Recent Breaches
-
January 26, 2025 • New York Blood Center said it does not have a "specific timetable for system restoration" following the attack, which has led to canceled appointments and delays
-
January 29, 2025 • NorthBay Healthcare Corporation in California notifies 569,012 people of a breach that occurred between January 11 to April 1, 2024.
-
February 1, 2025 An off-duty San Jose police officer used a personal device to make unauthorized searches of the department's Flock license-plate database and disclosed the complainant's vehicle location to his cousin, the domestic-violence suspect. Police discovered the misuse through audit records after the woman's February 2025 complaint. February 1 is a discovery-month placeholder, not the verified access date. The officer was dismissed in April 2026.
-
February 1, 2025 • Canadian telecom Telus notified some consumer customers in Sep 2026 that an attacker used compromised credentials to access their accounts between Feb 2025 and Jun 2026, viewing personal and billing data. Telus reset credentials, notified police and offered ID protection.
-
February 17, 2025 • Pro-Russian hacktivist group NoName057(16) claimed a coordinated DDoS campaign against Italian institutions and banks, causing temporary service disruptions but no data compromise; politically motivated, with activity spanning several days.
-
February 25, 2025 • Insider contractor illicitly accessed and leaked confidential IRS taxpayer records (activity occurred 20182020; higher victim count publicized Feb 2025).
-
March 1, 2025 • CISA and the FBI reported that foreign cyber actors on the network of an unnamed U.S. industrial automation integrator serving utilities and transport firms collected about 800 files of customer SCADA data, ICS device details and schematics in March-April 2025.
-
March 7, 2025 • PEAR listed AIL Hospitality Group on its leak site on August 5, 2025. DataBreach.com later indexed 11,086 records containing names and driver's license information and assigns March 7, 2025 as the breach date. Independent ransomware trackers estimate the compromise in early July 2025, so the precise intrusion date remains contested. No independently verified operational disruption has been established.
-
March 20, 2025 • Autism Services of Saskatoon discovered a ransomware attack on March 20, 2025 after certain systems became inaccessible. A forensic investigation determined that the threat actor likely accessed and exfiltrated information collected from clients and former employees, and a ransom demand was found on a desktop computer. Autism Services isolated affected systems, terminated network access, and began restoring servers the following day. The last observed unauthorized activity occurred March 20. The organization notified 2,168 affected individuals, and subsequent monitoring found no evidence that the copied information was published or used for fraud. Investigators could not conclusively identify the entry point or responsible actor, although a firewall vulnerability was considered the likely access path.
-
April 1, 2025 From April 2025 through February 2026, unidentified attackers exploited a previously unknown server-software vulnerability and security misconfigurations to gain and maintain access to the Korea National Diplomatic Academy's online education system. A government authority detected suspicious activity in February 2026, after which the Ministry of Foreign Affairs blocked the system. The ministry confirmed signs of leakage involving user IDs, names, email addresses, encrypted passwords, and other personnel information; reporting placed the affected database at up to approximately 10,000 records. National identification numbers, mobile phone numbers, home addresses, and photographs were not included. Authorities considered possible foreign state involvement, including North Korea, but said there was insufficient technical evidence for attribution.
-
April 2, 2025 • On April 2, 2025, a phishing email sent from a compromised account induced a victim at an undisclosed Ukrainian organization to open a malicious Remote Desktop Protocol file and connect to actor-controlled infrastructure. Google Threat Intelligence Group observed Turla deploy the StockStay.MarketMaker downloader to the victim device, which retrieved the StockStay backdoor from compromised Ukrainian government infrastructure. The victim's identity and any acquired information were not disclosed.
-
April 4, 2025 • The Ministry of iTaukei Affairs official Facebook page was hacked and defaced by unauthorized users posting content such as Hollywood movie clips. No sensitive or internal data was compromised; cybersecurity teams are working to restore control.
-
April 14, 2025 • Several gigabytes of internal 4chan backend data, including moderator emails, hashed passwords, and source code, were stolen and leaked online; brief service outage reported; no ransom or financial motive indicated.
-
April 23, 2025 • Attackers used previously leaked credentials in a large-scale credential-stuffing campaign against The North Faces online customer accounts in April 2025. Unauthorized logins exposed personally identifiable information from 2,861 customer profiles, though no financial data was accessed.
-
April 23, 2025 • NSFOCUS identified DDoS traffic against Bharat Sanchar Nigam Limited websites on April 23, 25 and 26, 2025 using CLDAP, NetBIOS and NTP reflection. Its May 7 observations reported the corporate site and related online services still inaccessible. The duration of each traffic wave is documented, but continuous downtime and any effect on the wider telecom network are not established. The attacker is unidentified; Hacktivist and Protest are limited inferences from the India-Pakistan conflict-related campaign.
-
May 1, 2025 • Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
-
May 2, 2025 • On May 2, 2025 NSFOCUS observed an NTP-reflection DDoS attack against POWERGRID public website lasting 31 minutes 26 seconds. Secondary cybersecurity reporting describes temporary website and online-service disruption, while NSFOCUS distinguishes possible online billing or fault-reporting effects from confirmed measurements. No disruption to the physical power grid was reported. No operator was identified; Hacktivist and Protest are inferred from the wider India-Pakistan cyber confrontation.
-
May 7, 2025 • NSFOCUS observed two consecutive DNS-reflection DDoS waves targeting presidentofindia.gov.in on May 7-8, 2025 during the India-Pakistan military escalation. The first lasted about 2 hours 16 minutes and the second about 19 hours 46 minutes using NSFOCUS GMT+8 reporting times. Media described Indian government portals becoming unavailable during the campaign, but did not independently quantify a continuous outage of this particular website. The operator remains unknown; Hacktivist and Protest are inferred from timing and target selection.
-
May 12, 2025 • Approximately 300,000 crash reports were downloaded via a compromised account in TxDOTs Crash Records Information System on May 12, 2025. The agency disclosed the incident on June 6, 2025 and began notifications; no actor or motive has been identified.
-
May 18, 2025 • Academic Urology detected unauthorized network access on May 22, 2025 and later determined that files may have been accessed or acquired between May 18 and May 22. INC claimed the incident on June 17, 2025, but the practice did not confirm that attribution. The practice notified 73,281 people after completing its review on January 30, 2026; no operational disruption was reported.