Fashion Box S.p.A.
January 29, 2025
•[ brute-force, data leak ]
Fashion Box S.p.A., owner of the Replay brand, disclosed a brute-force intrusion on January 29 2025 that allowed unauthorized access to internal servers and the exfiltration of corporate information and personal data of employees and external stakeholders. The company notified multiple European data-protection authorities. No encryption was confirmed. An undisclosed amount of personal and corporate data was taken.
Central New York Cardiology
February 27, 2025
•[ data leak, healthcare ]
Practice reported a data breach impacting extensive patient PHI/PII per public notice.
Christensen Group Insurance
October 10, 2022
•[ phishing, data leak ]
Company posted 24-02-2025 notice about 2022 email-account breach; data breach letters now being sent.
DISA Global Solutions
February 9, 2024
•[ data leak ]
Breach window Feb 9Apr 22, 2024; ~3.3M impacted; disclosures via state AG filings and reports in FebMar 2025.
Northern Caribbean University
February 24, 2025
•[ data leak ]
Cyberattack crippled key systems; NCU warned students of possible data release.
Racine Unified School District
December 3, 2024
•[ data leak ]
Security breach of RUSD internal network; forensic probe said staff data may have been accessed; student data hosted externally unaffected.
India Post
February 17, 2025
•[ data leak, vulnerability, idor ]
IDOR flaw allowed retrieval of KYC documents by altering IDs in URLs; reports indicate thousands of records were exposed.
Cocospy & Spyic
February 14, 2025
•[ data leak, stalkerware, vulnerability ]
Vulnerability allowed unauthenticated access to servers exposing stalkerware customer lists and victims uploaded data.
Invest Hong Kong
February 22, 2025
•[ ransomware, data leak ]
Follow-up coverage of InvestHK ransomware; checking possible client/staff info exposure; later update: no evidence of leakage.
Patelco Credit Union
June 29, 2024
•[ ransomware, data leak, regulatory action ]
Ransomware encrypted Patelco systems on June 29, 2024, causing a near-total outage of digital banking through mid-July and exposing substantial member PII; DFPI later issued a consent order and $100,000 fine with mandated cybersecurity improvements.
OmniGPT Chatbot Platform
March 10, 2025
•[ data leak, data breach, hacking ]
A hacker known as Gloomer claimed to have breached the OmniGPT AI chatbot platform, stealing and leaking millions of user messages and account details. Data samples were posted on BreachForums and reported by multiple cybersecurity outlets, though OmniGPT has not confirmed the incident.
Users of Steam game PirateFi
February 6, 2025
•[ malware, data leak ]
Free-to-play game PirateFi on Steam removed after being discovered to install Vidar infostealer; victims urged by Valve to scan or reformat their systems.
Israel Police
February 9, 2025
•[ data leak, hacktivism, third-party compromise ]
Hacktivist group Handala claimed to have breached Israel Police systems and exfiltrated 2.1 TB of data containing 350,000 documents with officer information, weapon licenses, and case files. Authorities denied direct network infiltration and suggested a third-party vendor compromise.
Humboldt Independent Practice Association (IPA)
June 26, 2024
•[ data leak, healthcare, unauthorized access ]
Between June 26 and July 1 2024, an unauthorized actor accessed a Humboldt Independent Practice Association email account containing protected health information. Exposed data may include patient names, contact details, birth dates, diagnoses, insurance, and identification numbers. No evidence of encryption or confirmed data exfiltration has been reported. The breach was disclosed to HHS in November 2024 and publicly announced on February 15 2025.
Lee Enterprises
February 3, 2025
•[ ransomware, data leak ]
On February 3, 2025, Lee Enterprises suffered a ransomware attack that encrypted multiple critical applications and exfiltrated files. The Qilin group claimed responsibility, asserting theft of about 350 GB of data. The incident caused partial but significant disruption of operations for roughly one week, affecting printing, billing, and vendor systems. Approximately 39,779 individuals had personal information compromised.
Russian Organizations Across Various Industries
February 5, 2025
•[ malware, phishing, data leak ]
Nova Infostealer malware campaign targeting Russian organizations across multiple industries collected credentials and files via phishing and malicious installers.
Chronopost
January 28, 2025
•[ data leak ]
Chronopost confirmed a cyberattack discovered on January 28, 2025, that exposed personal data of about 210,000 clients, including names, addresses, and signatures. The company reported to CNIL and claimed no banking or payment data was compromised.:contentReference[oaicite:0]{index=0}
City of McKinney, Texas
October 31, 2024
•[ ransomware, data leak ]
Ransomware group INC claimed responsibility for breaching the City of McKinney, Texas, beginning October 31, 2024. Officials confirmed that personal and health data of approximately 17,751 individuals were exfiltrated. The city discovered the breach on November 14, 2024, and publicly reported it in February 2025. No encryption was reported.
Business Registration Service (Kenya)
January 31, 2025
•[ data leak, criminal actors ]
Kenyas Business Registration Service confirmed a major data breach on January 31 2025 that exposed registry and beneficial-owner data, including national ID numbers, addresses, phone numbers, and company ownership details. Media reports suggest over two million company and shareholder records were compromised and sold on the dark web. The attack was financially motivated and attributed to criminal actors; the government continues to assess the extent of the breach.
Medusind Solutions
December 29, 2023
•[ data leak, healthcare ]
Medusind Solutions, a healthcare billing and revenue cycle management provider, suffered a data breach on December 29, 2023, when unauthorized actors accessed its systems and exfiltrated sensitive patient data. Compromised data included names, addresses, insurance details, and other medical information of patients from multiple provider clients. The company disclosed the breach on January 10, 2024. There was no service disruption reported, but patient data privacy was significantly impacted.
