-
Bennett College
October 27, 2025
•
[ ransomware, education ]
Bennett College, a private HBCU for women in Greensboro, N.C., had network data accessed Oct. 27-Nov. 15, 2025, affecting 30,065 people. INC Ransom listed the college on its leak site Dec. 6; the college notified the state AG and offered credit monitoring.
-
Multiple undisclosed JetBrains Marketplace users
October 31, 2025
•
[ malware, technology ]
From 2025-10-31 through June 2026, 15 malicious third-party JetBrains Marketplace plugins published under seven vendor accounts posed as functional AI developer tools while secretly exfiltrating user-supplied AI provider API keys over unencrypted HTTP to a hard-coded server. The plugins accumulated approximately 70,000 installations. JetBrains removed all 15 plugins, banned the publisher accounts, and remotely disabled installed copies on 2026-06-17. JetBrains confirmed that its internal systems, source code, and corporate infrastructure were not compromised. The server's location in Beijing does not establish the perpetrator's country.
-
Suno, Inc.
November 1, 2025
In November 2025, a hacker using the name ellie.191 gained unauthorized access to Suno systems and obtained outdated source code, internal details about the company's music-scraping and model-training pipelines, customer account information, and Stripe purchase data. The actor said a Suno employee had been compromised through the Shai-Hulud supply-chain worm and that harvested GitHub and cloud credentials enabled the intrusion; the actor's relationship to the original Shai-Hulud campaign is unknown. Have I Been Pwned later examined a dataset containing 55.3 million unique email addresses, some phone numbers, and tens of thousands of purchase records with names, addresses, transaction information, and partial card details. Suno confirmed a November 2025 incident and did not dispute the reported account count, although it said the incident primarily involved outdated source code and that no sensitive personal information was compromised. No operational disruption was reported.
-
Bandai Namco Filmworks
November 4, 2025
•
[ hack, leak, technology ]
Between 5:00 and 8:45 p.m. on November 4, 2025, an unnamed 15-year-old student sent false account-cancellation requests to Bandai Channel after identifying a server vulnerability and used ChatGPT to refine and automate his code. He changed his IP address about 30 times after being blocked, caused 46,812 accounts to be deregistered, and prompted a service suspension from November 6 to December 19. Bandai Namco Filmworks later said personal information from up to 1.366 million accounts may have been exposed, but confirmed no online publication or secondary misuse.
-
Undisclosed major global stock exchange
November 12, 2025
Unknown attackers compromised a senior executive's device at an undisclosed major global stock exchange. Malware was present by October 10, 2025, and the attackers began collecting and exfiltrating data on November 12. Over approximately five months, they stole the executive's Outlook mailbox in small incremental archives using Dropbox and OneDrive while maintaining persistence through scheduled tasks disguised as legitimate software services.
-
Cornerstone Staffing Solutions, Inc.
November 13, 2025
•
[ ransomware, technology ]
Qilin listed Cornerstone Staffing Solutions on November 13, 2025 and displayed samples from recruitment databases and company files while threatening publication. Cornerstone had not publicly confirmed the claim, and no operational disruption was reported.
-
Under Armour
November 17, 2025
•
[ ransomware, retail, technology ]
Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
-
Harvard University
November 18, 2025
•
[ phishing, leak, education ]
Harvard disclosed that an unauthorized party accessed information systems used by its Alumni Affairs and Development office after a phone-based phishing attack. The compromised systems contained records used for alumni engagement and fundraising, including donation-related information, event attendance records, and contact details such as email addresses, telephone numbers, and home addresses. University communications indicated the systems did not generally contain Social Security numbers, passwords, or financial account numbers, but noted the institution was still investigating exactly what information was accessed and advised vigilance for suspicious communications purporting to be from the University.
-
Greenbaum, Rowe, Smith & Davis LLP
November 25, 2025
•
[ hack, brute-force, healthcare ]
An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
-
Undisclosed trusted vendor serving Ascent Healthcare Management facilities
November 25, 2025
•
[ leak, healthcare ]
An unauthorized actor used credentials stolen from one trusted vendor to access systems maintained by a second unnamed trusted vendor between November 25 and November 28, 2025 and copied files containing resident information for three Ascent Healthcare Management-affiliated skilled nursing facilities. The incident was discovered on June 1, 2026. Separate HHS filings reported 1,397 affected individuals at Bear Mountain Health and Rehabilitation, 1,551 at Elevate Health & Rehabilitation, and 1,045 at Swannanoa Valley Health and Rehabilitation. Because the primary compromise occurred in the shared vendor environment, this is coded as one vendor event rather than three separate facility intrusions. The facilities said they had credible evidence that the copied files were permanently deleted and not published; the vendor, actor, motive, and technical acquisition point remain undisclosed.
