Full List

Search

Recent Breaches

• Georgia Superior Court Clerks’ Cooperative Authority November 8, 2025 • [ ransomware, data exfiltration, cyber threat ] The Devman ransomware group attacked the Georgia Superior Court Clerks Cooperative Authority beginning November 8, 2025. GSCCCA voluntarily restricted access to its systems while investigating a credible cyber threat. Devman claimed to have exfiltrated 500 GB of organizational data from GSCCCAs application servers and demanded a $400,000 ransom by November 27.
• Sund & Bælt November 14, 2025 • [ DDoS, Denial-of-service, Hacktivism ] On November 14, 2025, the Storeblt website operated by Sund & Blt was rendered inaccessible due to an external denial-of-service attack. Sund & Blt confirmed the DDoS incident, and DR reported that the pro-Russian hacktivist group NoName057(16) claimed responsibility on Telegram as part of a broader campaign targeting Danish entities. No data loss occurred.
• Poltronesofà October 27, 2025 • [ ransomware, phishing, data breach ] Italian furniture retailer Poltronesof disclosed that its IT environment suffered a ransomware attack on October 27, 2025, in which intruders compromised group servers and encrypted virtual machines, making several internal systems temporarily unavailable. The companys incident-response team isolated affected infrastructure and launched a forensic investigation, but it warned that attackers may have exfiltrated customer data including identification and contact details. While payment information was reportedly not impacted, customers were advised to be vigilant for phishing attempts and to change passwords used with company services.
• Iberia Líneas Aéreas de España S.A. November 23, 2025 • [ data breach, third-party risk, loyalty program data ] Spanish flag carrier Iberia began notifying customers after discovering that unauthorized access to a suppliers systems had exposed limited loyalty-program data, including names, email addresses and Iberia Club card IDs, while emphasizing that passwords and payment information remained safe; the airline activated its security protocols, added additional protections around account email changes, notified regulators, and continues to investigate the vendor breach and a purported 77 GB data listing on hacker forums.
• Thayer Hotel at West Point September 19, 2025 • [ unauthorized access, data breach, personally identifiable information ] On 19 September 2025 the Thayer Hotel at West Point experienced unauthorized access to its computer systems, prompting a forensic investigation and containment measures. The hotel later confirmed that an Undetermined actor accessed systems holding data on roughly 33,053 individuals and that exposed information could include names, dates of birth, postal addresses, Social Security numbers, drivers license and passport numbers, state IDs, email addresses and some medical or financial data for guests and employees. A formal Notice of Data Security Incident dated 31 October 2025 describes the breach, and law firms have begun investigating potential claims while the hotel offers credit monitoring through Kroll.
• Elmcrest Children’s Center, Inc. August 12, 2025 • [ unauthorized access, data leak, health information ] Elmcrest Childrens Center, Inc. detected unauthorized access to its computer network on August 12, 2025. The investigation determined that files containing information for approximately 23,500 individuals were accessed, including names, addresses, dates of birth, treatment details, and insurance information.
• Svenska Kraftnät October 25, 2025 • [ ransomware, data breach, critical infrastructure ] Swedens national power grid operator Svenska Kraftnt experienced a data breach on October 25, 2025, when ransomware group Everest accessed an external file-transfer system and claimed to have stolen roughly 280 GB of data. Electricity transmission operations were not affected.
• Colorado State Public Defender’s Office October 3, 2025 • [ ransomware, encryption, operational disruption ] Ransomware beginning Oct 3 2025 encrypted servers and shared drives at Colorados State Public Defender Office, rendering thousands of case files inaccessible and delaying operations for weeks. No evidence of data theft or leak has been reported.
• Arizona Federal Public Defender’s Office September 24, 2025 • [ ransomware, data exfiltration, backup deletion ] Ransomware detected Sept 24 2025 crippled Arizonas Federal Public Defender Office, encrypting decades of case files and deleting backups. Investigators suspectbut have not confirmeddata exfiltration. No threat group has claimed responsibility.
• Toys “R” Us Canada July 30, 2025 • [ data leak, phishing, dark web ] Company confirmed a threat actor copied records from its customer database and later leaked them on the dark web; investigation verified the datas authenticity and regulators were notified. No payment credentials were exposed; customers warned about phishing.
• Hue Central Hospital – On-Demand and International Treatment Center January 15, 2025 • [ ransomware, encryption, healthcare ] In January 2025 the hospital information system of Hue Central Hospitals On-Demand and International Treatment Center was compromised, with around 500 GB of data encrypted and a ransom demanded for decryption; no public evidence of data exfiltration has been reported.
• Aeroméxico July 4, 2025 • [ data breach, cloud security, data exfiltration ] Criminal group ShinyHunters claimed responsibility for compromising Aeromxicos Salesforce or related cloud application environment around July 4 2025, exfiltrating approximately 172 GB of passenger data including contact and ID information. Aeromxico has not confirmed the intrusion or the volume of records exposed.
• McDonald’s recruitment chatbot platform June 1, 2025 • [ data leak, recruitment, chatbot ] SecurityWeek reported that a recruitment chatbot platform used by McDonalds leaked data on approximately 64 million job applicants worldwide.
• Payne County Sheriff’s Office May 28, 2025 • [ ransomware ] The Payne County Sheriffs Office in Oklahoma suffered a ransomware attack attributed to the SafePay group.
• Ogeechee Judicial Circuit District Attorney’s Office June 11, 2025 • [ ransomware, encryption, office closure ] Ransomware attack on the Ogeechee Judicial Circuit District Attorneys Office in Georgia on June 11, 2025 encrypted internal systems and forced closure of offices for several days; no data theft or leak reported; attacker identity unconfirmed.
• Rosselkhoznadzor – Mercury (VetIS) platform June 1, 2025 • [ cyberattack, supply chain disruption, animal-product certification ] Cyberattack took Russias Mercury (VetIS) animal-product certification platform offline, forcing paper certificates and disrupting dairy supply chains; major retailers (e.g., Lenta, Yandex Lavka, Miratorg) reported interruptions; restoration ongoing; no attribution.
• Черна писта May 30, 2025 • [ DDoS, service disruption, cyber attack ] Bulgarian outlets reported a DDoS that attempted to take down the crash-map site created by 18-year-old Martin Atanasov; the hosting firm confirmed a mass attack and service impact before restoration.
• Conseil départemental des Hauts-de-Seine May 20, 2025 • [ ransomware, cyberattack, system disruption ] French outlets reported a massive cyberattack that paralyzed the Hauts-de-Seine departments systems, consistent with a large-scale ransomware-style disruption; restoration efforts continued into the following day.
• Undisclosed U.S. government agency (reported as “Department of Government Efficiency”) May 8, 2025 • [ malware, infostealer, credential theft ] Ars Technica reports a government software engineers workstation was infected with info-stealing malware, with login credentials appearing in multiple stealer-log dumps since 2023; investigation centers on credential exposure rather than confirmed enterprise compromise.
• Alcaldía de Cáchira May 2, 2025 • [ malware, financial theft, unauthorized access ] Authorities arrested suspects accused of using malware to access municipal accounts and steal $1.935 million COP from the Cchira mayors office.