Latest Data Breaches 2025
Stay informed with our monthly roundup of the recent data breach stories across key industries, highlighting not only the scale of each breach, but also the types of data exposed, and the underlying causes behind these events, from sophisticated cyberattacks to accidental disclosures.
Data Breaches From August 2025
August 2025 brought a wave of major data breaches that showed once again how even the biggest companies and financial institutions aren't immune to cyber threats. Google, Allianz Life, Air France–KLM, and TransUnion were among the organizations hit, with many of the attacks traced back to the ShinyHunters hacking group. Instead of breaking into core systems, the attackers took advantage of third-party platforms like Salesforce and Drift, using social engineering to slip past defenses.
Google is a multinational technology company that focuses on online advertising, search engine technology, cloud computing, software, and consumer electronics. In August 2025, a data breach was confirmed that stemmed from a compromised Salesforce-hosted corporate database. Although the breach did not directly affect consumer accounts, the exposed business data has been used by hackers in subsequent social engineering and phishing attacks targeting Google's large user base.
Scale of the Breach: The breach exposed the data of a limited number of Google's business customers. While Google stated that no consumer passwords or financial data were compromised, the company issued a warning to its 2.5 billion Gmail users due to the potential for targeted follow-up attacks.
Type of Data Exposed: The breach involved "basic and largely publicly available business information" from a Salesforce database used for managing potential advertisers. This included business customer names and contact details, which are being used to craft highly convincing phishing emails and vishing (voice phishing) scams.
Cause of the Breach: The hacking group, ShinyHunters, gained access to the database through social engineering. The attackers impersonated IT support staff and tricked a Google employee into approving a malicious application linked to the Salesforce platform, which allowed them to exfiltrate the data.
Breach Notification: https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift
Air France and KLM
Air France and KLM, part of the Air France–KLM Group, are major European airlines that serve a vast global network. On August 7, 2025, the airlines disclosed a data breach that originated from a third-party customer support platform they use. The attack, which is part of a broader campaign by the hacking group ShinyHunters, did not compromise the airlines' internal systems, but it did expose sensitive customer information that can be used for targeted phishing and social engineering attacks.
Scale of the Breach: The exact number of affected customers has not been officially disclosed by the airlines, but reports indicate it could impact hundreds of thousands of travelers who had previously interacted with the customer service platform.
Type of Data Exposed: The breached data includes passenger names, email addresses, phone numbers, and Flying Blue loyalty program numbers. No sensitive information such as passwords, passport details, or credit card numbers was compromised.
Cause of the Breach: The breach was a result of an unauthorized access to a third-party customer service platform. This incident is tied to a wider campaign of attacks by the ShinyHunters group, which uses social engineering and voice phishing (vishing) to trick employees of client companies into providing access to their Salesforce-hosted data.
Breach Notification: https://nieuws.klm.com/klm-informeert-klanten-over-incident-met-persoonsgegevens/
TransUnion
TransUnion is a global consumer credit reporting agency, and one of the "Big Three" credit bureaus in the United States. In late August 2025, the company disclosed a data breach that began the previous month, affecting its U.S. consumer support operations. The incident, which TransUnion claims was quickly contained, did not compromise its core credit database or credit reports, but it exposed sensitive personal data. The breach is reportedly part of a wider campaign of attacks targeting companies that use Salesforce, a third-party cloud-based service, by a well-known hacking group.
Scale of the Breach: The breach impacted over 4.4 million U.S. individuals, and while the company states this is a "very small percentage" of its overall customer base, it is still a significant number of records.
Type of Data Exposed: The breached data included highly sensitive personal identifiers such as names, billing addresses, phone numbers, email addresses, dates of birth, and unredacted Social Security numbers. The hackers also claimed to have stolen customer support tickets and messages.
Cause of the Breach: The incident was a result of unauthorized access to a third-party application used for TransUnion's U.S. consumer support operations. The attack is linked to a larger, ongoing campaign by the hacking group ShinyHunters, which uses social engineering tactics to exploit weaknesses in Salesforce integrations to steal data from a wide range of companies.
Data Breach Notification: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3dcd9b7c-bce3-4685-bffd-f728ce96e2fd.html
Workday
Workday is an American on-demand, cloud-based software vendor specializing in financial management and human capital management systems. In mid-August 2025, Workday confirmed it was affected by a social engineering campaign targeting a third-party customer relationship management (CRM) platform, widely reported to be Salesforce. The company stated that the breach did not affect its core customer environments or the sensitive data they hold, but it did expose business contact information. The incident is part of a larger series of coordinated attacks on numerous organizations that leverage Salesforce, with the hacking group ShinyHunters being linked to the campaign.
