Recent Breaches
-
November 11, 2025 • In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records. The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country.
-
November 10, 2025 • The Chamber of Deputies of Chaco province in Argentina reported that a cybersecurity incident affecting part of its server infrastructure had been identified as a ransomware attack, prompting technicians and the state IT firm ECOM Chaco to shut down the official website, the online system for tracking legislative procedures and the electronic legal digest while they contained the intrusion and preserved institutional information; authorities filed a criminal complaint with the provincial cybercrime unit and emphasized that maintaining the continuity of essential legislative functions and the security of data were priorities during the response.
-
November 10, 2025 • A phone phishing scam enabled unauthorized access to Princeton Universitys Advancement database containing alumni, donor, student, parent, and some faculty information; the breach lasted under 24 hours and the university has not determined what data was viewed or extracted.
-
November 10, 2025 • On November 10, 2025, Weda medical software used by general practitioners across France experienced a major cyberattack that rendered the system inaccessible. Physicians were unable to view or transmit patient medical records for several days. Service resumed only in degraded mode on November 14. No evidence of data encryption or exfiltration has been reported.
-
November 9, 2025 • Manassas City Public Schools in Virginia announced that all schools would be closed on Monday, November 10, 2025, after a cybersecurity incident disrupted phone and network systems across the district. According to statements from Superintendent Kevin Newman reported by WJLA and FOX 5, the breach was discovered over the weekend, more than 7,000 families were notified, and the district experienced significant connectivity and telephone outages while physical school security remained unaffected. Schools were already scheduled to be closed Tuesday for a holiday, and officials used the extended break to give IT staff time to investigate and restore systems so normal operations could resume on Wednesday.
-
November 9, 2025 • According to coverage in The Register of research by Chinese blog MXRN, attackers breached the systems of Beijing linked security company Knownsec and leaked more than twelve thousand classified documents describing Chinese state cyber weapons, internal tools and global targeting lists, along with code for remote access trojans that can compromise major desktop and mobile operating systems; the cache also reportedly includes a spreadsheet of 80 successfully attacked overseas targets and massive datasets such as Indian immigration records, South Korean telecom call logs and Taiwanese road planning information that Knownsec had previously obtained in offensive operations, some of which were briefly published to GitHub before being removed.
-
November 9, 2025 • OpenAI reported that on November 9 an attacker accessed Mixpanels analytics application server and exported limited customer-identifiable metadata including names, emails, coarse location, browser and operating system information, referring websites, and account identifiers; no credentials, API keys, chat content, or service disruption occurred.
-
November 9, 2025 • In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data included more than 500k email addresses reportedly belonging to North American customers, along with a smaller subset containing names, usernames, phone numbers and physical addresses.
-
November 9, 2025 • In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published the following month. The impacted data included names, usernames, phone numbers and physical addresses.
-
November 8, 2025 • At a media forum interview reported by TASS, the director of TRK Tavria in Russian occupied Kherson said the outlet's website is regularly subjected to DDoS attacks attributed to Ukrainian hackers, with several incidents that took the site down for a period before technicians restored it; he stressed that despite the repeated cyberattacks there has been no serious lasting damage, and that the company continues to operate its regional television, radio and online services.
-
November 8, 2025 • Reports from Indian media state that cybercriminals somehow obtained the ability to operate a dormant State Bank of India account held by Trinamool Congress MP Kalyan Banerjee, transferring about 5556 lakh from his active Kalighat branch account into the dormant account and then withdrawing the full amount; the bank has filed a complaint with the Kolkata Police cybercrime division, which is investigating how forged or manipulated KYC information, including Banerjees photo and mobile number, was used to facilitate the online banking fraud and whether any internal security lapses contributed to the theft.
-
November 8, 2025 • Swiss outlet watson.ch, citing Tribune de Genve and 24 Heures, reports that Swiss peripherals maker Logitech was listed on the Clop ransomware gangs dark web leak site, with extortionists claiming to have stolen data and threatening to publish it unless a ransom was paid; subsequent regulatory filings and security reporting confirm t
-
November 8, 2025 • Surveillance-technology and telecom systems provider Protei, founded in Russia and now headquartered in Jordan, was hacked by an unidentified actor who defaced its public website around November 8, 2025 and stole the contents of its web server, including about 182 GB of historical emails and files related to its deep packet inspection and lawful intercept products used by telecoms across dozens of countries.
-
November 8, 2025 • A large-scale supply-chain campaign abused OAuth tokens linked to Gainsight-published applications integrated with Salesforce, enabling unauthorized API calls that accessed certain customers Salesforce data; according to Salesforce and multiple security advisories, suspicious activity began around November 8, 2025, and may have affected more than 200 Salesforce instances before tokens were revoked and the apps were pulled from the AppExchange.
-
November 8, 2025 • The Devman ransomware group attacked the Georgia Superior Court Clerks Cooperative Authority beginning November 8, 2025. GSCCCA voluntarily restricted access to its systems while investigating a credible cyber threat. Devman claimed to have exfiltrated 500 GB of organizational data from GSCCCAs application servers and demanded a $400,000 ransom by November 27.
-
November 7, 2025 WOG reported a massive cyberattack that temporarily disrupted its online services; specialists restored most functions the same day and all services were fully operational shortly after.
-
November 6, 2025 • A ComputerHoy journalist describes deliberately infecting a Windows PC in 2025 with the Andrmeda malware, which enrolls machines into a botnet so attackers can download additional payloads and execute arbitrary files remotely. The piece walks through how the author obtained the malware sample, how the infection behaves on the system, the use of Spains INCIBE antibotnet service and security tools to detect and remove Andrmeda, and what readers should do if they discover their own devices are part of the botnet. This is a self-inflicted test infection rather than an unsolicited attack on an organization.
-
November 6, 2025 • According to Belgian News Agency coverage relayed by DataBreaches.net, pro Russian hacktivist group NoName057 claimed responsibility on Telegram for a distributed denial of service attack that briefly disrupted the public websites of Belgian telecom operators Proximus and Scarlet, as well as Ghent University Hospital, on a Wednesday morning in November 2025. Proximus said technicians detected unusual traffic around 7:20 and a sharp rise in volume shortly after, but countermeasures meant overall impact on service was very limited and core systems remained resilient. The group also boasted of targeting an internal Telenet portal, a claim Telenet publicly rejected, emphasizing that its systems were not hacked and no sites went offline, and authorities noted that such DDoS attacks do not involve any compromise of user data.
-
November 6, 2025 • Pro-Russian hacktivist group NoName057 claimed responsibility for a distributed denial-of-service attack that briefly disrupted the public websites of Belgian telecom operators Proximus and Scarlet and Ghent University Hospital in November 2025. According to the Belgian News Agency, Proximus technicians detected unusual traffic around 7:20 a.m., saw a sharp spike by 7:30, and deployed countermeasures that kept core systems running so overall impact on services remained very limited. Officials stressed that the DDoS campaign affected website availability only and did not involve any intrusion into internal networks or compromise of customer data.
-
November 6, 2025 • The U.S. Congressional Budget Office confirmed a cybersecurity incident after a suspected foreign hacker breached its network, potentially exposing sensitive internal information. A CBO spokesperson told BleepingComputer that the agency identified the intrusion, immediately contained it, and deployed additional monitoring and new security controls while the investigation continues. Reporting based on U.S. officials indicates that emails and exchanges between congressional offices and CBO analysts may have been accessed, raising concerns that draft reports, economic forecasts, and other confidential communications could be at risk, although the extent of any data exfiltration has not yet been established and CBOs work for Congress is continuing.