Ingram Micro
July 3, 2025
•[ ransomware ]
SafePay ransomware attack on Ingram Micro shut down internal systems, website, and online ordering systems.
Avantic Medical Lab
July 3, 2025
•[ ransomware, data leak ]
Everest listed the lab June 10 and leaked 31 GB of patient files on July 3; contents include PHI, EOB files, and some financial details.
Undisclosed European telecommunications organisation
July 3, 2025
•[ espionage, malware, vulnerability exploitation ]
Darktrace reports a China-aligned espionage actor (Salt Typhoon) breached a European telecom by exploiting a Citrix NetScaler Gateway, deploying SnappyBee malware for persistence and data staging. Activity reflects classic intelligence collection rather than service disruption; defenders observed beaconing, credential access, and movement to support systems.
Columbia University
July 3, 2025
•[ data leak, hacktivism ]
University said a hacker with a political agenda broke into IT systems and stole targeted student data; no threat activity detected since June 24.
Louis Vuitton
July 2, 2025
•[ data leak ]
Louis Vuitton confirmed multiregion customer data breach. No payment data impacted. Undisclosed amount of data was stolen.
C&M Software (service provider to Banco Central ecosystem)
July 2, 2025
•[ insider threat, compromised credentials, financial theft ]
Attackers allegedly bought an employee's credentials for ~$2,700 to access C&M systems and steal BRL 800M from connected institutions; part converted to crypto and laundered.
Deutsche Welthungerhilfe (WHH)
July 2, 2025
•[ ransomware, data leak ]
RaaS group listed WHH and offered stolen data for sale; WHH shut down affected systems, involved police and DPA, and refused to pay.
Luzerne County Government
July 1, 2025
•[ hack, government ]
Luzerne County, Pennsylvania reported a data breach in July 2025 after discovering unauthorized access to county servers. Investigation suggests personal and possibly financial data were exposed, though no service disruption or encryption was reported.
OutcomesOne
July 1, 2025
•[ social, phishing, healthcare ]
A phishing attack compromised a single employees email account for about one hour at OutcomesOne, a Florida-based professional services firm providing health IT and medication management support to insurers and pharmacies. Attackers accessed PHI stored in the organizations email application server, exposing data of roughly 149,000 individuals including names, demographics, provider, insurance, and medication information. No Social Security numbers or financial data were involved.
Federal Emergency Management Agency (FEMA) and U.S. Customs and Border Protection (CBP)
July 1, 2025
•[ hack, government ]
Attackers gained unauthorized access to FEMA Region 6s Citrix-based virtual desktop infrastructure beginning July 2025, exfiltrating sensitive employee data from both FEMA and CBP systems. The compromise originated from stolen credentials and enabled lateral movement between federal systems before detection.
Undisclosed U.S. political associates (per Reuters)
July 1, 2025
•[ data leak, state-sponsored, political ]
Reuters-reported claim: Iran-linked actors threaten to release ~100 GB of emails allegedly stolen from associates of Donald Trump; CISA called material 'purportedly stolen' and 'unverified.'
Pulse Urgent Care Center
July 1, 2025
•[ data leak, unauthorized access, healthcare ]
Unauthorized access to Pulse Urgent Care Centers network exposed patient PHI; no encryption or quantitative scope reported and threat actor unconfirmed.
Accu Reference Medical Laboratory
July 1, 2025
•[ ransomware, data leak ]
Qilin listed Accu Reference on July 10 claiming they acquired data on July 1; screenshots display unredacted PHI; encryption not indicated.
Undisclosed Ukrainian local government entity
July 1, 2025
•[ espionage, webshell, intrusion ]
Symantec observed multi-week summer 2025 espionage intrusion against a Ukrainian local government network using LocalOlive webshell and dual-use Windows tools; no operational disruption reported.
Undisclosed Southeast Asian conglomerate
July 1, 2025
•[ intrusion, data exfiltration, corporate data ]
The Osiris threat group conducted a prolonged intrusion against an undisclosed Southeast Asian conglomerate beginning in mid-2025, resulting in the exfiltration of large volumes of sensitive corporate and financial data. The incident is documented through security research and attacker leak site claims, without confirmation of ransomware encryption.
Boniface Mwangi (Kenyan activist)
July 1, 2025
•[ spyware, surveillance, data extraction ]
An AFP/Digital Journal report said Kenyan activist Boniface Mwangi feared for his life after learning spyware was installed on his phone while it was in police custody following his July 2025 arrest. The article cited Citizen Lab findings that a surveillance tool linked to Cellebrite technology enabled Kenyan police to access extensive content on the device, including messages, private files, financial information, passwords, and other sensitive data. The report describes state-enabled device compromise/data extraction rather than an enterprise network breach.
PayPal
July 1, 2025
•[ data exposure, software error, personally identifiable information ]
PayPal disclosed that a software error in its PayPal Working Capital (PPWC) loan application exposed sensitive personal information, including Social Security numbers, for nearly six months in 2025. The exposure window was reported as beginning July 1, 2025 and ending when PayPal fixed/rolled back the problematic code and blocked further access on December 13, 2025. PayPal stated it notified affected customers and offered credit monitoring, and reporting noted some accounts showed unauthorized activity that PayPal said it reimbursed. The incident was characterized as a data exposure caused by an application error rather than a compromise of PayPals broader systems.
LG Uplus
July 1, 2025
•[ unauthorized access, data leak, credential theft ]
LG Uplus reported illegal access to internal information after a breach affecting company servers. Investigators said exposed information included server lists, server account credentials, and employees names, and later found forensic reconstruction was hindered after key systems were reinstalled or discarded.
Qantas
June 30, 2025
•[ data leak, third-party ]
Qantas detected unusual activity on a thirdparty contactcenter platform; a significant amount of customer data may be stolen; airline core systems remained secure.
International Criminal Court (ICC)
June 30, 2025
•[ cyberattack, espionage ]
ICC reported a cyberattack detected and contained.Impact and data access undisclosed. This follows a 2023 espionage incident.
