National Assembly of Ecuador
February 17, 2025
•[ government, data leak ]
Cyberattack targeting Ecuadors National Assembly aimed at accessing confidential legislative information; intrusion detected and contained without confirmed data theft or attribution.
Ministry of Health and Human Services (Palau)
February 17, 2025
•[ ransomware, data leak ]
The Ministry of Health and Human Services of Palau suffered a ransomware-attributed data breach by the Qilin group on February 17, 2025. The attackers exfiltrated patient and hospital data from internal servers but no encryption of systems was confirmed. Authorities reported service restoration and an investigation into the scope of data theft.
United States Coast Guard
February 17, 2025
•[ data leak, government ]
Between February 17 and 19, 2025, the U.S. Coast Guard identified unauthorized access to its Direct Access personnel and payroll system, a PeopleSoft-based application. Sensitive personal and financial data of Coast Guard members was compromised, leading the service to take the system offline for investigation. Approximately 1,135 members experienced delayed pay as a consequence of the shutdown. No ransomware or encryption was reported, and attribution remains undetermined.
Endue Software
February 17, 2025
•[ data leak ]
Law firm press release announcing an investigation into a reported Endue Software data breach.
Undisclosed US debt settlement firm
February 15, 2025
•[ data leak ]
A US debt settlement firm disclosed a breach affecting 160,000 individuals; limited details on intrusion vector provided.
Cocospy & Spyic
February 14, 2025
•[ data leak, stalkerware, vulnerability ]
Vulnerability allowed unauthenticated access to servers exposing stalkerware customer lists and victims uploaded data.
Genea
February 14, 2025
•[ ransomware, data leak ]
Genea suffered a ransomware/data-theft incident attributed to Termite. Attackers had access from Jan 31 and exfiltrated data on Feb 14, prompting days of system disruption. Sensitive patient information was later posted to the dark web.
Undisclosed Riyadh-based real estate and construction company
February 14, 2025
•[ ransomware, data leak ]
The DragonForce ransomware group attacked a major Riyadh-based real estate and construction firm, exfiltrating over 6 TB of internal corporate data and encrypting systems as part of a double-extortion campaign. The group demanded ransom payment by February 27, 2025, ahead of Ramadan, and later leaked the stolen data when unpaid.
U.S. Coast Guard
February 14, 2025
•[ data leak ]
Coast Guards Direct Access system was breached on 02/14/2025, exposing financial/PII and delaying pay for 1,135 members; system was taken offline while CG Cyber Command & CGIS investigated; offline payments processed and security measures pursued; no attribution yet.
Philippine Charity Sweepstakes Office (PCSO)
February 13, 2025
•[ data leak, hacktivism, government ]
Hacktivist group Philippine Exodus Security claimed responsibility for exfiltrating approximately 100 GB of data from PCSO branch office email accounts in February 2025. While PCSO denied a central database breach, DICT confirmed that unauthorized access to email systems occurred. The group stated its goal was to expose alleged corruption, not to extort funds.
Included Health
February 13, 2025
•[ data leak ]
Included Health detected a security incident on Feb 13, 2025; investigation found unauthorized access to sensitive data (names, SSNs, medical record info). Notices were filed and letters sent to affected individuals the same day
GS Shop
February 13, 2025
•[ credential stuffing, data leak ]
Credential-stuffing led to extraction of ~1.58M GS Shop customer records (21-06-2024 to 13-02-2025); financial data not affected; GS Retail blocked offending IPs, urged password changes, and launched a security task force.
Urban One, Inc.
February 13, 2025
•[ ransomware, social engineering, data leak ]
Ransomware group Cactus gained access to Urban Ones internal HR and payroll servers via social-engineering intrusion beginning February 2025, exfiltrating employee PII and financial data; company confirmed breach and notified affected staff.
Baltimore City Public Schools
February 13, 2025
•[ ransomware, data leak ]
The Cloak ransomware group exfiltrated sensitive personal and student data from Baltimore City Public Schools in February 2025. While the attack was ransomware-related, no encryption or service disruption occurred; over 31,000 people were notified of data theft.
Bell Ambulance
February 13, 2025
•[ ransomware, data leak, healthcare ]
Bell Ambulance detected a network intrusion on Feb 13, 2025. Medusa ransomware claimed responsibility and data theft; HHS/state filings list ~114,000 impacted.
Doxbin
February 12, 2025
•[ data leak ]
Hackers compromised Doxbin, locked out admins, deleted accounts, and leaked a database containing user records and a blacklist file.
Asus
February 12, 2025
•[ ransomware, data leak ]
The Everest ransomware group claimed it obtained more than 1TB of ASUS-related data including phone camera source code and other internal materials. ASUS later confirmed that a supplier was hacked and that some ASUS phone camera source code was affected, stating the incident did not impact ASUS products, internal company systems, or user privacy. The report described leaked materials as including camera-related source code, internal patches, test modules, debugging logs, and other development artifacts, with no public indication of customer data exposure in the statement cited.
Mobilelink US
February 12, 2025
•[ ransomware, data leak, unconfirmed breach ]
Cybernews reported that the DragonForce ransomware group claimed Mobilelink USA (a major Cricket Wireless dealer) as a victim and alleged theft of ~5TB of data with a threat to publish it. The report stated the leak-site post did not include proof samples or details of the allegedly stolen data, and Mobilelink had not confirmed the incident at the time of reporting.
Users of Indian banking mobile apps
February 11, 2025
•[ malware, phishing, data leak ]
Android malware campaign disguised as Indian bank apps, distributed via phishing links and fake APKs to install FinStealer; exfiltration of banking credentials and personal information confirmed by CYFIRMA and other researchers.
Virginia Attorney General’s Office
February 11, 2025
•[ data leak, ransomware, cyber intrusion ]
In February 2025, the Virginia Attorney Generals Office voluntarily shut down nearly all internal systems after detecting a sophisticated cyber intrusion. The criminal group Cloak later claimed responsibility, asserting it had stolen 134 GB of internal documents and posted samples to its leak site. Officials confirmed system shutdowns for containment but did not verify any file encryption or ransom demand, indicating an exfiltration-only intrusion rather than an active ransomware lockout.