Scale of the Breach: Workday did not disclose the number of people impacted. However, given that Workday serves over 11,000 organizations, including a large percentage of Fortune 500 companies, a legal group reported that the breach could potentially affect tens of millions of employees, students, and healthcare professionals.
Type of Data Exposed: The compromised data included "commonly available business contact information," such as names, email addresses, and phone numbers. The hackers can use this information to launch more sophisticated social engineering and phishing campaigns against the affected individuals.
Cause of the Breach: The breach was a result of a social engineering attack where hackers impersonated IT or HR staff through phone calls and text messages to trick Workday employees into giving them access to the third-party CRM platform. This method, known as "vishing" (voice phishing), allowed the attackers to exfiltrate the data without directly breaching Workday's core systems.
Breach Notification: https://blog.workday.com/en-us/protecting-you-from-social-engineering-campaigns-update-from-workday.html
Connex Credit Union
Connex Credit Union is a member-owned financial institution and one of the largest credit unions in Connecticut. In August 2025, Connex publicly disclosed a data breach that had occurred in early June. The incident exposed the personal and financial information of a significant number of its members, leading to a scramble by the credit union to provide fraud alerts and identity theft monitoring. The breach has also prompted multiple law firms to launch class action lawsuits against the credit union.
Scale of the Breach: The breach affected approximately 172,000 members of the credit union, a considerable number for a regional financial institution.
Type of Data Exposed: The compromised data was highly sensitive, including member names, account numbers, debit card information, Social Security numbers, and other government IDs. This type of information puts affected individuals at a high risk of identity theft and financial fraud.
Cause of the Breach: While the specific technical vector was not explicitly detailed by the company, the incident is linked to a wider social engineering and voice phishing campaign by the hacking group ShinyHunters. This group tricked employees of various companies into providing access to sensitive data on third-party platforms.
Data Breach Notification: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ba496af0-2688-4929-ad01-f07a4d8972cf.html
Manpower
Manpower is a leading global staffing and workforce solutions company. In August 2025, the company confirmed a data breach at an independently owned franchise in Lansing, Michigan, which occurred in late 2024. The incident, attributed to the RansomHub ransomware group, exposed a significant amount of sensitive data. Manpower clarified that the attack was isolated to the franchise's network and did not affect ManpowerGroup's wider corporate systems, and the company has offered complimentary credit monitoring to those affected.
Scale of the Breach: The breach affected approximately 144,189 individuals, primarily employees and job candidates who had worked with the Lansing franchise.
Type of Data Exposed: The data stolen included a wide range of sensitive information, such as names, Social Security numbers, driver's licenses, passport scans, addresses, and phone numbers. Additionally, the hackers claimed to have exfiltrated 500GB of corporate data, including financial statements and confidential contracts.
Cause of the Breach: The breach was a result of a ransomware attack by the RansomHub ransomware group. The hackers gained unauthorized access to the network of the Lansing franchise and exfiltrated data before encrypting the company's systems.
Data Breach Notification: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7f78311b-64ff-4436-82b7-187ed0d23685.html
Orange SA
Orange SA, formerly France Télécom, is a French multinational telecommunications corporation and a major global player in mobile, fixed-line, internet, and IPTV services. In early August 2025, the company was targeted by a ransomware attack by the Warlock ransomware group, resulting in the theft and publication of sensitive business data on the dark web. Orange confirmed the data release, stating the threat actor had only limited access to its systems and the stolen information was outdated or of low sensitivity.
Scale of the Breach: The hackers exfiltrated and published approximately 4GB of corporate files. The company did not specify the number of individuals or businesses impacted.
Type of Data Exposed: The compromised data consisted of "sensitive business user data." While Orange claims the information was "outdated or low-sensitivity," the nature of the files, which included internal documents and business information, could still be used for further attacks.
Cause of the Breach: The breach was a result of a ransomware attack carried out by the Warlock ransomware group. This group, which operates using a ransomware-as-a-service (RaaS) model, gained unauthorized access to Orange's systems and stole data before encrypting some of the company's files.
Data Breach Notification: https://newsroom.orange.com/the-orange-group-announces-that-it-filed-a-complaint-on-monday-28-july-concerning-a-security-incident-on-one-of-its-information-systems/
Salesloft Drift
In August 2025, Salesloft was at the center of a major supply-chain attack when its Drift application was compromised, leading to unauthorized access to the Salesforce environments of hundreds of its customers. This breach exposed sensitive customer data and credentials, prompting Salesforce and Google to temporarily disable their integrations with Drift.
Scale of the Breach: The breach impacted a wide array of Salesloft's customers, with security researchers estimating that over 700 organizations were affected. While Zscaler was a prominent victim, other companies like Google and Allianz Life were also impacted due to their use of the platform's integrations.
