-
KrebsOnSecurity
May 21, 2025
KrebsOnSecurity was hit by a record 6.3 Tbps DDoS attributed to the Aisuru IoT botnet; service remained online behind Google Project Shield.
-
Madera Community Hospital
May 28, 2025
•
[ ransomware, healthcare ]
An unauthorized third party accessed Madera Community Hospital's network on May 28 and May 29, 2025. The hospital later determined that files from part of its network were likely acquired, ultimately identifying 150,810 affected individuals. An unidentified extortion group claimed responsibility and demanded payment but later withdrew its demand after learning the victim was a hospital, stating that it did not want to harm patients. No known group has publicly identified itself as the perpetrator, and the hospital found no evidence that the compromised information was publicly released.
-
YES24
June 9, 2025
•
[ ransomware, retail, technology ]
Ransomware encrypted internal servers at YES24 beginning June 9 2025, forcing nationwide outage of its ticketing, e-book, and online community services for four days; operations gradually restored; no confirmed data exfiltration.
-
Hôpital Privé de la Loire
June 26, 2025
•
[ hack, leak, healthcare ]
Hpital priv de la Loire in Saint-tienne, France (Ramsay Sant) had its electronic patient record accessed June 26-July 1, 2025 via a doctor's account. Hacker "Marak" claimed the theft and tried to sell the data. CNIL fined the hospital 500,000 on Sept. 3, 2026.
-
Blue Fish Pediatrics, L.L.P.
July 11, 2025
•
[ leak, healthcare ]
Blue Fish Pediatrics determined that an unauthorized party had access to a limited number of files in its computer systems between 2025-07-11 and 2025-07-17. The practice completed its file review on 2026-05-04 and notified affected individuals in June 2026. The incident affected 62,150 individuals in total, including 41,485 Texas residents. Blue Fish Pediatrics did not publicly identify the actor, motive, or initial access method.
-
UK Ministry of Defence
July 18, 2025
•
[ leak, government, espionage ]
Further reporting on MoD data leak reveals identities of more than 100 UK government personnel compromised; follows ARAP breach revelations and superinjunction details.
-
CoinDCX
July 19, 2025
Blockchain sleuths reported ~$44.2M drained from CoinDCX infrastructure in early hours of July 19; initial wallet funded via Tornado Cash; part of funds bridged from Solana to Ethereum.
-
Dell
July 21, 2025
•
[ hack, technology ]
Dell claims a demo/test environment at its Customer Solution Centers was breached by the World Leaks extortion group. Stolen data appears largely synthetic with no customer impact reported.
-
Colorado Health Network Inc.
July 29, 2025
•
[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
-
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•
[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
-
Norwest Venture Partners
August 9, 2025
•
[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
-
The Estée Lauder Companies Inc.
August 9, 2025
On or around August 9, 2025, an unauthorized party accessed Este Lauder's Oracle E-Business Suite used for human-resources management and obtained employee-related personal information. The company confirmed the breach on June 19, 2026. The timing aligns with Cl0p's mass exploitation of CVE-2025-61882, and Cl0p reportedly leaked 870 GB under Este Lauder's name, but the company did not confirm the vulnerability or attribution; no operational disruption was reported.
-
Motor Controls, Inc.
August 26, 2025
World Leaks listed Motor Controls on its data-leak site on 26 August 2025, and the supplied breach database subsequently indexed 18,598 published records. The underlying intrusion date and access vector were not reported, and no victim-specific evidence of encryption or operational disruption was found. This event is separate from the breach Motor Controls notified to the Texas Attorney General in May 2025.
-
MCBS, LLC
September 22, 2025
•
[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
-
Comcast Corporation
September 29, 2025
•
[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
-
Defense Manpower Data Center (DMDC), U.S. Department of Defense
October 1, 2025
•
[ leak, government, misconfiguration ]
Unauthorized users accessed files through a vulnerable Defense Manpower Data Center file-sharing system from sometime in October 2025 until July 16, 2026. The Defense Department discovered and patched the vulnerability on July 16. Data pertaining to current and former service members and other DoD-associated individuals was exposed; the intrusion date and perpetrators remain unidentified.
-
Upper Township
October 5, 2025
•
[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
-
Unlimited Technology Systems, LLC
October 5, 2025
•
[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
-
The Connecticut Institute for the Blind, Inc. d/b/a Oak Hill
October 6, 2025
•
[ leak, healthcare ]
The Connecticut Institute for the Blind, Inc., doing business as Oak Hill, experienced a security incident on or about October 6, 2025. Its investigation found that files in certain affected accounts were accessed or acquired without authorization. Oak Hill determined on May 13, 2026, that the files contained personal information, mailed notices on June 30, and reported 1,556 affected individuals to HHS. No operational disruption was reported, and Oak Hill reported no known identity or financial fraud resulting from the incident.
-
Clarinda Regional Health Center
October 23, 2025
On or around October 23, 2025, an unauthorized actor acquired files from Clarinda Regional Health Center's network containing personal and protected health information. LockBit later claimed responsibility, although CRHC did not publicly confirm the attribution, and the hospital began notifying 24,341 affected individuals in June 2026.
