-
Blue Fish Pediatrics, L.L.P.
July 11, 2025
•
[ leak, healthcare ]
Blue Fish Pediatrics determined that an unauthorized party had access to a limited number of files in its computer systems between 2025-07-11 and 2025-07-17. The practice completed its file review on 2026-05-04 and notified affected individuals in June 2026. The incident affected 62,150 individuals in total, including 41,485 Texas residents. Blue Fish Pediatrics did not publicly identify the actor, motive, or initial access method.
-
UK Ministry of Defence
July 18, 2025
•
[ leak, government, espionage ]
Further reporting on MoD data leak reveals identities of more than 100 UK government personnel compromised; follows ARAP breach revelations and superinjunction details.
-
CoinDCX
July 19, 2025
Blockchain sleuths reported ~$44.2M drained from CoinDCX infrastructure in early hours of July 19; initial wallet funded via Tornado Cash; part of funds bridged from Solana to Ethereum.
-
Dell
July 21, 2025
•
[ hack, technology ]
Dell claims a demo/test environment at its Customer Solution Centers was breached by the World Leaks extortion group. Stolen data appears largely synthetic with no customer impact reported.
-
Colorado Health Network Inc.
July 29, 2025
•
[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
-
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•
[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
-
Norwest Venture Partners
August 9, 2025
•
[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
-
The Estée Lauder Companies Inc.
August 9, 2025
On or around August 9, 2025, an unauthorized party accessed Este Lauder's Oracle E-Business Suite used for human-resources management and obtained employee-related personal information. The company confirmed the breach on June 19, 2026. The timing aligns with Cl0p's mass exploitation of CVE-2025-61882, and Cl0p reportedly leaked 870 GB under Este Lauder's name, but the company did not confirm the vulnerability or attribution; no operational disruption was reported.
-
Motor Controls, Inc.
August 26, 2025
World Leaks listed Motor Controls on its data-leak site on 26 August 2025, and the supplied breach database subsequently indexed 18,598 published records. The underlying intrusion date and access vector were not reported, and no victim-specific evidence of encryption or operational disruption was found. This event is separate from the breach Motor Controls notified to the Texas Attorney General in May 2025.
-
MCBS, LLC
September 22, 2025
•
[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
-
Comcast Corporation
September 29, 2025
•
[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
-
Defense Manpower Data Center (DMDC), U.S. Department of Defense
October 1, 2025
•
[ leak, government, misconfiguration ]
Unauthorized users accessed files through a vulnerable Defense Manpower Data Center file-sharing system from sometime in October 2025 until July 16, 2026. The Defense Department discovered and patched the vulnerability on July 16. Data pertaining to current and former service members and other DoD-associated individuals was exposed; the intrusion date and perpetrators remain unidentified.
-
Upper Township
October 5, 2025
•
[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
-
Unlimited Technology Systems, LLC
October 5, 2025
•
[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
-
The Connecticut Institute for the Blind, Inc. d/b/a Oak Hill
October 6, 2025
•
[ leak, healthcare ]
The Connecticut Institute for the Blind, Inc., doing business as Oak Hill, experienced a security incident on or about October 6, 2025. Its investigation found that files in certain affected accounts were accessed or acquired without authorization. Oak Hill determined on May 13, 2026, that the files contained personal information, mailed notices on June 30, and reported 1,556 affected individuals to HHS. No operational disruption was reported, and Oak Hill reported no known identity or financial fraud resulting from the incident.
-
Clarinda Regional Health Center
October 23, 2025
On or around October 23, 2025, an unauthorized actor acquired files from Clarinda Regional Health Center's network containing personal and protected health information. LockBit later claimed responsibility, although CRHC did not publicly confirm the attribution, and the hospital began notifying 24,341 affected individuals in June 2026.
-
Bennett College
October 27, 2025
•
[ ransomware, education ]
Bennett College, a private HBCU for women in Greensboro, N.C., had network data accessed Oct. 27-Nov. 15, 2025, affecting 30,065 people. INC Ransom listed the college on its leak site Dec. 6; the college notified the state AG and offered credit monitoring.
-
Multiple undisclosed JetBrains Marketplace users
October 31, 2025
•
[ malware, technology ]
From 2025-10-31 through June 2026, 15 malicious third-party JetBrains Marketplace plugins published under seven vendor accounts posed as functional AI developer tools while secretly exfiltrating user-supplied AI provider API keys over unencrypted HTTP to a hard-coded server. The plugins accumulated approximately 70,000 installations. JetBrains removed all 15 plugins, banned the publisher accounts, and remotely disabled installed copies on 2026-06-17. JetBrains confirmed that its internal systems, source code, and corporate infrastructure were not compromised. The server's location in Beijing does not establish the perpetrator's country.
-
Suno, Inc.
November 1, 2025
In November 2025, a hacker using the name ellie.191 gained unauthorized access to Suno systems and obtained outdated source code, internal details about the company's music-scraping and model-training pipelines, customer account information, and Stripe purchase data. The actor said a Suno employee had been compromised through the Shai-Hulud supply-chain worm and that harvested GitHub and cloud credentials enabled the intrusion; the actor's relationship to the original Shai-Hulud campaign is unknown. Have I Been Pwned later examined a dataset containing 55.3 million unique email addresses, some phone numbers, and tens of thousands of purchase records with names, addresses, transaction information, and partial card details. Suno confirmed a November 2025 incident and did not dispute the reported account count, although it said the incident primarily involved outdated source code and that no sensitive personal information was compromised. No operational disruption was reported.
-
Bandai Namco Filmworks
November 4, 2025
•
[ hack, leak, technology ]
Between 5:00 and 8:45 p.m. on November 4, 2025, an unnamed 15-year-old student sent false account-cancellation requests to Bandai Channel after identifying a server vulnerability and used ChatGPT to refine and automate his code. He changed his IP address about 30 times after being blocked, caused 46,812 accounts to be deregistered, and prompted a service suspension from November 6 to December 19. Bandai Namco Filmworks later said personal information from up to 1.366 million accounts may have been exposed, but confirmed no online publication or secondary misuse.