Type of Data Exposed: The attackers' primary goal was credential theft, and they exfiltrated "large volumes of data" from numerous corporate Salesforce instances. The compromised data included OAuth tokens, AWS access keys, passwords, Snowflake-related access tokens, and sensitive information from Salesforce objects such as Accounts, Cases, and Users.
Cause of the Breach: The breach was a result of a supply-chain attack where a threat actor, identified as UNC6395, compromised OAuth tokens associated with the Salesloft Drift application. These stolen tokens acted as "digital keys," allowing the attackers to bypass standard authentication and gain access to the Salesforce environments of hundreds of Salesloft customers.
Breach Notification: https://status.salesforce.com/generalmessages/20000217?ref=news.dxable.com
https://www.zscaler.com/blogs/company-news/salesloft-drift-supply-chain-incident-key-details-and-zscaler-s-response
Data Breaches From July 2025
July 2025 was another sobering reminder of just how vulnerable even the biggest brands, governments, and service providers remain in the face of cyber threats. From global airlines and fast-food giants to luxury fashion houses and city governments, organizations across industries found themselves grappling with breaches that exposed millions of records, disrupted critical operations, and shook customer trust. What stands out this month is not only the scale of these incidents, but also the common threads—social engineering, supply chain weaknesses, and basic security oversights—that continue to enable attackers. Let's take a closer look at the most significant breaches from July and what they reveal about today's evolving cyber risk landscape.
Qantas
In July 2025, Qantas, Australia's flag carrier and largest airline, disclosed a significant data breach. The incident did not affect Qantas's internal systems or flight operations but instead originated from a cyberattack on a third-party customer service platform used by one of its call centers. This supply chain attack exposed a vast number of customer records, once again underscoring the vulnerabilities that can exist within an organization's extended network of vendors and partners. The breach has been attributed to the sophisticated cybercriminal group "Scattered Spider."
Scale of the Breach: The breach affected the personal information of up to 6 million Qantas customers, with Qantas later confirming a precise figure of 5.7 million unique customer records.
Type of Data Exposed: The compromised data varied by customer but primarily included names, email addresses, phone numbers, dates of birth, addresses, and Qantas Frequent Flyer details. Importantly, the airline stated that no credit card details, financial data, or passport information were stored on the breached platform and were therefore not compromised.
Cause of the Breach: The attack was a result of social engineering, where threat actors impersonated employees to gain unauthorized access to the third-party customer service platform.
Breach Notification: https://www.qantas.com/au/en/support/information-for-customers-on-cyber-incident.html
McDonald's
In July 2025, a significant data breach occurred at McDonald's, affecting millions of job applicants. The incident centered on the company's AI-powered hiring platform, McHire, which is used by many of its franchisees. The breach was not caused by a sophisticated cyberattack but rather by a failure to secure the system's administrative backend. This security oversight led to the exposure of sensitive personal information, highlighting the risks of using third-party AI platforms without proper security protocols.
Scale of the Breach: The breach potentially exposed the personal data of approximately 64 million job applicants globally.
Type of Data Exposed: The leaked data included applicants' full names, email addresses, and phone numbers.
Cause of the Breach: The breach was caused by a weak password ("123456") used for an admin account on the platform, which had not been updated for years, along with an Insecure Direct Object Reference (IDOR) vulnerability that allowed access to other user records.
Brach Notice: https://www.paradox.ai/blog/responsible-security-update
Co-op UK
Amajor cyberattack on the Co-op, one of the UK's largest consumer cooperatives with millions of members, was confirmed to be more severe than initially reported in April 2025. While the company's proactive response of shutting down its IT systems prevented the deployment of ransomware, it did not stop the attackers from exfiltrating a significant amount of member data. The breach, which caused operational disruptions including empty shelves in some stores, was part of a larger campaign targeting multiple UK retailers and has been attributed to the notorious cybercriminal group, Scattered Spider.
Scale of the Breach: The data of all 6.5 million members of the Co-op's loyalty program was compromised in the incident.
Type of Data Exposed: The stolen data included names, addresses, and other contact information, although the company has stated that no financial details, passwords, or transaction history were accessed.
Cause of the Breach: The attack was a social engineering assault where hackers gained initial access by tricking an employee and resetting their password. From there, they were able to move laterally and exfiltrate the member database.
Breach Notification: https://www.coop.co.uk/cyber-incident
Allianz Life Insurance Company
In July 2025, Allianz Life Insurance Company of North America, a major provider of retirement and financial solutions and a subsidiary of the global financial services giant Allianz SE, confirmed a substantial data breach. The incident did not involve a direct attack on the company's internal systems, but rather on a third-party, cloud-based Customer Relationship Management (CRM) system used by the company. The breach was a prime example of a supply chain attack, where a weakness in a vendor's security led to the exposure of a vast amount of sensitive customer information, highlighting the critical importance of vetting third-party partners.
