DXS International
December 14, 2025
•[ ransomware, data leak ]
DXS International disclosed a cyberattack affecting its office servers that it said was discovered on December 14, 2025 and immediately contained in cooperation with NHS England. The company reported minimal impact on services and said front-line clinical services were unaffected. The specific nature of the breach and whether patient medical information was stolen was not confirmed in the report; however, a ransomware group calling itself DevMan claimed credit and alleged theft of 300 GB of data. Regulators and law enforcement were notified and an external cybersecurity firm was engaged to investigate the scope and extent of unauthorized access.
Solana
October 12, 2025
•[ ddos ]
A Russian-language report stated that the Solana network was under a sustained DDoS attack for more than a week with traffic peaking around 6 Tbps. The article said Solana continued functioning normally despite the malicious traffic, with transaction confirmation times remaining stable.
Ungava Tulattavik Health Centre (UTHC)
January 11, 2025
•[ data leak, phishing ]
Ungava Tulattavik Health Center in Kuujjuaq (Nunavik, Quebec) disclosed it was the victim of a cyberattack in November 2025. The centre said the attack was blocked upon detection, but warned that files containing clinical and administrative information related to some people who use the health centre and some employees may have been stolen. The centre established a crisis unit, deployed enhanced surveillance/security tools, and worked with the Sret du Qubec, the Nunavik Regional Board of Health and Social Services, and Sant Qubecs Cyber Defence Operational Centre during the investigation. Officials advised users and employees to monitor bank accounts and watch for suspicious emails or calls while the incident response and review continued.
Naftali Bennett's phone
December 17, 2025
•[ data leak, hacking ]
Israel National News reported that the Iranian-affiliated hacker group Handala claimed it infiltrated Naftali Bennetts personal iPhone 13 as part of Operation Octopus and published files it said were extracted from the device, including a contact list with names of senior Israeli officials, internal communications, sensitive documents, and personal photos. The outlet also reported Bennett responded that the matter was being handled by security authorities. Subsequent coverage elsewhere reported Bennetts office said tests indicated the phone was not hacked, though content tied to his accounts/contacts circulated online; the exact extent of compromise is therefore not fully verified beyond an unauthorized leak claim.
LKQ
March 10, 2025
•[ ransomware, data leak ]
LKQ Corporation confirmed it was impacted by the Oracle E-Business Suite (EBS) hacking campaign after being listed by the Cl0p ransomware group. LKQ told the Maine Attorney General that personal information for more than 9,000 individuals was compromised, and an example notice letter indicated affected data included sole proprietor supplier information such as Employer Identification Numbers and Social Security numbers. According to LKQ, it launched an investigation on October 3, 2025 and completed its analysis of personal information compromise on December 1, 2025.
Ireland's Office of the Ombudsman
November 12, 2025
•[ ransomware, service disruption ]
The Office of the Ombudsman in Ireland reported that it was the victim of a ransomware attack involving unauthorized access to its IT systems on December 11, 2025. As part of containment, the Office took systems offline and worked with the National Cyber Security Centre and external specialists to investigate and restore services, while notifying law enforcement and the Data Protection Commission. The Office later stated it was confident no personal data had been taken in the incident, and it incrementally restored services, reporting by early January 2026 that public-facing services were back online. The incident primarily caused disruption through precautionary shutdown and recovery operations rather than publicly reported data theft.
Passenger ferry owned by GNV
December 17, 2025
•[ malware, foreign interference, sabotage ]
French authorities reported that the passenger ferry 'Fantastic' (operated by Italian shipping company Grandi Navi Veloci, GNV) was infected with malware while docked in the port of Ste, France. Officials stated the malware could have enabled the ship to be remotely controlled, prompting an investigation into possible foreign interference. Prosecutors said a Latvian national was arrested and charged after the malware was discovered.
Dainichiseika Color & Chemicals Mfg. (Vietnam subsidiary)
December 15, 2025
•[ ransomware, unauthorized access, data leak ]
Dainichiseika Color & Chemicals Manufacturing reported that its consolidated subsidiary in Vietnam (DAINICHI COLOR VIETNAM CO., LTD.) suffered unauthorized access that resulted in ransomware infection of internal servers and related systems. On December 15, 2025, the company confirmed that files on servers and PCs had been encrypted and rendered unreadable, consistent with a ransomware data attack. Affected devices were disconnected from internal networks and the internet to prevent spread, and IT specialists were dispatched to support recovery and forensic analysis. The company stated that key subsidiary operations such as manufacturing and shipping continued as usual and that the extent of information leakage, if any, was still being assessed.
The Minersville School District
December 15, 2025
•[ malware ]
Minersville Area School District reported a cybersecurity incident after security tools detected attempts to install malware on certain district systems on Monday, December 15, 2025. As a precaution, the district took its computer network offline to contain any potential infection and engaged cybersecurity specialists to investigate the activity, validate system integrity, and plan a safe restoration. The network shutdown disrupted district operations and led to the closure of schools on Tuesday, December 16, 2025. Public reporting did not confirm whether data was accessed or exfiltrated, and the incident was described primarily as a malware-install attempt and precautionary outage.
SoundCloud
December 15, 2025
•[ data leak, ddos ]
SoundCloud disclosed that it detected unauthorized activity involving an ancillary service dashboard and investigated the incident with external experts. SoundCloud said an attacker accessed information for roughly 20% of user accounts, limited to email addresses and information visible on public SoundCloud profiles, and stated that passwords and payment information were not exposed. The company implemented additional security controls, forced logouts and token rotations, and temporarily restricted some access while mitigating follow-on activity; it also reported experiencing a DDoS attack that contributed to short-lived service availability issues on the web version.
