-
Optima Tax Relief
May 1, 2025
•
[ ransomware, financial, leak ]
Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
-
Power Grid Corporation of India Limited (POWERGRID)
May 2, 2025
•
[ hack, ddos, energy ]
On May 2, 2025 NSFOCUS observed an NTP-reflection DDoS attack against POWERGRID public website lasting 31 minutes 26 seconds. Secondary cybersecurity reporting describes temporary website and online-service disruption, while NSFOCUS distinguishes possible online billing or fault-reporting effects from confirmed measurements. No disruption to the physical power grid was reported. No operator was identified; Hacktivist and Protest are inferred from the wider India-Pakistan cyber confrontation.
-
Office of the President of India
May 7, 2025
•
[ ddos, government ]
NSFOCUS observed two consecutive DNS-reflection DDoS waves targeting presidentofindia.gov.in on May 7-8, 2025 during the India-Pakistan military escalation. The first lasted about 2 hours 16 minutes and the second about 19 hours 46 minutes using NSFOCUS GMT+8 reporting times. Media described Indian government portals becoming unavailable during the campaign, but did not independently quantify a continuous outage of this particular website. The operator remains unknown; Hacktivist and Protest are inferred from timing and target selection.
-
Texas Department of Transportation
May 12, 2025
•
[ leak, government ]
Approximately 300,000 crash reports were downloaded via a compromised account in TxDOTs Crash Records Information System on May 12, 2025. The agency disclosed the incident on June 6, 2025 and began notifications; no actor or motive has been identified.
-
Academic Urology & Urogynecology of Arizona
May 18, 2025
•
[ ransomware, healthcare, leak ]
Academic Urology detected unauthorized network access on May 22, 2025 and later determined that files may have been accessed or acquired between May 18 and May 22. INC claimed the incident on June 17, 2025, but the practice did not confirm that attribution. The practice notified 73,281 people after completing its review on January 30, 2026; no operational disruption was reported.
-
KrebsOnSecurity
May 21, 2025
KrebsOnSecurity was hit by a record 6.3 Tbps DDoS attributed to the Aisuru IoT botnet; service remained online behind Google Project Shield.
-
Madera Community Hospital
May 28, 2025
•
[ ransomware, healthcare ]
An unauthorized third party accessed Madera Community Hospital's network on May 28 and May 29, 2025. The hospital later determined that files from part of its network were likely acquired, ultimately identifying 150,810 affected individuals. An unidentified extortion group claimed responsibility and demanded payment but later withdrew its demand after learning the victim was a hospital, stating that it did not want to harm patients. No known group has publicly identified itself as the perpetrator, and the hospital found no evidence that the compromised information was publicly released.
-
YES24
June 9, 2025
•
[ ransomware, retail, technology ]
Ransomware encrypted internal servers at YES24 beginning June 9 2025, forcing nationwide outage of its ticketing, e-book, and online community services for four days; operations gradually restored; no confirmed data exfiltration.
-
Hôpital Privé de la Loire
June 26, 2025
•
[ hack, leak, healthcare ]
Hpital priv de la Loire in Saint-tienne, France (Ramsay Sant) had its electronic patient record accessed June 26-July 1, 2025 via a doctor's account. Hacker "Marak" claimed the theft and tried to sell the data. CNIL fined the hospital 500,000 on Sept. 3, 2026.
-
Blue Fish Pediatrics, L.L.P.
July 11, 2025
•
[ leak, healthcare ]
Blue Fish Pediatrics determined that an unauthorized party had access to a limited number of files in its computer systems between 2025-07-11 and 2025-07-17. The practice completed its file review on 2026-05-04 and notified affected individuals in June 2026. The incident affected 62,150 individuals in total, including 41,485 Texas residents. Blue Fish Pediatrics did not publicly identify the actor, motive, or initial access method.
-
UK Ministry of Defence
July 18, 2025
•
[ leak, government, espionage ]
Further reporting on MoD data leak reveals identities of more than 100 UK government personnel compromised; follows ARAP breach revelations and superinjunction details.
-
CoinDCX
July 19, 2025
Blockchain sleuths reported ~$44.2M drained from CoinDCX infrastructure in early hours of July 19; initial wallet funded via Tornado Cash; part of funds bridged from Solana to Ethereum.
-
Dell
July 21, 2025
•
[ hack, technology ]
Dell claims a demo/test environment at its Customer Solution Centers was breached by the World Leaks extortion group. Stolen data appears largely synthetic with no customer impact reported.
-
Colorado Health Network Inc.
July 29, 2025
•
[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
-
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•
[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
-
Norwest Venture Partners
August 9, 2025
•
[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
-
The Estée Lauder Companies Inc.
August 9, 2025
On or around August 9, 2025, an unauthorized party accessed Este Lauder's Oracle E-Business Suite used for human-resources management and obtained employee-related personal information. The company confirmed the breach on June 19, 2026. The timing aligns with Cl0p's mass exploitation of CVE-2025-61882, and Cl0p reportedly leaked 870 GB under Este Lauder's name, but the company did not confirm the vulnerability or attribution; no operational disruption was reported.
-
Motor Controls, Inc.
August 26, 2025
World Leaks listed Motor Controls on its data-leak site on 26 August 2025, and the supplied breach database subsequently indexed 18,598 published records. The underlying intrusion date and access vector were not reported, and no victim-specific evidence of encryption or operational disruption was found. This event is separate from the breach Motor Controls notified to the Texas Attorney General in May 2025.
-
MCBS, LLC
September 22, 2025
•
[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
-
Comcast Corporation
September 29, 2025
•
[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