Scale of the Breach: The breach affected the personal information of the "majority" of Allianz Life's approximately 1.4 million U.S. customers.
Type of Data Exposed: The compromised data included a wide range of personally identifiable information (PII), such as full names, Social Security numbers (SSNs), dates of birth, mailing and email addresses, phone numbers, and policy/contract numbers.
Cause of the Breach: The attackers gained access through a social engineering attack, where they reportedly impersonated IT helpdesk staff to trick an employee into providing access to the third-party system, which was then used to exfiltrate the data.
Notification: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0446bff3-a013-43ed-82fa-bca6bb157de1.html
Relevant links: https://haveibeenpwned.com/Breach/AllianzLife
Ingram Micro
Ingram Micro, a leading global distributor of information technology products and services, suffered a significant ransomware attack in July 2025 that disrupted its worldwide operations. The incident, attributed to the SafePay ransomware group, forced the company to take its systems offline and impacted the entire IT supply chain, causing delays for partners and customers. The company worked with third-party experts to contain and remediate the attack, but the incident highlighted the critical vulnerabilities that exist in large, interconnected business ecosystems.
Scale of the Breach: The company's global operations were disrupted for several days, with a significant financial impact estimated at over $136 million per day.
Type of Data Exposed: The SafePay group claimed to have exfiltrated 3.5 TB of corporate data. While Ingram Micro has not confirmed the full scope, reports suggest the stolen data included email addresses, phone numbers, and Social Security numbers, among other sensitive information.
Cause of the Breach: The attackers reportedly gained initial access to the company's network by exploiting an unpatched or misconfigured GlobalProtect VPN, likely using stolen or brute-forced credentials.
Data Breach Notification: https://www.ingrammicro.com/en-us/information
Louis Vuitton
The luxury fashion brand Louis Vuitton, a cornerstone of the LVMH group, confirmed that a single, coordinated cyberattack compromised customer data across multiple regions, including the UK, South Korea, Turkey, Italy, and Sweden. This incident, part of a series of attacks on major retailers, was a sophisticated campaign targeting third-party vendors and highlights the ongoing security risks in the supply chain for high-profile companies. The attack has been widely attributed to the notorious cybercrime group, ShinyHunters, known for targeting high-value data from prominent organizations.
Scale of the Breach: The exact number of affected customers globally is still under investigation, but it is known that the breach impacted a significant portion of Louis Vuitton's customer base, with official figures reporting 419,000 affected individuals in Hong Kong and nearly 143,000 in Turkey alone.
Type of Data Exposed: The compromised data included personally identifiable information such as names, email addresses, phone numbers, residential addresses, and purchase history. Crucially, Louis Vuitton has confirmed that no payment information, credit card details, or passwords were leaked.
Cause of the Breach: The attack was a supply chain attack that exploited a vulnerability in a third-party Customer Relationship Management (CRM) system. Attackers reportedly used social engineering to trick an employee into granting them access to the system, which allowed them to exfiltrate the data.
Anne Arundel Dermatology
In July 2025, Anne Arundel Dermatology, a leading dermatology practice with over 60 locations in the Mid-Atlantic and Southeastern United States, announced that it was the victim of a hacking incident that exposed the sensitive data of a large number of its patients. The breach, which was reported to the U.S. Department of Health and Human Services, is one of the largest healthcare data breaches of the year. The extended period of unauthorized access allowed attackers to potentially exfiltrate a vast amount of protected health information (PHI) and personally identifiable information (PII).
Scale of the Breach: The hacking incident compromised the data of approximately 1.9 million patients.
Type of Data Exposed: The breached data included a wide range of sensitive information, such as names, addresses, dates of birth, medical records, health history, and insurance information.
Cause of the Breach: The cause of the breach was a network intrusion that began in February 2025 and remained undetected for several months. While the specific method of attack has not been publicly detailed, it is believed to be a hacking incident that exploited vulnerabilities in the company's systems.
Breach Notification: https://oag.ca.gov/system/files/AAD_IDX%20Notification%20Letter%20-%20Final.pdf
City of St. Paul, Minnesota
The City of St. Paul, Minnesota, became the victim of a sophisticated ransomware attack that crippled many of its digital services and internal systems. The incident was not a simple system glitch but a deliberate attack by a sophisticated external actor. The city's proactive response involved shutting down its entire network to contain the threat and prevent further damage. The attack led to a citywide state of emergency and the deployment of the Minnesota National Guard's cyber protection unit, an unprecedented move for an internal cybersecurity incident. The city's refusal to pay the ransom led the attackers to leak a significant amount of stolen data publicly.
