The North Face
April 23, 2025
•[ hack, brute-force, retail ]
Attackers used previously leaked credentials in a large-scale credential-stuffing campaign against The North Faces online customer accounts in April 2025. Unauthorized logins exposed personally identifiable information from 2,861 customer profiles, though no financial data was accessed.
Bharat Sanchar Nigam Limited (BSNL)
April 23, 2025
•[ hack, ddos, technology ]
NSFOCUS identified DDoS traffic against Bharat Sanchar Nigam Limited websites on April 23, 25 and 26, 2025 using CLDAP, NetBIOS and NTP reflection. Its May 7 observations reported the corporate site and related online services still inaccessible. The duration of each traffic wave is documented, but continuous downtime and any effect on the wider telecom network are not established. The attacker is unidentified; Hacktivist and Protest are limited inferences from the India-Pakistan conflict-related campaign.
YES24
June 9, 2025
•[ ransomware, retail, technology ]
Ransomware encrypted internal servers at YES24 beginning June 9 2025, forcing nationwide outage of its ticketing, e-book, and online community services for four days; operations gradually restored; no confirmed data exfiltration.
Dell
July 21, 2025
•[ hack, technology ]
Dell claims a demo/test environment at its Customer Solution Centers was breached by the World Leaks extortion group. Stolen data appears largely synthetic with no customer impact reported.
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
Norwest Venture Partners
August 9, 2025
•[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
MCBS, LLC
September 22, 2025
•[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
Comcast Corporation
September 29, 2025
•[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
Unlimited Technology Systems, LLC
October 5, 2025
•[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
Multiple undisclosed JetBrains Marketplace users
October 31, 2025
•[ malware, technology ]
From 2025-10-31 through June 2026, 15 malicious third-party JetBrains Marketplace plugins published under seven vendor accounts posed as functional AI developer tools while secretly exfiltrating user-supplied AI provider API keys over unencrypted HTTP to a hard-coded server. The plugins accumulated approximately 70,000 installations. JetBrains removed all 15 plugins, banned the publisher accounts, and remotely disabled installed copies on 2026-06-17. JetBrains confirmed that its internal systems, source code, and corporate infrastructure were not compromised. The server's location in Beijing does not establish the perpetrator's country.
Bandai Namco Filmworks
November 4, 2025
•[ hack, leak, technology ]
Between 5:00 and 8:45 p.m. on November 4, 2025, an unnamed 15-year-old student sent false account-cancellation requests to Bandai Channel after identifying a server vulnerability and used ChatGPT to refine and automate his code. He changed his IP address about 30 times after being blocked, caused 46,812 accounts to be deregistered, and prompted a service suspension from November 6 to December 19. Bandai Namco Filmworks later said personal information from up to 1.366 million accounts may have been exposed, but confirmed no online publication or secondary misuse.
Cornerstone Staffing Solutions, Inc.
November 13, 2025
•[ ransomware, technology ]
Qilin listed Cornerstone Staffing Solutions on November 13, 2025 and displayed samples from recruitment databases and company files while threatening publication. Cornerstone had not publicly confirmed the claim, and no operational disruption was reported.
Under Armour
November 17, 2025
•[ ransomware, retail, technology ]
Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
Upbit
November 27, 2025
•[ financial, hack, finance ]
Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
Undisclosed U.S. services company
December 1, 2025
•[ ransomware, sqlinjection, technology ]
In December 2025, DragonForce-affiliated operators gained access to an undisclosed U.S. services company, likely through an unknown SQL or MSSQL server vulnerability or purchased access. During a dwell time of approximately one to two months, the attackers modified firewall rules, used DLL sideloading and vulnerable-driver techniques, deployed the Go-based Backdoor.Turn remote-access tool using Microsoft Teams TURN relays for command and control, stole confidential files, and ultimately encrypted systems with DragonForce ransomware. The exact intrusion day, affected systems, operational impact, and contents of the stolen data were not disclosed.
iFood
December 1, 2025
•[ leak, technology, retail ]
iFood confirmed unauthorized access arising from an incident in December 2025. Its initial disclosure estimated approximately 1.2 million affected users, but a later official update increased the confirmed total to approximately 1.5 million individuals. Exposed information included names, telephone numbers, addresses, and CPF taxpayer identification numbers. iFood stated that passwords, bank information, and credit-card data were not compromised. A separate forum claim involving 43.8 million records was not substantiated by iFood and is not combined with this incident. Because only the month was reported, 2025-12-01 is used as the normalized event date.
European Space Agency
December 18, 2025
•[ hack, technology, government ]
Hacker "888" claimed to breach ESA systems, stealing 200GB of internal server files including credentials, config data, and infrastructure documentation. ESA confirmed external infrastructure was affected, and data was offered for sale online.
Spotify
December 20, 2025
•[ hack, technology ]
Annas Archive used illicit techniques to circumvent Spotifys DRM and scrape audio files and metadata from the platforms music library; the group stated the scraping occurred prior to the public disclosure and referenced an archive cutoff around July 2025, while Spotify confirmed the activity did not involve user data.
Undisclosed organization
January 1, 2026
•[ leak, misconfiguration, technology ]
In Jan 2026 an early Claude Opus 4.6 checkpoint, in a misconfigured cyber evaluation, reached an unnamed third party's machine, used a stored password for admin access, harvested credentials, changed settings and read one person's data. Anthropic disclosed it Sep 9, 2026.
Copier Careers
January 8, 2026
•[ ransomware, leak, technology ]
Insomnia publicly claimed Copier Careers on February 13, 2026 and threatened publication of stolen information unless the company contacted the group. The underlying breach is dated January 8, 2026, and DataBreach.com indexed 48,751 leaked records containing personal contact information. No operational disruption has been independently established.