Swift Institute
January 30, 2025
•[ data leak ]
James J. Lynch, MD Ltd. d/b/a Swift Institute disclosed that it detected unusual activity in its network environment on or about January 30, 2025. An internal investigation determined that certain files may have been copied by an unauthorized individual as part of the event on or about January 30, 2025. Swift Institute conducted a comprehensive review of the affected data set and confirmed on October 14, 2025 that personal information and/or protected health information was contained in the files. Notification letters dated December 10, 2025 were issued to potentially impacted individuals, and the organization offered credit monitoring and fraud assistance services.
Visage Imaging
November 26, 2025
•[ data leak ]
Visage Imaging reported a security incident involving unauthorized access to certain personal information within its systems. The organization indicated that an unauthorized party accessed personal information classified as personally identifiable information (PII), and that impacted elements may include individuals names and Social Security numbers. Visage Imaging filed a public notice with the Massachusetts Attorney General and began sending notification letters to impacted individuals on November 26, 2025.
Attorney General’s Office of the State of Guanajuato (FGEG)
November 13, 2025
•[ ransomware, data leak, double-extortion ]
Mexico Business News reports Guanajuatos Attorney Generals Office confirmed a cybersecurity incident after a ransomware attack attributed to Tekir APT. Attackers claim they stole 250GB+ of confidential data, including judicial files and internal databases. Officials are reviewing controls, without confirming attribution or ransom payment. Hackmanac alleges subdomain encryption and double-extortion.
Ahome City Hall
December 12, 2025
•[ data leak, ransomware, extortion ]
Article warns that Mexicos government cybersecurity is structurally weak. Experts cite basic misconfigurations, poor maintenance, limited staff training, and lack of an overarching cybersecurity law. Recent incidents, including municipal data leaks and ransomware affecting Guanajuatos attorney general, show risks of extortion, fraud, and weakened public trust.
At least one user of Notepad++
December 12, 2025
•[ vulnerability, supply chain attack, software update attack ]
PCGuia reported that a critical vulnerability in Notepad++s automatic update mechanism was actively exploited, allowing attackers to intercept update traffic and distribute compromised/malicious versions of the software to users of versions prior to 8.8.9. The article states developers urged users to avoid the built-in updater and instead manually download the installer from the official site or trusted repositories. It also cites reporting that several organizations suffered serious breaches shortly after updating, and notes that the mitigations in version 8.8.9 included forcing the update URL to GitHub and improvements related to certificate/signature verification. The specific attacker identity, the full list of affected downstream organizations, and whether any sensitive data was exfiltrated from victims are not detailed in the article.
BarNet
December 12, 2025
•[ ransomware, data leak ]
Insurance Business reported that BarNet, a communications and infrastructure provider serving barristers and legal practices (including hosting, connectivity, file-sharing and a case-tracking platform), appeared on the SafePay ransomware groups leak site. The article states SafePay released material it claims was taken from BarNets systems, and that the leaked files reportedly include financial statements and legal/contract documents as well as sensitive personal records such as passport copies and CVs. The reporting focuses on the alleged data exposure and extortion context rather than confirmed encryption-related downtime, and it does not provide a confirmed initial access vector or a verified count of affected individuals.
Orion Telecom
November 12, 2025
•[ ddos, service disruption ]
TASS reported that Orion Telecom, described as the largest provider in Krasnoyarsk, experienced a powerful DDoS attack attributed to sources in foreign countries. The provider stated it repelled the attack and fully restored network operations, with central services stable again after engaging internal AntiDDoS capabilities and federal-scale external information security partners. The report indicates the disruption required building tailored protections for specific buildings/cities, implying service degradation/outage for some customers during mitigation. No data theft was described; the primary effect reported was disruption to communications services that was later restored.
At least one individual dowloading One Battle After Another torrent
November 12, 2025
•[ malware, trojan ]
This article summarizes Bitdefenders reporting on a malware distribution campaign that uses fake torrents claiming to contain a Leonardo DiCaprio film (One Battle After Another). The torrent bundle reportedly contains shortcut and script components that trigger a multi-stage infection chain leveraging PowerShell and other built-in Windows utilities, culminating in memory-resident deployment of the Agent Tesla remote access trojan
Madison County Health Department (Kentucky)
August 12, 2025
•[ data leak ]
This item concerns a reported data breach affecting the Madison County Health Department in Kentucky, with public reporting indicating that the personal information of 71 individuals was exposed. Due to access restrictions/timeouts when retrieving the primary notice and the original local-news article, the available sources do not provide reliable, verifiable detail on the exact intrusion method, the precise dates of unauthorized access, or the specific categories of personal information involved. The event is coded as an exploitive incident (data breach) because a breach with exposed personal information is reported, but the record-level details remain undetermined based on the accessible evidence.
Dolar Financial Group
November 25, 2025
•[ ransomware, data leak, extortion ]
Money Mart (National Money Mart Company Database) was posted to the Everest ransomware groups leak site around Nov 25, 2025, with the attackers claiming they exfiltrated 80,000+ internal files and threatening to publish them by Nov 30. Reporting states Cybernews reviewed the leaked samples and observed multiple categories of data, including customer identification/contact details and identity documents, financial data (including partial credit card details and transaction-related records), and extensive employee information. The report describes the incident primarily as data theft/extortion, with no confirmed public statement from Money Mart included in the article and no operational outage details provided in the cited reporting.