Scale of the Breach: The attackers, identified as the "Interlock" ransomware group, exfiltrated 43 gigabytes of data from the city's servers.
Type of Data Exposed: The leaked data included various internal documents, such as HR files, financial records, and sensitive personal identification documents like driver's licenses and passport scans. However, officials stated that most resident data, which is stored in cloud-based applications, was not affected.
Cause of the Breach: The cause of the attack was identified as a ransomware attack by the Interlock group. The group reportedly gained access to the city's systems around July 20, 2025, through a backdoor that allowed the deployment of a remote access trojan, which likely led to the exfiltration and encryption of data.
Breach Notification: https://www.stpaul.gov/news/important-information-city-services-during-digital-security-incident-1
Data Breaches From June 2025
June 2025 has been another tough month on the cybersecurity front, with millions of people learning that their personal information may have been exposed in major data breaches. Patients, customers, and employees alike are finding themselves caught in the fallout of ransomware attacks and data theft that hit healthcare systems, tech platforms, and even global retailers. From McLaren Health Care and Kettering Health to Zoomcar and Ahold Delhaize, the impact has been widespread, touching everyday lives in ways that go far beyond technology. These stories remind us that behind every breach are real people whose trust and privacy are on the line.
McLaren Health Care
McLaren Health Care, a nonprofit health system based in Michigan, has experienced two major cyberattacks within two years. In a recent incident, McLaren confirmed that a ransomware attack last summer led to the compromise of sensitive data belonging to over 743,000 patients. The attack, which targeted both McLaren's core operations and its Karmanos Cancer Institute, highlights the growing vulnerability of healthcare providers to cybercriminals. While McLaren was able to restore its IT systems relatively quickly, the extensive forensic investigation delayed the notification of affected individuals, with letters being sent out nearly a year after the breach was detected.
Scale of the Breach: The data breach impacted 743,131 individuals. The organization began notifying affected individuals in June 2025, with the investigation into compromised files having concluded the month prior.
Type of Data Exposed: A wide range of sensitive personal and medical information was exposed, including: Names and Social Security numbers, Driver's license numbers, Health insurance information, Medical information, such as billing and claims information, diagnosis, and medical record numbers.
Cause of the Breach: The incident was a ransomware attack by an international group of cybercriminals, with some sources linking the attack to the "Inc. Ransomware" group. The attackers gained unauthorized access to the network over a period of several weeks, from July 17 to August 3, 2024.
Notification: https://www.mclaren.org/main/notice-of-data-security-incident
Episource LLC
Episource LLC is a healthcare services company that provides medical coding and risk adjustment services to health plans and providers. In a recent cybersecurity incident, the company discovered a data breach that exposed sensitive patient information. Episource serves as a third-party vendor, meaning that many of the affected individuals may not have been direct customers, but rather patients of healthcare organizations that partner with Episource.
Scale of the Breach: The breach impacted over 5.4 million individuals. The number was officially reported to the U.S. Department of Health and Human Services Office for Civil Rights.
Type of Data Exposed: The stolen information included a wide variety of personal and protected health information (PHI), such as: Contact information (name, address, phone number, email), Health insurance information (policy numbers, member/group IDs, and Medicare/Medicaid identifiers), Medical information (diagnoses, medications, test results, and medical record numbers), Other personal data like dates of birth and, in some cases, Social Security numbers.
Cause of the Breach: The incident was a cyberattack in which an unauthorized party gained access to and copied data from Episource's systems between January 27 and February 6, 2025. While some reports from affected partners referred to it as a ransomware attack, the company's public notice did not explicitly confirm ransomware as the cause, but did state a cybercriminal was able to view and exfiltrate data.
Breach Notification: https://response.idx.us/episource/
https://www.pshpgeorgia.com/newsroom/notice-of-data-breach.html
https://www.vnshealthplans.org/notice-of-episource-llc-data-incident/
Zoomcar
Zoomcar, an Indian car-sharing marketplace, has recently experienced a significant data breach. The company, which connects hosts with guests for car rentals, was hit by a cybersecurity incident that compromised the personal information of millions of its users. This is not the first time Zoomcar has been impacted, with a prior breach in 2018 affecting a smaller number of users. The recent incident has raised renewed concerns about data security in the mobility sector, especially for platforms that handle vast amounts of user data.
Scale of the Breach: The cybersecurity incident affected approximately 8.4 million users, a number reported by Zoomcar to the U.S. Securities and Exchange Commission (SEC).
