Douglasville-Douglas County Water & Sewer Authority
November 26, 2024
•[ ransomware, data leak ]
The DouglasvilleDouglas County Water & Sewer Authority was targeted by the Lynx ransomware group on November 26 2024. Attackers claimed responsibility on a leak site on January 14 2025, later removed. The authority rebuilt and restored its systems with minimal data loss and reported no evidence of customer or employee data theft. Data exfiltration remains unconfirmed.
University Diagnostic Medical Imaging (UDMI)
November 26, 2024
•[ data leak ]
On November 26 2024, University Diagnostic Medical Imaging in New York detected unauthorized access to its systems that exposed patient information including names, addresses, dates of birth, referring physicians, and treatment data. The breach affected 138,080 individuals and was disclosed publicly in February 2025.
Concord Orthopaedics
November 21, 2024
•[ data leak, third-party breach ]
Vendor breach exposed patient Pii/phi; notifications sent months after discovery.
Hazleton Anesthesia Services
November 21, 2024
•[ data leak ]
On Nov 21, 2024, Somnia (management company) identified suspicious activity in its email environment and later confirmed unauthorized access to a limited number of accounts that included Hazleton Anesthesia Services. Review completed Mar 10, 2025; public substitute notice issued Mar 31, 2025. No encryption or operational disruption reported.
Southeast Series Of Lockton Companies LLC
November 20, 2024
•[ data leak ]
Insurance brokerage reported unauthorized access to files on an employee computer
Behavioral Health Resources
November 20, 2024
•[ data breach, data leak ]
Unauthorized actor accessed Behavioral Health Resources network in Nov 2024, exfiltrating client PII and medical records; organization confirmed breach via Maine AG filing and began notifications in Apr 2025.
Converse University
November 20, 2024
•[ data leak ]
Class action alleges delayed notice following a late-2024 data breach.
Erickson Companies
November 18, 2024
•[ data leak ]
Company notified individuals after data breach potentially exposing Social Security numbers.
Systematic Financial Management
November 16, 2024
•[ data leak ]
Intrusion confirmed; files with PII may have been accessed; discovery Nov 16, 2024; PII confirmed Jan 10, 2025.
Pound Road Medical Centre
November 13, 2024
•[ ransomware, data leak ]
On November 13, 2024, PRMC reported a cyber incident and later Anubis publicly claimed it as a victim, alleging patient data may have been accessed and taken. No public confirmation of encryption or operational disruption was made.
Legends International
November 9, 2024
•[ data leak ]
On November 9 2024, Legends International detected unauthorized access to its internal systems. The investigation confirmed that an external actor exfiltrated files containing sensitive personal and financial data of employees and customers. No ransomware, encryption, or operational disruption was reported.
VeraCore (Advantive)
November 5, 2024
•[ data leak, vulnerability, web shell ]
The Vietnamese-linked cybercriminal group XE Group exploited two zero-day vulnerabilities (CVE-2024-57968, CVE-2025-25181) in the U.S. software vendor VeraCores warehouse management and fulfillment platform. Attackers uploaded web shells, maintained persistent access since 2020, exfiltrated configuration and system data, and executed commands on compromised servers, potentially exposing data from client organizations using VeraCore for logistics operations.
Hixson Holdings, Inc
November 5, 2024
•[ data leak ]
Hixson Holdings Inc., a Cincinnati-based architecture, engineering and project management firm, detected suspicious activity on its network on November 5, 2024. A forensic investigation later determined that an Undetermined intruder may have accessed sensitive data on Hixson's systems from that date through October 9, 2025, before the review concluded. Exposed information includes names, contact details, Social Security numbers and medical or insurance identifiers, highlighting that the firm handled protected health information for some clients. Hixson filed notice with the Massachusetts Attorney General and began mailing breach letters on October 31, 2025, while law firms and regulators assess potential legal and remediation obligations.
The Plastic Surgery Center
November 4, 2024
•[ data leak ]
Names, dates of birth, Social Security numbers, passport and drivers license numbers, financial, biometric, and medical information
MIT’s Technology Review
November 4, 2024
•[ data leak, third-party contractor, Intel Broker ]
The threat actor known as Intel Broker claims to have stolen the personal data of 290,762 individuals from MITs Technology Review website via a third-party contractor.
Biomedical Caledonia Medical Laboratory
November 1, 2024
•[ data leak, hacked, third-party breach ]
In November 2024, unauthorized actors accessed Biomedical Caledonia Medical Laboratorys systems through an external vendor, prompting an investigation and cybersecurity upgrades. The lab confirmed the intrusion but did not disclose specific data types or quantities affected. No evidence of encryption or operational disruption has been reported.
Fall Mountain Regional School District
November 1, 2024
•[ phishing, data leak ]
District warned community after phishing scam; vendor ids and emails exposed.
City of McKinney, Texas
October 31, 2024
•[ ransomware, data leak ]
Ransomware group INC claimed responsibility for breaching the City of McKinney, Texas, beginning October 31, 2024. Officials confirmed that personal and health data of approximately 17,751 individuals were exfiltrated. The city discovered the breach on November 14, 2024, and publicly reported it in February 2025. No encryption was reported.
Finastra
October 31, 2024
•[ compromised credentials, data leak ]
Intruder used compromised credentials to access Finastras SFTP/Aspera platform, copied files on Oct 31, 2024, and maintained access until Nov 8. A forum post later advertised ~400 GB of alleged Finastra data. Finastra isolated the platform, said there was no malware/ransomware and no impact to core operations, and began notifications in Feb 2025.
City of Sheboygan
October 31, 2024
•[ ransomware, data leak ]
67,000+ residents PII including SSNs, state IDs, license plate numbers were accessed during an Oct 31, 2024 ransomware incident; breach letters filed May 2025.
