Film Development Corporation (KSFDC)
May 12, 2025
•[ data leak, insider threat, surveillance ]
Reporting described a major cybersecurity breach in which CCTV footage recorded inside government-owned theatres in Thiruvananthapuram (Kairali, Sree, and Nila) appeared on pornographic websites and then spread via Telegram/X and other channels. The leaked clips visibly displayed the KSFDC logo on seats, strongly indicating the source. Authorities opened a high-level inquiry and a cyber-cell investigation, with officials considering possibilities including insider misuse by staff with access to surveillance systems or an external intrusion into the CCTV network. No specific perpetrator, intrusion method, or exact timeframe for initial compromise was provided, but the incident resulted in non-consensual exposure of surveillance video of patrons.
Freedom Mobile
October 23, 2025
•[ data leak ]
Freedom Mobile disclosed a breach of its customer account management platform that it detected on Oct. 23, 2025. The company stated that an unknown third party used a subcontractors account to access personal information for a limited number of customers, and that suspicious accounts and related IP addresses were blocked as part of corrective measures. Reported exposed data elements include first and last names, home addresses, dates of birth, phone numbers (home and/or mobile), and customer account numbers; Freedom stated the incident was not ransomware and that its network and operations were not affected.
Pepe memecoin website
April 12, 2025
•[ website compromise, phishing, malware ]
The official website for the Pepe (PEPE) memecoin was compromised in a front-end attack that redirected visitors to a malicious site. According to Blockaid and Cointelegraph reporting, the compromised front-end contained code associated with the Inferno Drainer family and redirected users to a fake site that injects malicious code intended to drain crypto wallets. Users were advised to avoid interacting with the site while the issue was being addressed; the reporting did not quantify how many users were affected or whether wallet losses occurred.
700Credit
October 25, 2025
•[ data leak ]
700Credit, an automotive credit reporting and identity verification provider, was reported to have experienced a data breach on or around Oct. 25, 2025. The report stated the company was alerted to suspicious activity within its proprietary web-based application (700Dealer.com), after which it engaged third-party forensic specialists. According to the reporting, the investigation found consumer data had been copied from the application without authorization, while 700Credits internal network was said to be unaffected. Compromised data was described as including consumer names, addresses, and Social Security numbers from auto financing applications submitted between May and October 2025.
At least one individual in Singapore
January 11, 2025
•[ malware, extortion, data leak ]
Singapore Police warned of a malware-enabled sextortion scam in which victims were lured via social media offers of online sexual services and deceived into downloading a malicious application. Police said the malware enabled scammers to remotely access victims photo galleries and contact lists, and in some cases capture or retrieve compromising content. Attackers then threatened to send the images to the victims contacts unless payments were made. Police reported at least six cases since November 2025 with total losses of at least S$20,000.
Industrial Credit Union of Whatcom County
August 14, 2025
•[ data leak, third-party breach ]
Industrial Credit Union of Whatcom County reported a data breach stemming from a security incident at a third-party communication delivery vendor that provides print and email services to financial institutions; the credit union stated its own systems were not breached. The potentially impacted data includes names, dates of birth, Social Security numbers, and financial/banking information. The credit union filed notice with the Washington State Attorney Generals office and began sending notification letters to impacted individuals on Nov. 26, 2025. Public reporting linked this incident to the Marquis Software Solutions vendor intrusion detected on Aug. 14, 2025.
Asus
February 12, 2025
•[ ransomware, data leak ]
The Everest ransomware group claimed it obtained more than 1TB of ASUS-related data including phone camera source code and other internal materials. ASUS later confirmed that a supplier was hacked and that some ASUS phone camera source code was affected, stating the incident did not impact ASUS products, internal company systems, or user privacy. The report described leaked materials as including camera-related source code, internal patches, test modules, debugging logs, and other development artifacts, with no public indication of customer data exposure in the statement cited.
Pro Medicus
January 7, 2025
•[ data leak, email compromise, employee data ]
Pro Medicus disclosed that it investigated unauthorized access by an unknown third party to a single email inbox in July 2025. The company said it engaged external cybersecurity experts, secured the inbox, and contained the incident. Its analysis concluded the access was isolated to one mailbox and did not provide access to any client systems or patient data; it also stated there was no operational impact or financial loss. Pro Medicus reported that PII for approximately 100 current and former employees could potentially have been accessed and that the affected individuals were notified.
Mower County
November 6, 2025
•[ ransomware, data leak, government ]
Mower County reported that it detected a ransomware attack on June 18, 2025 and investigated with cybersecurity and data forensics consultants. The county said unauthorized access to its systems occurred sometime between June 11 and June 18, 2025 and that sensitive personal data collected by the county was stolen. Reported affected data types include Social Security numbers, birthdates, names, ID card numbers, fingerprints, financial account information, medical/health insurance information, and payment card information. As of Dec. 3, 2025, the county said it had no indication the stolen information had been released or offered for sale; it also noted approximately 27,064 notification letters were being sent.