Type of Data Exposed: The stolen data included a wide range of personal information, such as full names, phone numbers, car registration numbers, personal addresses, and email addresses. Zoomcar stated there was no evidence of financial information or plaintext passwords being compromised.
Cause of the Breach: The breach was the result of a cyberattack in which an unauthorized third party gained access to Zoomcar's internal systems. The company became aware of the incident after employees received external communications from the threat actor, who claimed to have accessed the company's data.
FORM 8-K: https://www.sec.gov/Archives/edgar/data/1854275/000121390025054319/ea0245724-8k_zoomcar.htm
Kettering Health
Kettering Health, a nonprofit health system with numerous facilities across Ohio, suffered a significant cyberattack that disrupted its operations and compromised patient data. The incident led to a system-wide technology outage, forcing the health system to cancel elective procedures and resort to using paper records. The breach was a result of a ransomware attack by a cybercriminal group that not only encrypted systems but also exfiltrated a large volume of sensitive data, which it later began leaking on the dark web. The incident highlights the critical vulnerabilities of healthcare providers to sophisticated cyber threats.
Scale of the Breach: While the exact number of affected individuals is still being determined, the ransomware group claims to have stolen 941 gigabytes of data, consisting of more than 732,000 files across over 20,000 folders.
Type of Data Exposed: The stolen information is extensive and includes a wide range of sensitive patient and employee data. Examples of the compromised data include names, dates of birth, Social Security numbers, medical record numbers, diagnoses, treatment information, and financial account information, along with scans of identity documents like driver's licenses and passports.
Cause of the Breach: The incident was a ransomware attack by the cybercriminal group known as Interlock. The attackers gained unauthorized access to Kettering Health's network and spent several weeks inside before launching the attack, which involved both data exfiltration and the encryption of files.
Breach Notification: https://ketteringhealth.org/notice-of-privacy-incident/
Ahold Delhaize
Ahold Delhaize, a global food retail conglomerate with well-known U.S. brands like Food Lion, Stop & Shop, and Giant Food, experienced a significant cyberattack that compromised the data of millions. The incident, which occurred in November 2024, not only disrupted some of its business operations, including e-commerce and pharmacy services, but also led to the exfiltration of a large volume of sensitive data. The company has since been working with cybersecurity experts and law enforcement to investigate the breach and notify affected individuals of the potential exposure.
Scale of the Breach: The data breach impacted over 2.2 million individuals. This includes current and former employees, their dependents, and others whose information was in the company's internal U.S. business systems.
Type of Data Exposed: A wide array of sensitive personal, financial, and health information was stolen, including names, dates of birth, government-issued identification numbers (Social Security, passport, and driver's license), bank account information, and medical details found within employment records.
Cause of the Breach: The incident was a ransomware attack perpetrated by the INC Ransom group. The attackers gained unauthorized access to the company's U.S. network and exfiltrated a massive amount of data, threatening to leak it on the dark web after Ahold Delhaize refused to pay the ransom.
Notice: https://www.aflac.com/docs/aflac-cyber-incident-6-24-2025.pdf
Data Breaches From May 2025
May 2025 was another alarming month for cybersecurity, with a surge in high-impact data breaches affecting major organizations across industries—from finance and retail to healthcare and technology. This month's breaches underscored recurring vulnerabilities tied to third-party vendors, insider threats, and outdated software systems. Notably, Coinbase faced a major extortion attempt linked to overseas support contractors, while Marks & Spencer suffered severe disruptions from a ransomware attack believed to be connected to IT outsourcing. Healthcare giant Ascension, global beverage leader Coca-Cola, sportswear brand Adidas, and data broker LexisNexis were also among the high-profile victims. Each incident highlights the growing complexity and scale of modern data breaches—and the urgent need for resilient, vendor-aware security strategies.
Coinbase
Coinbase, a leading cryptocurrency exchange platform founded in 2012, serves millions of users globally by facilitating the buying, selling, and storing of digital assets like Bitcoin and Ethereum. In May 2025, Coinbase disclosed a significant data breach caused by insider threats from overseas customer support contractors, discovered after a $20 million extortion demand on May 11, 2025. The breach exposed sensitive user information, though no funds or cryptographic keys were compromised. The incident has raised concerns about third-party contractor security, with potential costs estimated at $400 million.
Scale of the Breach: 69,461 users were affected.
Type of Data Exposed: Names, contact details, partial Social Security numbers, masked banking data, and ID images were compromised.
Cause of the Breach: Insider threat from overseas customer support contractors leaking data, starting December 26, 2024.
