Swift Institute
January 30, 2025
•[ data leak ]
James J. Lynch, MD Ltd. d/b/a Swift Institute disclosed that it detected unusual activity in its network environment on or about January 30, 2025. An internal investigation determined that certain files may have been copied by an unauthorized individual as part of the event on or about January 30, 2025. Swift Institute conducted a comprehensive review of the affected data set and confirmed on October 14, 2025 that personal information and/or protected health information was contained in the files. Notification letters dated December 10, 2025 were issued to potentially impacted individuals, and the organization offered credit monitoring and fraud assistance services.
Visage Imaging
November 26, 2025
•[ data leak ]
Visage Imaging reported a security incident involving unauthorized access to certain personal information within its systems. The organization indicated that an unauthorized party accessed personal information classified as personally identifiable information (PII), and that impacted elements may include individuals names and Social Security numbers. Visage Imaging filed a public notice with the Massachusetts Attorney General and began sending notification letters to impacted individuals on November 26, 2025.
Attorney General’s Office of the State of Guanajuato (FGEG)
November 13, 2025
•[ ransomware, data leak, double-extortion ]
Mexico Business News reports Guanajuatos Attorney Generals Office confirmed a cybersecurity incident after a ransomware attack attributed to Tekir APT. Attackers claim they stole 250GB+ of confidential data, including judicial files and internal databases. Officials are reviewing controls, without confirming attribution or ransom payment. Hackmanac alleges subdomain encryption and double-extortion.
Ahome City Hall
December 12, 2025
•[ data leak, ransomware, extortion ]
Article warns that Mexicos government cybersecurity is structurally weak. Experts cite basic misconfigurations, poor maintenance, limited staff training, and lack of an overarching cybersecurity law. Recent incidents, including municipal data leaks and ransomware affecting Guanajuatos attorney general, show risks of extortion, fraud, and weakened public trust.
BarNet
December 12, 2025
•[ ransomware, data leak ]
Insurance Business reported that BarNet, a communications and infrastructure provider serving barristers and legal practices (including hosting, connectivity, file-sharing and a case-tracking platform), appeared on the SafePay ransomware groups leak site. The article states SafePay released material it claims was taken from BarNets systems, and that the leaked files reportedly include financial statements and legal/contract documents as well as sensitive personal records such as passport copies and CVs. The reporting focuses on the alleged data exposure and extortion context rather than confirmed encryption-related downtime, and it does not provide a confirmed initial access vector or a verified count of affected individuals.
Madison County Health Department (Kentucky)
August 12, 2025
•[ data leak ]
This item concerns a reported data breach affecting the Madison County Health Department in Kentucky, with public reporting indicating that the personal information of 71 individuals was exposed. Due to access restrictions/timeouts when retrieving the primary notice and the original local-news article, the available sources do not provide reliable, verifiable detail on the exact intrusion method, the precise dates of unauthorized access, or the specific categories of personal information involved. The event is coded as an exploitive incident (data breach) because a breach with exposed personal information is reported, but the record-level details remain undetermined based on the accessible evidence.
Dolar Financial Group
November 25, 2025
•[ ransomware, data leak, extortion ]
Money Mart (National Money Mart Company Database) was posted to the Everest ransomware groups leak site around Nov 25, 2025, with the attackers claiming they exfiltrated 80,000+ internal files and threatening to publish them by Nov 30. Reporting states Cybernews reviewed the leaked samples and observed multiple categories of data, including customer identification/contact details and identity documents, financial data (including partial credit card details and transaction-related records), and extensive employee information. The report describes the incident primarily as data theft/extortion, with no confirmed public statement from Money Mart included in the article and no operational outage details provided in the cited reporting.
MédecinDirect
November 28, 2025
•[ data leak ]
MdecinDirect, a French teleconsultation platform, reported a large-scale cyber incident in late November 2025. The provider stated it was the victim of an intrusion that was stopped upon detection on 11/28/2025. Approximately 285,000 patients were warned that their account information could have been compromised, and affected people were informed once the incident perimeter was clarified on 12/03/2025. MdecinDirect indicated that personal and health data potentially consulted included the reason for teleconsultation, information provided in pre-teleconsultation questionnaires, written exchanges between patients and physicians, and some Social Security numbers. The platform stated teleconsultation videos were not recorded and were therefore not impacted. It reported filing a complaint and notifying the CNIL (Frances data protection authority), and stated that services were functioning normally about ten days after the intrusion while additional technical investigation continued.
