-
Colorado Health Network Inc.
July 29, 2025
•
[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
-
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•
[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
-
Norwest Venture Partners
August 9, 2025
•
[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
-
The Estée Lauder Companies Inc.
August 9, 2025
On or around August 9, 2025, an unauthorized party accessed Este Lauder's Oracle E-Business Suite used for human-resources management and obtained employee-related personal information. The company confirmed the breach on June 19, 2026. The timing aligns with Cl0p's mass exploitation of CVE-2025-61882, and Cl0p reportedly leaked 870 GB under Este Lauder's name, but the company did not confirm the vulnerability or attribution; no operational disruption was reported.
-
Motor Controls, Inc.
August 26, 2025
World Leaks listed Motor Controls on its data-leak site on 26 August 2025, and the supplied breach database subsequently indexed 18,598 published records. The underlying intrusion date and access vector were not reported, and no victim-specific evidence of encryption or operational disruption was found. This event is separate from the breach Motor Controls notified to the Texas Attorney General in May 2025.
-
MCBS, LLC
September 22, 2025
•
[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
-
Comcast Corporation
September 29, 2025
•
[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
-
Defense Manpower Data Center (DMDC), U.S. Department of Defense
October 1, 2025
•
[ leak, government, misconfiguration ]
Unauthorized users accessed files through a vulnerable Defense Manpower Data Center file-sharing system from sometime in October 2025 until July 16, 2026. The Defense Department discovered and patched the vulnerability on July 16. Data pertaining to current and former service members and other DoD-associated individuals was exposed; the intrusion date and perpetrators remain unidentified.
-
Upper Township
October 5, 2025
•
[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
-
Unlimited Technology Systems, LLC
October 5, 2025
•
[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
-
The Connecticut Institute for the Blind, Inc. d/b/a Oak Hill
October 6, 2025
•
[ leak, healthcare ]
The Connecticut Institute for the Blind, Inc., doing business as Oak Hill, experienced a security incident on or about October 6, 2025. Its investigation found that files in certain affected accounts were accessed or acquired without authorization. Oak Hill determined on May 13, 2026, that the files contained personal information, mailed notices on June 30, and reported 1,556 affected individuals to HHS. No operational disruption was reported, and Oak Hill reported no known identity or financial fraud resulting from the incident.
-
Clarinda Regional Health Center
October 23, 2025
On or around October 23, 2025, an unauthorized actor acquired files from Clarinda Regional Health Center's network containing personal and protected health information. LockBit later claimed responsibility, although CRHC did not publicly confirm the attribution, and the hospital began notifying 24,341 affected individuals in June 2026.
-
Bennett College
October 27, 2025
•
[ ransomware, education ]
Bennett College, a private HBCU for women in Greensboro, N.C., had network data accessed Oct. 27-Nov. 15, 2025, affecting 30,065 people. INC Ransom listed the college on its leak site Dec. 6; the college notified the state AG and offered credit monitoring.
-
Multiple undisclosed JetBrains Marketplace users
October 31, 2025
•
[ malware, technology ]
From 2025-10-31 through June 2026, 15 malicious third-party JetBrains Marketplace plugins published under seven vendor accounts posed as functional AI developer tools while secretly exfiltrating user-supplied AI provider API keys over unencrypted HTTP to a hard-coded server. The plugins accumulated approximately 70,000 installations. JetBrains removed all 15 plugins, banned the publisher accounts, and remotely disabled installed copies on 2026-06-17. JetBrains confirmed that its internal systems, source code, and corporate infrastructure were not compromised. The server's location in Beijing does not establish the perpetrator's country.
-
Suno, Inc.
November 1, 2025
In November 2025, a hacker using the name ellie.191 gained unauthorized access to Suno systems and obtained outdated source code, internal details about the company's music-scraping and model-training pipelines, customer account information, and Stripe purchase data. The actor said a Suno employee had been compromised through the Shai-Hulud supply-chain worm and that harvested GitHub and cloud credentials enabled the intrusion; the actor's relationship to the original Shai-Hulud campaign is unknown. Have I Been Pwned later examined a dataset containing 55.3 million unique email addresses, some phone numbers, and tens of thousands of purchase records with names, addresses, transaction information, and partial card details. Suno confirmed a November 2025 incident and did not dispute the reported account count, although it said the incident primarily involved outdated source code and that no sensitive personal information was compromised. No operational disruption was reported.
-
Bandai Namco Filmworks
November 4, 2025
•
[ hack, leak, technology ]
Between 5:00 and 8:45 p.m. on November 4, 2025, an unnamed 15-year-old student sent false account-cancellation requests to Bandai Channel after identifying a server vulnerability and used ChatGPT to refine and automate his code. He changed his IP address about 30 times after being blocked, caused 46,812 accounts to be deregistered, and prompted a service suspension from November 6 to December 19. Bandai Namco Filmworks later said personal information from up to 1.366 million accounts may have been exposed, but confirmed no online publication or secondary misuse.
-
Undisclosed major global stock exchange
November 12, 2025
Unknown attackers compromised a senior executive's device at an undisclosed major global stock exchange. Malware was present by October 10, 2025, and the attackers began collecting and exfiltrating data on November 12. Over approximately five months, they stole the executive's Outlook mailbox in small incremental archives using Dropbox and OneDrive while maintaining persistence through scheduled tasks disguised as legitimate software services.
-
Cornerstone Staffing Solutions, Inc.
November 13, 2025
•
[ ransomware, technology ]
Qilin listed Cornerstone Staffing Solutions on November 13, 2025 and displayed samples from recruitment databases and company files while threatening publication. Cornerstone had not publicly confirmed the claim, and no operational disruption was reported.
-
Under Armour
November 17, 2025
•
[ ransomware, retail, technology ]
Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
-
Harvard University
November 18, 2025
•
[ phishing, leak, education ]
Harvard disclosed that an unauthorized party accessed information systems used by its Alumni Affairs and Development office after a phone-based phishing attack. The compromised systems contained records used for alumni engagement and fundraising, including donation-related information, event attendance records, and contact details such as email addresses, telephone numbers, and home addresses. University communications indicated the systems did not generally contain Social Security numbers, passwords, or financial account numbers, but noted the institution was still investigating exactly what information was accessed and advised vigilance for suspicious communications purporting to be from the University.
