Hixson Holdings, Inc
November 5, 2024
•[ data leak ]
Hixson Holdings Inc., a Cincinnati-based architecture, engineering and project management firm, detected suspicious activity on its network on November 5, 2024. A forensic investigation later determined that an Undetermined intruder may have accessed sensitive data on Hixson's systems from that date through October 9, 2025, before the review concluded. Exposed information includes names, contact details, Social Security numbers and medical or insurance identifiers, highlighting that the firm handled protected health information for some clients. Hixson filed notice with the Massachusetts Attorney General and began mailing breach letters on October 31, 2025, while law firms and regulators assess potential legal and remediation obligations.
Ravin Academy
October 22, 2025
•[ hacktivism, data leak, government ]
Cyber intrusion into Ravin Academy, an Iranian cybersecurity training institution linked to the Ministry of Intelligence, by a hacktivist group. The stolen data was posted online with anti-regime rhetoric, indicating an ideologically motivated protest hack.
Vibra Hospital of Sacramento
August 30, 2025
•[ data leak, PHI ]
Attack on Vibra Hospital of Sacramentos network occurred between August 30 and September 5, 2025. The breach exposed protected health information, including medical and insurance details but no financial or Social Security data. No ransomware or encryption occurred, and no threat group has publicly claimed responsibility.
WhatsApp users in Bijnor, Uttar Pradesh
October 1, 2025
•[ malware, phishing, data leak ]
Several WhatsApp users in Bijnor, Uttar Pradesh had their Android phones compromised after downloading a fake wedding invitation via WhatsApp. The malware granted remote access, exposing personal messages, photos, and financial app data. Victims filed complaints with the Bijnor Cyber Crime Police Station; authorities believe multiple individuals across the district were affected.
MAYA Systems Ltd.
October 12, 2025
•[ data leak, hacktivism, espionage ]
An Iran-linked hacktivist group known as Cyber Toufan claimed responsibility for breaching Israeli defense contractor MAYA Systems in October 2025, stealing and releasing files allegedly showing Iron Beam laser-defense system designs and other IDF technologies. Israeli authorities have not verified the authenticity of the leaked materials.
Arizona Federal Public Defender’s Office
September 24, 2025
•[ ransomware, data leak ]
Ransomware detected Sept 24 2025 crippled Arizonas Federal Public Defender Office, encrypting decades of case files and deleting backups. Investigators suspectbut have not confirmeddata exfiltration. No threat group has claimed responsibility.
M-TIBA (CarePay Kenya)
October 23, 2025
•[ data leak ]
Threat actor Kazu claimed on Oct 23 2025 to have exfiltrated 2.15 TB of data (~4.8 M users) from M-TIBA, a Safaricom-backed health-finance platform; sample of 114 k records posted; Kenyas ODPC launched investigation Oct 29 2025; no encryption or operational outage confirmed.
Khan & Associates CPA, Inc.
July 9, 2025
•[ unauthorized access, data leak ]
An unauthorized user accessed Khan & Associates CPAs Intuit tax filing software between July 916 2025, filing false federal and state tax returns and exposing clients PII including SSNs and bank data.
Undisclosed Ukrainian business services organization
June 27, 2025
•[ webshell, credential harvesting, data leak ]
Symantec-reported intrusion beginning June 27, 2025 used LocalOlive webshell and LOTL techniques to harvest credentials and system data; activity persisted through mid-2025; no disruption reported.
City of Gloversville (NY)
March 14, 2025
•[ ransomware, data leak ]
City of Gloversville, New York, experienced a ransomware attack discovered on March 14, 2025. The incident encrypted municipal servers and exposed payroll and banking information. Attackers demanded $300,000, and the city paid $150,000 to regain access; no ransomware group has publicly claimed responsibility.
Merkle, Inc. (Dentsu Group)
October 1, 2025
•[ data leak, ransomware ]
Dentsus US-based subsidiary Merkle disclosed a cyber incident discovered in October 2025 involving unauthorized access and data theft from HR and client systems; stolen information included employee, supplier, and client financial and personal records; certain systems were taken offline during response; no ransomware group claimed responsibility.
Jennings O'Donovan
October 1, 2025
•[ data leak ]
Engineering firm Jennings O'Donovan in County Sligo, Ireland experienced unauthorized access to part of its IT system used for the governments defective block grant scheme. The intrusion occurred in early October 2025 and potentially exposed personal data of roughly 861 applicants, while financial systems remained secure. Authorities consider it consistent with financially motivated criminal activity.
University of Pennsylvania
October 31, 2025
•[ data leak ]
Hacker alias WeGotHacked infiltrated University of Pennsylvania systems around Oct 31 2025, stealing an estimated 1.2 million donor records and compromising multiple @upenn.edu email accounts. On Nov 1 the actor used those accounts to send vulgar emails to the campus community. BleepingComputer later verified portions of the dataset. UPenn initially denied a breach but launched an investigation after the claims were substantiated.
Origin Energy
July 30, 2025
•[ insider threat, data leak ]
Encrypted credit/debit card details for 732 customers (plus associated account data) exfiltrated to a personal email account on the employees last day; company disclosed the insider-led breach and began notifications.
ZZ Dats
October 24, 2025
•[ data leak, government, regulatory action ]
Latvias DVI fined vendor ZZ Dats 300,000 for a 2024 municipal data breach affecting 42 municipalities; enforcement materials cite failures in safeguarding personal data rather than evidence of a targeted intrusion. This row logs the regulatory outcome tied to last years exposure.
ModMed (Modernizing Medicine)
October 24, 2025
•[ data leak, healthcare, third-party breach ]
Modernizing Medicine (ModMed) said it discovered unauthorized activity on July 29, 2025, and confirmed that attackers had accessed and exfiltrated data from servers hosting podiatry-client EHR information between July 910. Exposed fields include full names, addresses, DOB, SSNs, contact details, health insurance info, medical record and patient account numbers, dates of service, providers/practices, billing/diagnostic codes, prescription/medication data, and diagnosis/treatment information; providers were notified on September 19 and patients on October 17. Days later, a seller advertised a partial EHR database (1,0001,500 podiatry patient records) on a breach forum/Telegram, indicating financially motivated data trafficking, though ModMed has not confirmed a second intrusion. Overall impact: large-scale PHI exposure from vendor-hosted servers, with evidence of downstream data sale attempts.
OYO Hotel & Casino Las Vegas
January 8, 2025
•[ data leak ]
Documents show unusual activity between Jan 811 in a shared network environment used by the property; subsequent review determined thousands of individuals were affected. The case centers on data theft rather than operational shutdown, with regulatory filings and notices issued in October.
Wojeski & Company
July 28, 2023
•[ ransomware, phishing, data leak ]
NY AG says Wojeski suffered a phishing-led ransomware incident that locked access to files, followed by a second breach when a vendors employee improperly accessed and exfiltrated client data. Notifications lagged by over a year. Settlement requires encryption, inventorying locations of personal data, stronger access controls, vulnerability management, and a formal IR plan; $60,000 penalty and credit monitoring for affected New Yorkers.
University of the Witwatersrand
October 17, 2025
•[ zero-day, data leak ]
University statement confirms zero-day event impacting Oracle E-Business; investigation ongoing
London North Eastern Railway
October 8, 2025
•[ data leak, supply chain attack ]
Media report warns LNER customers after supplier breach exposed contact and journey data