Legacy Professionals LLP
January 4, 2024
•[ data leak, unauthorized access ]
Legacy Professionals LLP, an Illinois-based accounting and audit firm, reported that sensitive personal information in its custody may have been accessed and acquired following suspicious activity detected on its computer network in late April 2024. The firm investigated and determined an unauthorized third party may have viewed and obtained certain information. Legacy then reviewed the affected data to identify impacted individuals, completing its review on 01/06/2025, and began mailing breach notification letters on 02/27/2025. Information potentially exposed was described as varying by individual and included names, Social Security numbers, and financial account numbers. Public filings referenced in reporting suggested Legacy provided affected individuals with credit monitoring services. Specific technical details such as the attack vector, the duration of unauthorized access, and whether data was exfiltrated beyond the identified categories were not publicly disclosed.
Community Dental Care, Inc.
June 12, 2024
•[ data leak, hacked ]
Community Dental Care (CDC), a Minnesota nonprofit dental healthcare provider, reported that an unauthorized third party may have viewed and obtained sensitive personal information and protected health information from its systems. CDC detected unauthorized activity on 12/20/2024 and investigated, later concluding that on or around 12/06/2024 an intruder may have accessed and acquired certain data. CDC performed a data review to determine what information was involved and identify affected individuals, completing that review on 03/24/2025, and posted a public notice on 03/28/2025. Potentially exposed information varied by person and could include names, Social Security numbers, addresses, dates of birth, drivers license or other government IDs, passport numbers, medical information, and health insurance information. CDC indicated it would update notices if additional information types were identified and offered guidance and services to affected individuals.
Fieldtex Products, Inc.
January 8, 2025
•[ ransomware, data leak ]
Fieldtex Products Inc., including its e-First Aid Supplies division, reported a data security incident after identifying unauthorized access to certain systems during August 2025. Public reporting associated the incident with the Akira ransomware group, which claimed responsibility on a leak site and alleged it stole corporate documents, though those claims were not independently verified in the available notice. According to reporting on the incident and breach tracking, the event potentially exposed limited protected health information related to individuals, with data elements including name, address, date of birth, member identification number, health plan name, coverage effective and termination dates, and gender. External reporting cited approximately 238,615 affected individuals. Fieldtex indicated it took steps to investigate, mitigate, and notify impacted people; the initial compromise method and the full extent of any data exfiltration beyond the limited PHI described were not publicly detailed in the accessible notice.
TriZetto Provider Solutions,
January 11, 2024
•[ data leak, healthcare ]
TriZetto Provider Solutions, a Cognizant-owned vendor providing revenue management services to healthcare organizations, reported a cybersecurity incident affecting a customer web portal. TriZetto identified suspicious portal activity on 10/02/2025, secured the portal, and engaged Mandiant to investigate and validate remediation. Forensic work determined an unauthorized third party had been accessing historical eligibility transaction reports within TriZetto systems since November 2024, nearly a year before detection. The reports contained protected health information for patients of certain healthcare provider clients. TriZettos review determined compromised data could include patient and primary insured names combined with other personal and insurance information such as addresses, dates of birth, Social Security numbers, member/Medicare numbers, insurer names, and related demographic health and coverage details. TriZetto stated it believed the actor had been eradicated and no further unauthorized portal activity was detected after 10/02/2025; the total number of affected clients/individuals was not yet publicly confirmed.
Agfa
January 11, 2025
•[ ransomware, data leak ]
Agfa-Gevaert faced public claims from the Everest ransomware group alleging the theft of Agfa data. Subsequent public reporting indicates Agfa conducted an internal investigation and concluded in early December 2025 that its IT systems were operational and that the data at issue was limited to older, non-sensitive information. Agfas communications emphasized that there was no indication that critical or current sensitive data was compromised. Details such as the initial access vector, the precise systems affected, and whether any encryption or operational disruption occurred were not publicly disclosed in accessible reporting. This entry codes the incident as an unauthorized access/data exposure event based on the companys statement about what information was involved after its probe.
