Vultr
July 8, 2022
•[ data leak, third-party ]
In March 2023, the "AI-first global cloud platform" Vultr disclosed a security incident at a third-party vendor. Dating back to the previous year, the incident was attributed to the ActiveCampaign email marketing service provider and resulted in the exposure of 188k unique email addresses. A small number of records also included name, IP address and country of origin. No Vultr systems or additional customer data were impacted. Vultr subsequently self-submitted the impacted data to HIBP.
Operation Endgame 3.0
November 13, 2025
•[ infostealer, remote access trojan, botnet ]
Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP.
Eurofiber
November 13, 2025
•[ data leak ]
In November 2025, Eurofiber France disclosed a data breach of its ticket management platform. Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backup files.
Beckett Collectibles
November 9, 2025
•[ data leak ]
In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data included more than 500k email addresses reportedly belonging to North American customers, along with a smaller subset containing names, usernames, phone numbers and physical addresses.
Operation Endgame 3.0
November 14, 2025
•[ infostealer, remote access trojan, botnet ]
Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP.
Sax LLP
July 25, 2024
•[ data leak ]
Sax LLP disclosed that threat actors gained unauthorized access to its systems in late July 2024 and accessed files containing sensitive personal information; suspicious activity was detected on August 7, 2024.
Undisclosed Thailand government organization
March 1, 2025
•[ malware ]
Researchers identified the use of a signed kernel-mode driver to hide ToneShell malware activity on systems of a Thai government organization, allowing covert long-term access.
Undisclosed Myanmar government organization
March 1, 2025
•[ state-sponsored attack, malware, rootkit ]
Chinese state-linked threat actors deployed a kernel-mode rootkit to conceal ToneShell malware on systems belonging to a Myanmar government organization, enabling stealthy persistent access.
Undisclosed Apple-assembler in China
December 1, 2025
•[ data leak ]
Hackers breached an Apple assembler in China and accessed internal systems, with reporting indicating that production and manufacturing-related data was targeted during the intrusion.
Ubisoft
December 27, 2025
•[ data leak, service disruption ]
Ubisoft suffered a breach in which attackers accessed internal systems controlling the Rainbow Six Siege economy and moderation tools. Game services were globally disrupted, requiring rollback and shutdown of servers for nearly two days.
Arch Linux
December 25, 2025
•[ DDoS, service disruption ]
Arch Linuxs official website experienced a distributed denial-of-service attack that rendered the site inaccessible over IPv4 while remaining reachable via IPv6 as a mitigation measure.
Greater St. Louis Oral & Maxillofacial Surgery PC
December 4, 2025
•[ phishing, data leak ]
Unauthorized access to a server-hosted employee email account resulted in exposure of patient personal and protected health information and use of the account to send phishing emails.
Fyzical Acquisition Holdings LLC
January 9, 2025
•[ unauthorized access, email compromise ]
Unauthorized access to FYZICALs email environment was detected on December 9 2024 triggering an investigation that concluded in November 2025 Breach notifications were issued to affected individuals and state authorities in December 2025
MetroWest Community Federal Credit Union
September 3, 2025
•[ ransomware, data leak ]
MetroWest Community Federal Credit Union disclosed that unauthorized access to its systems in early September 2025 resulted in the compromise of sensitive member information, with the incident attributed to the Akira cybercriminal group.
Grenoble École de Management
November 15, 2025
•[ data leak ]
Threat actors claimed access to and sale of a large CRM dataset associated with the institution, which the school acknowledged and began investigating.
University of Lille
December 29, 2025
•[ data leak ]
Unauthorized access to university systems resulted in the exfiltration of student personal data later advertised on an underground forum.
Complexul Energetic Oltenia
December 26, 2025
•[ ransomware ]
A ransomware attack attributed to the Gentlemen group encrypted internal IT systems at Complexul Energetic Oltenia on December 26 2025 causing partial operational disruption The company isolated affected systems restored operations from backups and stated that national energy supply was not affected Data exfiltration has not been confirmed
Denton County MHMR Center (My Health, My Resources)
December 24, 2024
•[ data leak, healthcare ]
Denton County MHMR Center disclosed unauthorized access to its network occurring between December 24 and December 25, 2024. A forensic investigation determined that patient protected health information was accessed. The organization notified affected individuals and regulators in 2025; no attacker-caused operational disruption was publicly reported.
Associated Radiologists of the Finger Lakes P.C.
October 30, 2025
•[ data leak ]
A subset of ARFLs network was accessed by an unauthorized party between October 28 and October 30 2025 during which files containing personal and health information were viewed or copied without permission Notifications were issued on December 29
ManageMyHealth
December 30, 2025
•[ ransomware, data leak, healthcare ]
A significant volume of patient medical records was accessed and partially encrypted in a cyber intrusion targeting document systems The threat actor issued a ransom demand and published some data samples online before legal action was taken The breach was discovered in late December and publicly confirmed shortly after