-
National Association on Drug Abuse Problems (NADAP)
November 26, 2025
•
[ ransomware, healthcare ]
Unauthorized access to NADAP's network occurred on or around November 26, 2025 and was discovered on January 10, 2026. NADAP isolated and took impacted systems offline as a containment measure. Genesis claimed responsibility on March 6, 2026 and said it stole approximately 2 TB of medical and HR data. NYC Health + Hospitals confirmed that 5,086 of its patients were among those whose protected health information was accessed.
-
Upbit
November 27, 2025
•
[ financial, hack, finance ]
Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
-
Undisclosed U.S. services company
December 1, 2025
•
[ ransomware, sqlinjection, technology ]
In December 2025, DragonForce-affiliated operators gained access to an undisclosed U.S. services company, likely through an unknown SQL or MSSQL server vulnerability or purchased access. During a dwell time of approximately one to two months, the attackers modified firewall rules, used DLL sideloading and vulnerable-driver techniques, deployed the Go-based Backdoor.Turn remote-access tool using Microsoft Teams TURN relays for command and control, stole confidential files, and ultimately encrypted systems with DragonForce ransomware. The exact intrusion day, affected systems, operational impact, and contents of the stolen data were not disclosed.
-
iFood
December 1, 2025
•
[ leak, technology, retail ]
iFood confirmed unauthorized access arising from an incident in December 2025. Its initial disclosure estimated approximately 1.2 million affected users, but a later official update increased the confirmed total to approximately 1.5 million individuals. Exposed information included names, telephone numbers, addresses, and CPF taxpayer identification numbers. iFood stated that passwords, bank information, and credit-card data were not compromised. A separate forum claim involving 43.8 million records was not substantiated by iFood and is not combined with this incident. Because only the month was reported, 2025-12-01 is used as the normalized event date.
-
Anatomic and Clinical Laboratory Associates, P.C.
December 1, 2025
•
[ ransomware, healthcare, leak ]
Anatomic and Clinical Laboratory Associates detected potential unauthorized activity on December 1, 2025. Its investigation found that an unauthorized actor may have accessed its network and downloaded files. Insomnia later claimed responsibility, but the laboratory did not publicly attribute the incident to the group. No encryption or operational disruption was reported.
-
Undisclosed cryptocurrency wallet holders
December 1, 2025
North Korea's WaterPlum (Contagious Interview) used fake job offers to infect 30,000+ devices in 100+ countries in Dec 2025-Jul 2026, taking funds or credentials of 7,000+ crypto wallets; about $10.71M reached North Korea, per a Sept 18, 2026 Japan-US-Australia-Germany advisory.
-
Four Points by Sheraton (Marriott International, Inc.)
December 6, 2025
•
[ ransomware, leak ]
LockBit 5.0 listed the Four Points by Sheraton domain in December 2025 and threatened to publish allegedly stolen data. DataBreach.com later indexed 52,310 rows associated with the domain. Marriott International did not publicly confirm the actor's claim, the access vector was not established, and no encryption or operational disruption was documented.
-
IMA Diligence Services, LLC
December 8, 2025
•
[ hack, leak, healthcare ]
An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
-
Buena Vista Management Services, LLC dba Windward Life Care
December 8, 2025
•
[ leak, healthcare ]
Windward Life Care detected unusual network activity on December 8, 2025 and determined that an unauthorized party may have viewed or copied files containing personal and protected health information. Sinobi claimed on January 5, 2026 that it stole approximately 25 gigabytes and later published the material. Windward completed its data review on April 6, notified 12,913 affected individuals beginning April 10, and offered identity-protection services. No victim-specific evidence established encryption or operational disruption.
-
United Medical Doctors
December 12, 2025
•
[ ransomware, healthcare, leak ]
United Medical Doctors confirmed unauthorized access to its systems at varying times between December 12, 2025 and March 31, 2026, during which an unauthorized user accessed and/or acquired files. UMD detected suspicious activity on March 31. Insomnia publicly claimed the organization on April 9 and threatened disclosure of stolen information. DataBreach.com subsequently indexed 638,670 rows associated with the incident. No independently verified operational disruption has been established.