Official Notification: https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists
Marks & Spencer
Marks & Spencer (M&S), a historic British retailer founded in 1884, is renowned for its clothing, food, and home products, operating over 1,400 stores globally. In May 2025, M&S suffered a major cyberattack attributed to the "Scattered Spider" group, deploying DragonForce ransomware to encrypt virtual machines and steal customer data, severely disrupting online retail systems. The breach, potentially linked to vulnerabilities in M&S's IT outsourcing partner, Tata Consultancy Services, is expected to cause a £300 million ($400 million) profit loss, with recovery projected to extend into July 2025.
Scale of the Breach: Hundreds of thousands of customers were likely affected, though exact numbers remain unconfirmed.
Type of Data Exposed: Customer data was stolen, but no payment details or login credentials were confirmed compromised.
Cause of the Breach: A ransomware attack by the "Scattered Spider" group using DragonForce malware targeted virtual machines, possibly exploiting vulnerabilities in third-party IT systems.
Notification: https://corporate.marksandspencer.com/cyber-update
Ascension
Ascension, one of the largest nonprofit healthcare systems in the United States, operates over 140 hospitals and 40 senior care facilities across 19 states, focusing on patient-centered care. In May 2025, Ascension disclosed a significant data breach involving third-party vendors, exposing sensitive patient information ideal for medical identity theft. The breach, primarily linked to a former business partner's outdated software and a compromised cloud system, highlighted vulnerabilities in vendor security practices, impacting hundreds of thousands of individuals.
Scale of the Breach: 437,019 patients were affected by the breach.
Type of Data Exposed: Protected health information (PHI) was compromised, including data suitable for medical identity theft and fraud.
Cause of the Breach: The breach resulted from a former business partner using outdated software and vulnerabilities in a third-party vendor's cloud system.
Notification: https://www.mass.gov/doc/2025-738-ascension-health/download
Coca-Cola
The Coca-Cola Company, a global beverage giant founded in 1886, is renowned for its iconic soft drinks and operates in over 200 countries with a vast network of bottlers and distributors. In May 2025, the Everest ransomware group claimed responsibility for a data breach targeting Coca-Cola's Middle East operations, specifically its Dubai-based bottling partner, Coca-Cola Al Ahlia Beverages Company. After the company ignored ransom demands, hackers leaked 1,104 files containing sensitive employee data on dark web forums. The breach, reported on May 22, 2025, exposed personal and HR-related information, raising risks of identity theft and regulatory scrutiny.
Scale of the Breach: Personal data of 959 employees was exposed, primarily from Middle East operations.
Type of Data Exposed: Leaked data included full names, addresses, phone numbers, emails, banking details, salary records, passports, visas, and internal HR documents like administrative account structures.
Cause of the Breach: The Everest ransomware group infiltrated systems, likely through compromised credentials or third-party vulnerabilities, targeting a Middle East distributor.
Adidas
Adidas, a German sportswear giant founded in 1949, is a leading global brand known for its athletic apparel, footwear, and accessories, operating in over 100 countries. In May 2025, Adidas disclosed a data breach where hackers accessed consumer data through a third-party customer service provider, exposing contact information of customers who had interacted with its helpdesk. The breach, reported on May 23, 2025, did not compromise financial data but raised concerns about phishing and identity theft risks. Adidas is notifying affected customers and collaborating with cybersecurity experts to investigate and mitigate the incident.
Scale of the Breach: The exact number of affected customers is undisclosed, but reports suggest 544,395 individuals, including Turkish customers, may have been impacted.
Type of Data Exposed: Compromised data primarily includes names, email addresses, phone numbers, and possibly home addresses and birthdates.
Cause of the Breach: Hackers infiltrated a third-party customer service provider's systems, exploiting vulnerabilities to access consumer data.
Notification: https://www.adidas-group.com/en/data-security-information
LexisNexis
LexisNexis Risk Solutions, a subsidiary of RELX founded in 1970, is a major data broker based in Alpharetta, Georgia, providing analytics and risk management services to industries like finance, insurance, and law enforcement. In May 2025, LexisNexis disclosed a significant data breach involving unauthorized access to its GitHub account, discovered on April 1, 2025, after a tip from an unknown third party. The breach, which occurred on December 25, 2024, exposed sensitive personal information of over 364,000 individuals, raising concerns about data broker security practices. LexisNexis is offering two years of free identity protection and credit monitoring to affected individuals while facing potential class-action lawsuits.
Scale of the Breach: 364,333 individuals were affected by the breach.
Type of Data Exposed: Compromised data included names, phone numbers, email and postal addresses, Social Security numbers, driver's license numbers, and dates of birth.
Cause of the Breach: An unauthorized third party accessed data through a compromised LexisNexis GitHub account on a third-party software development platform.
