Hacks, thefts, and disruption: The worst data breaches of 2025
Content
The incident mirrors recent phone-based attacks on development offices at Princeton, Penn, and Columbia that also targeted donor records and contact data. The safest wording is that Salesforce was not breached directly, but connected customer environments were affected. Soon after the disclosure, Scattered Lapsus Hunters https://www.softforsale.com/67244/buy-pakeysoft-zip-password-recovery.html claimed responsibility in a Telegram channel and listed companies that included Atlassian, GitLab, Malwarebytes, SonicWall, Verizon, and others. Google Threat Intelligence confirmed the scale of exposure, noting hundreds of affected Salesforce instances across multiple sectors.
Petco disclosed a data exposure on Dec 3, 2025, inferred from a report that cited a Wednesday filing with California’s attorney general, after a software application setting left certain files accessible online. Anubis claimed responsibility, but the company’s final public scope remains more reliable than attacker claims. The Rainbow Six Siege incident remained a confirmed backend compromise by July 2026, centered on account actions, game credits, cosmetics, and marketplace abuse rather than a confirmed player data theft. The Aflac breach remained a confirmed major insurance data theft by July 2026, affecting more than 22 million people. The scale https://alcitynews.com/hide-expert-vpn-your-gateway-to-secure-and-private-internet-browsing.html of the posted data suggests at least partial exfiltration despite bpost’s ongoing investigation. TridentLocker, a newer ransomware operation, has claimed attacks on several organizations this year.
No later public evidence was found showing mass user data theft from this specific Chrome flaw. The breach gained wider attention this week after Have I Been Pwned obtained the dataset and notified 72 million people. Under Armour said it is investigating claims that customer data tied to 72 million accounts was posted to a hacker forum.
- Dairy Farmers of America confirmed a ransomware attack in June 2025, claiming there was no evidence of misuse of the exposed employee data, while the Play ransomware gang claimed responsibility, asserting they had stolen sensitive company and employee information before leaking it online.
- Two major data breaches in the insurance and automotive dealership sectors have compromised sensitive information of over 2.25 million individuals.
- The impact of the cyber attack was that “unauthorised access by a third party to a limited number of its IT systems” resulted in the compromise of “certain employee, customer and supplier information” at Australian Fluid Power.
- The Obscura ransomware gang claimed responsibility for the September 23 attack on Michigan City, Indiana, which forced many systems offline, disrupted employee access, and resulted in the theft and public release of 450 GB of data after the ransom deadline expired.
FBI and ATF surveillance systems were breached, sparking two “major cyber incidents”
Nissan stated that no credit card or financial information was involved and that no additional Nissan data was stored in the affected environment. Later reporting continued to frame the incident as a third-party or partner-linked exposure, with credit monitoring and fraud precautions offered to affected people. The SoundCloud breach had a clearer count by July 2026 after Have I Been Pwned listed about 29.8 million affected accounts. SoundCloud stated that passwords, financial data, and private content were not accessed. Brightspeed acknowledged a reported cybersecurity event on 05 Jan, 2026 and said it is investigating, with updates for customers, employees, and authorities as facts firm up. Global-e reported it contained the activity and started notifying affected people and regulators.
- Information access policies should make sure that the right people have access to the right level of ePHI at the right time.
- Why is it important that all members of the workforce receive ongoing security awareness training?
- If you want to know whether your organization's credentials are circulating, check whether your accounts have been compromised and monitor the dark web for credential dumps tied to your domain.
- The largest recent one is the 2024 National Public Data leak, which put roughly 2.9 billion records, including Social Security numbers, into circulation, some of it stored in plain text.
- It is important that all members of the workforce receive ongoing security awareness training for two reasons.
- Most importantly, shorten your containment window so a compromised device is locked in minutes.
Alpine Linux SSH Flaw Lets Attackers Log In Without a Password
Threat intelligence trackers listed the company as claimed by CoinbaseCartel, but technical details, stolen-data contents, and operational impact remain unclear. Analysts continue to examine the zero-day flaws and threat actors behind the activity. Both institutions reported that attackers accessed personal and financial data through compromised Oracle EBS systems used for core business functions. The Asus incident remained a confirmed supplier breach by July 2026, not a direct compromise of Asus internal systems or customer data. Asus stated that stolen material involved camera source code used in its phone line, and that no internal systems, products, or customer data were affected. Spotify confirmed it is investigating unauthorized scraping of its music library after a pirate activist group claimed it released metadata covering roughly 256 million tracks and 86 million audio files.
ManageMyHealth later stated that approximately 6% to 7% of users may be impacted, roughly 108,000 to 126,000 people, with notifications expected within 48 hours. Ransom demands https://chinanewsapp.com/the-topic-of-anonymity-of-bitcoin-mixers-their-advantages-and-the-top-3-most-popular.html continued across affected organizations, but victim-level impact still varies by company. The criminal group linked to CL0P claimed it accessed sensitive ERP data and emailed leaders from compromised third-party accounts on or before Sept 29, 2025, demanding payment to prevent leaks.