French Ministry of the Interior
November 12, 2025
•[ government, data leak, email compromise ]
Frances Interior Minister confirmed that the Ministry of the Interior experienced a cyberattack affecting its email servers. The intrusion was detected overnight between 12/11/2025 and 12/12/2025 and enabled the threat actors to access the ministrys email infrastructure and some document files. At the time of public confirmation, officials had not confirmed whether data was exfiltrated. In response, the ministry reported implementing standard containment procedures, tightening security protocols, and strengthening access controls. French authorities opened an investigation to determine the origin, intent, and full scope of the breach; possible explanations cited publicly included foreign interference, activists, or cybercriminals. The ministry is a high-value target given its responsibility for police forces, internal security, and immigration services.
Vitas Hospice
September 21, 2025
•[ data leak, third-party breach, healthcare ]
Vitas Hospice Services (Vitas Healthcare) detected a cybersecurity intrusion on 10/24/2025. According to the organizations breach notice and subsequent reporting, the threat actor gained access to certain Vitas systems by using a compromised third-party vendor account. The unauthorized access persisted from approximately 09/21/2025 through 10/27/2025, and the attacker downloaded files containing personal information of current and former patients. Exposed data elements included identifiers (name, address, phone number, date of birth), government identifiers (drivers license number and Social Security number), and protected health information such as medical and insurance details, plus next-of-kin contact information. Government breach tracking and reporting indicated 319,177 individuals were affected. Vitas stated it took steps to secure systems, investigate, and notify impacted individuals, though the specific malware or group responsible was not publicly identified.
Mikord
November 12, 2025
•[ data leak, sabotage, hacktivism ]
The Record reported that an anonymous hacker group allegedly breached Mikords servers and provided a trove of internal documents to an anti-war human rights group, including source code, technical and financial records, and internal correspondence. The report stated the hackers claimed months-long access and said they destroyed parts of Mikords infrastructure; Mikords website was reportedly offline for days and had been defaced earlier in December. While the company did not publicly acknowledge involvement in Russias military registry, investigative verification cited in the article indicated the leaked materials supported its participation, suggesting the breach had both data-theft and disruptive/destructive elements.
Pierce County Library System
April 15, 2025
•[ ransomware, data leak, service disruption ]
The Record reported that the Pierce County Library System discovered a cybersecurity incident on April 21, 2025 that forced it to shut down all systems, with an investigation later finding attackers had access between April 15 and April 21. By May 12, the library confirmed hackers breached systems and stole information on both patrons and current/former employees, and later breach notifications indicated more than 340,000 people were impacted. The report stated the INC ransomware gang claimed the attack in May, and the combination of service shutdown and confirmed data theft supports a mixed event involving disruption and data compromise.
700Credit
October 25, 2025
•[ data leak ]
The Record reported that auto-dealership service provider 700Credit said 5,836,521 people were affected by a data breach discovered on October 25, 2025. The company stated its IT team found that attackers made copies of information they accessed in 700Credit systems and that the copied data included names, Social Security numbers, dates of birth, and addresses. The report noted the company notified federal law enforcement and the FTC and began offering identity protection services, indicating confirmed unauthorized access and copying of sensitive consumer identifiers.
Prosper Marketplace
January 6, 2025
•[ data leak, PII ]
The Record reported that fintech lender Prosper Marketplace disclosed a cyberattack that was initially discovered on September 1, 2025, with an investigation concluding that attackers accessed data between June and August 2025. The company stated there was no evidence of unauthorized access to customer accounts or funds, but reported that sensitive personal information and application-related data were accessed, ultimately affecting about 13.1 million people. The reported exposed elements included high-risk identifiers (SSNs and national IDs), banking details, and extensive identity and application documentation, creating significant fraud and identity-theft risk even without confirmed account takeover.
Virginia Urology
September 11, 2025
•[ data leak, ransomware ]
DataBreaches reported that threat actors calling themselves MS13-089 claimed they hacked Virginia Urology on November 9, 2025 and exfiltrated about 927 GB of data, while stating they did not encrypt systems so as not to harm the patients. The outlet reviewed sample files and described faxed referrals and medical reports whose filenames appeared to include patients names and dates of birth, with additional pages containing extensive protected health information such as insurance and contact details and clinical histories. Virginia Urology had not publicly confirmed the incident or responded to inquiries in the reporting, but the presence of leaked sample data indicates unauthorized access and exfiltration consistent with an exploitive breach.
