Otelier
January 17, 2025
•[ leak, misconfiguration, technology ]
Hotel management platform Otelier suffers a data breach after threat actors breached its Amazon S3 cloud storage to stole millions of guests' personal information and reservations for well-known hotel brands like Marriott, Hilton, and Hyatt.
Frame & Optic
January 16, 2025
•[ leak, retail ]
In January 2025, the eyewear seller Frame & Optic suffered a data breach. The incident exposed almost 16k unique email addresses along with names, phone numbers and geolocation data including country, state and postcode. The data was provided to HIBP by a source who requested it be attributed to "oathnet.ru".
FortiGate devices
January 14, 2025
•[ leak, misconfiguration, technology ]
A new group dubbed "Belsen Group" leaks the configuration files, IP addresses, and VPN credentials for over 15,000 FortiGate devices on the dark web in a 1.6 GB archive, allegedly obtained exploiting CVE-2022-40684.
Stealer Logs, Jan 2025
January 13, 2025
•[ leak, malware ]
In January 2025, stealer logs with 71M email addresses were added to HIBP. Consisting of email address, password and the website the credentials were entered against, this breach marks the launch of a new HIBP feature enabling the retrieval of the specific websites the logs were collected against. The incident also resulted in 106M more passwords being added to the Pwned Passwords service.
Bank of America
January 10, 2025
•[ leak, finance ]
Bank of America notifies 414 individuals that their names, addresses, phone numbers, passport numbers, Social Security numbers, and their mortgage load numbers might have been compromised in a data breach at an unnamed third-party provider.
Wolf Haldenstein Adler Freeman & Herz
January 10, 2025
•[ leak ]
Wolf Haldenstein Adler Freeman & Herz LLP ("Wolf Haldenstein") a U.S. Law Firm, reports it has suffered a data breach that exposed the personal information of nearly 3.5 million individuals to threat actors.
United Nations' International Civil Aviation Organization (ICAO)
January 7, 2025
•[ leak, government ]
The United Nations' International Civil Aviation Organization (ICAO) announces it is investigating what it describes as a "reported security incident." 42,000 recruitment application data records are affected.
Nodex
January 6, 2025
•[ hack, leak, technology ]
Ukrainian hacktivists, part of the Ukrainian Cyber Alliance group, announce they had breached Russian internet service provider Nodex's network and wiped hacked systems after stealing sensitive documents.
Gravy Analytics
January 4, 2025
•[ leak, technology ]
Gravy Analytics, a major player in the location data broker market confirms to Norway's Data Protection Authority that it was breached by a threat actor who obtained an unknown number of files.
Community Health Center (CHC)
January 2, 2025
•[ leak, healthcare ]
Community Health Center (CHC), a leading Connecticut healthcare provider, notifies over 1 million patients of a data breach that impacted their personal and health data.
InfoCert via Third Party Ticketing Vendor
January 2, 2025
•[ hack, leak, technology ]
I dati sottratti messi in vendita sul dark web. L'azienda provider di servizi di identit digitale rassicura:Informazioni sottratte sono quelle delle richieste di assistenza clienti, i dati di accesso a InfoCert non sono stati compromessi
MedSave Health Insurance
January 1, 2025
•[ leak, healthcare ]
A threat actor with the Moniker 0mid16B claims to have breached MedSave Health Insurance TPA Ltd (MedSave), stealing 561 gigabytes of databases, containing data of 10,617,943 people.
Visionworks
January 1, 2025
•[ leak, healthcare ]
The federal suit, which seeks class-action status, alleges a data breach exposed 40,000 customers' private data.
Trusteed Plans Service Corporation
December 26, 2024
•[ leak, finance ]
TPSC detected a breach on 12/26/2024; investigation found unauthorized access and data acquisition. A data review completed 08/07/2025 identified 19,775 impacted individuals. Notices sent 09/1509/16/2025 detail exposure of PII/PHI (DOB, SSN, health info; sometimes insurance IDs). No outage or misuse evidence reported.
Speedio
December 24, 2024
•[ leak, misconfiguration, technology ]
In December 2024, data alleged to have been taken from the Brazilian lead generation platform Speedio was posted for sale to a popular hacking forum. The data was allegedly obtained from an unsecured Elasticsearch instance and contained over 62M records of largely public business information including company names, phone numbers and physical addresses, along with 27M unique email addresses, predominantly from public services such as Gmail and Outlook. Speedio did not respond to multiple attempts to disclose the incident, and the origin of the data could not be independently verified. The data was provided to HIBP by a source who requested it be attributed to "ayame@xmpp.jp".
Cornwell Quality Tools
December 20, 2024
•[ leak, manufacturing ]
Cornwell Quality Tools discovered a data breach (Dec 20, 2024), later completed an investigation (Aug 4, 2025) and mailed notices (Sept 4, 2025) offering credit monitoring; exposed data may include names, SSNs, DL numbers, financial accounts, and medical information
Fota Wildlife Park
December 5, 2024
•[ financial, hack, leak ]
People who purchased tickets to visit Fota Wildlife Park in Cork, Ireland, are warned to cancel their bank cards following the discovery of a cyberattack that may have exposed the data on those cards.
Multiple e-commerce platforms
December 2, 2024
•[ leak, retail ]
At least 100,000 customers' personal information, including credit cards, is believed to have been stolen from 11 e-commerce websites from multiple organizations in Japan including the coffee chain Tully's Coffee Japan and the national federation of fisheries cooperatives (JF Zengyoren).
Pembina Trails School Division
December 2, 2024
•[ ransomware, financial, leak ]
Canadian school division compromised by Rhysida ransomware Dec 2, 2024. Attack disrupted thousands of devices and exposed ~35,000+ student records and staff payroll/financial data. Group attempted $1.7M ransom before leaking stolen data on the dark web.
Port of Rijeka
November 30, 2024
•[ ransomware, financial, leak ]
The 8Base ransomware group hits Croatias Port of Rijeka, stealing sensitive data, including contracts and accounting info.
