Cardex
February 18, 2025
•[ vulnerability, theft, data leak ]
Abstract reported a session key vulnerability in Cardex that allowed an attacker to perform unauthorized transactions and drain funds from thousands of wallets.
RestorixHealth
May 29, 2024
•[ phishing, data leak ]
Investigation confirmed unauthorized access to one mailbox (May 729, 2024); notification letters commenced Feb 14, 2025.
NorthWest Arkansas Community College
February 27, 2025
•[ data leak ]
NWACC began mailing letters indicating personal information may have been affected; incident under review and notifications ongoing.
GS Shop
February 13, 2025
•[ credential stuffing, data leak ]
Credential-stuffing led to extraction of ~1.58M GS Shop customer records (21-06-2024 to 13-02-2025); financial data not affected; GS Retail blocked offending IPs, urged password changes, and launched a security task force.
Freddie Mac
February 19, 2025
•[ data leak, personally identifiable information ]
Breach notice filed with Massachusetts AG on Feb 19, 2025; unauthorized access to files containing consumers SSNs.
Medical Billing Specialists, Inc.
February 17, 2024
•[ data leak ]
Network disruption Feb 17, 2024; investigation confirmed unauthorized access to systems with sensitive data; notices filed 07-01-2025.
DecisionFi
January 15, 2025
•[ data leak ]
Unauthorized party accessed files via a web application; NH AG filing and notification letters dated 21-02-2025.
VectraRx Mail Pharmacy Services
December 13, 2024
•[ data leak ]
Unusual activity discovered Dec 13, 2024; review confirmed potential access/acquisition; notifications in Feb 2025.
Bybit
February 21, 2025
•[ data leak ]
Bybit disclosed major security breach; services restored and recovery efforts reported shortly after.
Supreme Administrative Court of Bulgaria
February 20, 2025
•[ ransomware, data leak ]
RansomHouse used White Rabbit ransomware against Bulgarias Supreme Administrative Court on Jan 27, encrypting ~140 computers; group posted employee-related files as proof of data theft. Court remained operational via paper processes; investigation into data leakage ongoing.
U.S. Coast Guard
February 14, 2025
•[ data leak ]
Coast Guards Direct Access system was breached on 02/14/2025, exposing financial/PII and delaying pay for 1,135 members; system was taken offline while CG Cyber Command & CGIS investigated; offline payments processed and security measures pursued; no attribution yet.
Insight Partners
January 16, 2025
•[ ransomware, social engineering, data leak ]
On January 16, 2025, Insight Partners detected a cyberattack following a social engineering intrusion first traced to October 2024. Attackers exfiltrated sensitive files related to funds, management companies, portfolio companies, banking and tax records, and personally identifiable data of employees, partners, and investors. More than 12,000 individuals were affected. The incident escalated into a ransomware attack, with systems partially encrypted before containment. No named threat group has been identified, but the actor is criminal and financially motivated.
Spyx
March 25, 2025
•[ data leak, stalkerware ]
Stalkerware service reportedly leaked user data including iCloud credentials and device identifiers.
College Hospital Costa Mesa
March 27, 2025
•[ data leak ]
California hospital disclosed a cybersecurity incident exposing patient information.
United Domestic Workers Of America
January 17, 2025
•[ data leak ]
Union reported unauthorized access; breach letters mailed March 27 to affected members.
Capital
March 27, 2025
•[ data leak ]
Ukrainian outlet said site was attacked after articles about a public figure.
Baylor Scott & White Texas Spine & Joint Hospital
January 10, 2025
•[ Email Compromise, Data Leak, Unauthorized Access ]
Unauthorized access to O365 mailbox exposed patient demographic and treatment information.
Cardi’s Furniture And Mattress
March 10, 2025
•[ data leak ]
Retailer mailed breach letters following cybersecurity incident affecting customer information.
Pam Golding Properties
March 20, 2025
•[ data leak ]
South African real-estate firm investigated data leak after reports of compromise.
Southeast Series Of Lockton Companies LLC
November 20, 2024
•[ data leak ]
Insurance brokerage reported unauthorized access to files on an employee computer
