Recent Breaches
-
November 12, 2025 Unknown attackers compromised a senior executive's device at an undisclosed major global stock exchange. Malware was present by October 10, 2025, and the attackers began collecting and exfiltrating data on November 12. Over approximately five months, they stole the executive's Outlook mailbox in small incremental archives using Dropbox and OneDrive while maintaining persistence through scheduled tasks disguised as legitimate software services.
-
November 13, 2025 • Qilin listed Cornerstone Staffing Solutions on November 13, 2025 and displayed samples from recruitment databases and company files while threatening publication. Cornerstone had not publicly confirmed the claim, and no operational disruption was reported.
-
November 17, 2025 • Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
-
November 18, 2025 • Harvard disclosed that an unauthorized party accessed information systems used by its Alumni Affairs and Development office after a phone-based phishing attack. The compromised systems contained records used for alumni engagement and fundraising, including donation-related information, event attendance records, and contact details such as email addresses, telephone numbers, and home addresses. University communications indicated the systems did not generally contain Social Security numbers, passwords, or financial account numbers, but noted the institution was still investigating exactly what information was accessed and advised vigilance for suspicious communications purporting to be from the University.
-
November 25, 2025 • An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
-
November 25, 2025 • An unauthorized actor used credentials stolen from one trusted vendor to access systems maintained by a second unnamed trusted vendor between November 25 and November 28, 2025 and copied files containing resident information for three Ascent Healthcare Management-affiliated skilled nursing facilities. The incident was discovered on June 1, 2026. Separate HHS filings reported 1,397 affected individuals at Bear Mountain Health and Rehabilitation, 1,551 at Elevate Health & Rehabilitation, and 1,045 at Swannanoa Valley Health and Rehabilitation. Because the primary compromise occurred in the shared vendor environment, this is coded as one vendor event rather than three separate facility intrusions. The facilities said they had credible evidence that the copied files were permanently deleted and not published; the vendor, actor, motive, and technical acquisition point remain undisclosed.
-
November 26, 2025 • Unauthorized access to NADAP's network occurred on or around November 26, 2025 and was discovered on January 10, 2026. NADAP isolated and took impacted systems offline as a containment measure. Genesis claimed responsibility on March 6, 2026 and said it stole approximately 2 TB of medical and HR data. NYC Health + Hospitals confirmed that 5,086 of its patients were among those whose protected health information was accessed.
-
November 27, 2025 • Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
-
December 1, 2025 • In December 2025, DragonForce-affiliated operators gained access to an undisclosed U.S. services company, likely through an unknown SQL or MSSQL server vulnerability or purchased access. During a dwell time of approximately one to two months, the attackers modified firewall rules, used DLL sideloading and vulnerable-driver techniques, deployed the Go-based Backdoor.Turn remote-access tool using Microsoft Teams TURN relays for command and control, stole confidential files, and ultimately encrypted systems with DragonForce ransomware. The exact intrusion day, affected systems, operational impact, and contents of the stolen data were not disclosed.
-
December 1, 2025 • iFood confirmed unauthorized access arising from an incident in December 2025. Its initial disclosure estimated approximately 1.2 million affected users, but a later official update increased the confirmed total to approximately 1.5 million individuals. Exposed information included names, telephone numbers, addresses, and CPF taxpayer identification numbers. iFood stated that passwords, bank information, and credit-card data were not compromised. A separate forum claim involving 43.8 million records was not substantiated by iFood and is not combined with this incident. Because only the month was reported, 2025-12-01 is used as the normalized event date.
-
December 1, 2025 • Anatomic and Clinical Laboratory Associates detected potential unauthorized activity on December 1, 2025. Its investigation found that an unauthorized actor may have accessed its network and downloaded files. Insomnia later claimed responsibility, but the laboratory did not publicly attribute the incident to the group. No encryption or operational disruption was reported.
-
December 1, 2025 North Korea's WaterPlum (Contagious Interview) used fake job offers to infect 30,000+ devices in 100+ countries in Dec 2025-Jul 2026, taking funds or credentials of 7,000+ crypto wallets; about $10.71M reached North Korea, per a Sept 18, 2026 Japan-US-Australia-Germany advisory.
-
December 6, 2025 • LockBit 5.0 listed the Four Points by Sheraton domain in December 2025 and threatened to publish allegedly stolen data. DataBreach.com later indexed 52,310 rows associated with the domain. Marriott International did not publicly confirm the actor's claim, the access vector was not established, and no encryption or operational disruption was documented.
-
December 8, 2025 • An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
-
December 8, 2025 • Windward Life Care detected unusual network activity on December 8, 2025 and determined that an unauthorized party may have viewed or copied files containing personal and protected health information. Sinobi claimed on January 5, 2026 that it stole approximately 25 gigabytes and later published the material. Windward completed its data review on April 6, notified 12,913 affected individuals beginning April 10, and offered identity-protection services. No victim-specific evidence established encryption or operational disruption.
-
December 12, 2025 • United Medical Doctors confirmed unauthorized access to its systems at varying times between December 12, 2025 and March 31, 2026, during which an unauthorized user accessed and/or acquired files. UMD detected suspicious activity on March 31. Insomnia publicly claimed the organization on April 9 and threatened disclosure of stolen information. DataBreach.com subsequently indexed 638,670 rows associated with the incident. No independently verified operational disruption has been established.
-
December 15, 2025 • On December 15, 2025, an unauthorized individual gained access to one Educational Employees Credit Union employee email account for a limited period and may have accessed or removed messages. EECU determined on May 8, 2026, that some emails contained personal and financial information, began notifying affected individuals on May 29, and reported no evidence that the information had been used for financial fraud or identity theft.
-
December 15, 2025 • An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
-
December 18, 2025 • Hacker "888" claimed to breach ESA systems, stealing 200GB of internal server files including credentials, config data, and infrastructure documentation. ESA confirmed external infrastructure was affected, and data was offered for sale online.
-
December 18, 2025 • France's Sports Ministry confirmed on December 19, 2025 that data from its Pass'Sport youth sports subsidy system was exfiltrated and posted on a criminal forum on December 17-18, affecting about 3.5 million households; a user called Indra claimed the leak.