Marquis Software Solutions
August 14, 2025
•[ ransomware, data leak ]
Marquis Software Solutions detected suspicious activity on Aug. 14, 2025 and determined it was the victim of a ransomware attack. An unauthorized party accessed Marquis network via a SonicWall firewall and may have acquired files from Marquis systems. Marquis stated the incident was limited to its environment (customers internal banking systems were not impacted) and that it had no evidence of misuse at the time of the notice. The potentially affected personal information for Maine residents includes names, addresses, phone numbers, Social Security numbers/TINs, dates of birth, and financial account information without security/access codes.
At least one telecom operator in Russia
January 11, 2025
•[ DDoS, telecom ]
A Russian tech-news report citing Roskomnadzor/GRFC monitoring stated that in November 2025 the regulator recorded and mitigated a record-long DDoS attack targeting telecommunications operators systems, with a maximum duration reported as 3 days 22 hours 20 minutes. The same regulatory summary reported peak attack power around 1.93 Tbps and very high packet rates during the period, with the telecom sector described as a primary focus of attack vectors. The report did not identify a specific threat group or provide victim-by-victim service impact details, but characterized the episode as an unusually prolonged and powerful DDoS campaign against telecom infrastructure.
myCicero
March 29, 2025
•[ data leak ]
Italian reporting stated that unknown cybercriminals attacked myCiceros systems between March 2930, 2025 and exfiltrated data from servers used to support transport-ticketing apps, including the UnicoCampania service. According to the article, stolen information included users personal/contact details, usernames and passwords, and information about purchased mobility tickets (type, validity, fare zone, and amounts paid). The report stated that payment card data were not stolen because those data were not hosted on myCicero systems, and it warned that even if passwords were stored encrypted, attackers might attempt to crack them depending on password strength.
Gold Coast Health Plan
October 21, 2024
•[ data leak, third-party breach, account takeover ]
Gold Coast Health Plan reported that a contracted vendor (Conduent Business Solutions) suffered a cyberattack involving compromise of a single employee email account, which allowed unauthorized access to certain files during a window from Oct. 21, 2024 to Jan. 13, 2025. The vendor discovered the incident on Jan. 13, 2025 and began an investigation with law enforcement notification. A later forensic review determined that information for 540 plan members could have been exposed, listing specific claim-related and membership data elements; the release stated that Social Security numbers and financial information were not accessed or disclosed.
Towne Mortgage
January 6, 2025
•[ ransomware, data leak ]
Towne Mortgage disclosed that a June 2025 incident may have involved a hacker copying data from its network. Reporting on subsequent litigation stated that the lender did not publicly specify how many customers were impacted, but a disclosure referenced at least 474 Massachusetts residents and indicated that Social Security numbers and financial account information were compromised. The same report noted that some cybersecurity blogs attributed the attack to the BlackByte ransomware-as-a-service group, though the company itself did not confirm attribution. Multiple class action lawsuits were filed after the lenders breach announcement, alleging failure to protect sensitive borrower information.
Anchorage Neighborhood Health Cente
August 22, 2025
•[ ransomware, data leak ]
Anchorage Neighborhood Health Center disclosed that an unauthorized third party gained access to certain systems and that sensitive personal information and protected health information may have been exposed, including identifiers (such as Social Security numbers and state ID numbers) and medical/insurance information. Reporting around the incident also described operational impacts at the clinic, including phone lines being down and appointment scheduling disruptions for more than a week in late August 2025. The organization filed a public notice and began sending notification letters to impacted individuals on November 19, 2025.
Personic Management Company LLC
August 29, 2025
•[ data leak, unauthorized access, third-party breach ]
Personic reported unauthorized activity affecting a third-party software platform it used to process patient information. The company stated it became aware of the issue on September 1, 2025, and an investigation concluded an unauthorized actor accessed the platform on August 29, 2025 and obtained certain data. The public notice stated the impacted data may include names and protected health information. Personic reported filing a notice with the Maine Attorney Generals office and beginning notification of impacted individuals on November 18, 2025.
Bpost
January 12, 2025
•[ ransomware, data leak, third-party ]
Reporting indicated that data attributed to Belgian postal operator bpost appeared on the TridentLocker ransomware leak site (about 30GB across thousands of files). Subsequent reporting cited a bpost spokesperson confirming a cyber incident and describing a limited data leak tied to a third-party exchange/platform used by a specific department (not linked to letters or parcels). The company stated it took immediate measures to contain the incident and said affected customers would be informed, while postal delivery operations were not expected to be endangered.