April 2025
April 2025 marked a concerning month in cybersecurity, with data breaches impacting a wide array of industries—from healthcare and finance to telecommunications and even professional sports. Millions of individuals had their sensitive data compromised as a result of ransomware attacks, third-party vulnerabilities, software misconfigurations, and unauthorized access incidents. High-profile organizations like Yale New Haven Health System, Blue Shield of California, and NASCAR found themselves in the crosshairs, while software providers like Cleo became conduits for broader compromise across their customer bases.
This report outlines the most significant data breaches disclosed in April 2025, highlighting the scale, causes, and data exposed in each incident to shed light on emerging cyber threats and the ongoing challenges of securing personal and organizational information.
Yale New Haven Health System
Yale New Haven Health System (YNHHS) is a large, integrated healthcare delivery system serving patients across Connecticut and parts of Rhode Island. In April 2025, YNHHS disclosed a significant data breach stemming from unauthorized access to their network in March. This incident compromised the personal and medical information of millions of individuals.
Scale of the Breach: Approximately 5.5 million individuals were affected by this cybersecurity incident.
Type of Data Exposed: A range of sensitive data was compromised, including names, dates of birth, addresses, contact information, race/ethnicity, Social Security numbers, and medical record numbers.
Cause of the Breach: While not officially confirmed, Detected on March 8, 2025, this breach was likely a ransomware attack, where unauthorized access led to the exfiltration of data.
Official Notification: https://www.ynhhs.org/news/yale-new-haven-health-notifies-patients-of-data-security-incident
Cleo's file transfer platform
Cleo provides file transfer software, and recently, its platform was affected by a security vulnerability. This vulnerability was exploited by cybercriminals, resulting in data breaches at organizations that utilize Cleo's software for file transfers.
Scale of the Breach: The breach has impacted multiple organizations, with data being exfiltrated from companies like Hertz and WK Kellogg.
Type of Data Exposed: The data exposed varies, but includes sensitive information such as employee records, personal data, and confidential business files.
Cause of the Breach: The breach was caused by the exploitation of vulnerabilities in Cleo's file transfer software, including flaws that allowed unauthorized file uploads/downloads and command execution.
VeriSource Services
Texas-based company providing employee benefits and HR administration services, experienced a significant data breach. The company disclosed that a cyberattack on April 14, 2025, initially detected in February 2024, compromised the personal information of approximately 4 million individuals.
Scale of the Breach: Approximately 4 million individuals were affected.
Type of Data Exposed: Sensitive personal information, including full names, addresses, dates of birth, gender information, and Social Security Numbers.
Cause of the Breach: The exact cause has not been publicly disclosed, but it involved "unauthorized access" to VeriSource's network.
Official Notification: http://www.verisource.com/Incident.html
Blue Shield of California
A major health insurance provider, experienced a data breach affecting approximately 4.7 million members due to a misconfiguration of Google Analytics on some of its websites. This error, which occurred between April 2021 and January 2024, inadvertently shared protected health information with Google's advertising services.
Scale of the Breach: Approximately 4.7 million Blue Shield of California members were affected.
Type of Data Exposed: Protected health information including insurance details, demographic information, service dates, providers, patient names, financial responsibility, and search activity.
Cause of the Breach: A misconfiguration of Google Analytics on certain Blue Shield websites.
Official Notification: https://news.blueshieldca.com/notice-of-data-breach
DBS Group and Bank of China
DBS Group and Bank of China (Singapore branch) both utilize Toppan Next Tech for printing services related to customer statements and letters. In early April 2025, TNT reported a ransomware attack on their systems, which led to the extraction of some customer data belonging to both banks.
Scale of the Breach:
- DBS: Approximately 8,200 customers had their statements or letters potentially compromised. The majority of these related to DBS Vickers (brokerage) accounts and some Cashline (short-term loan) accounts.
- Bank of China (Singapore): Around 3,000 personal banking customers were affected, whose paper notifications were printed and distributed by TNT.
Type of Data Exposed:
- DBS: The potentially compromised information included first and last names, postal addresses, and details relating to equities held under DBS Vickers and Cashline loans.
- Bank of China (Singapore): The data exposed included customer names, addresses, and in some cases, loan account numbers.
Cause of the Breach:
The root cause was a ransomware attack on Toppan Next Tech's (TNT) systems. The attackers gained unauthorized access to TNT's network and extracted data. The banks' own systems were not directly compromised in this incident, highlighting the risks associated with third-party vendors in the supply chain.
MTN Group
A major telecommunications provider in Africa and Asia, recently disclosed a cybersecurity incident in late April 2025 that resulted in unauthorized access to the personal information of some of its customers across certain markets.
Scale of the Breach: The exact number of affected customers and the specific markets involved are still under investigation and haven't been fully disclosed by MTN. However, MTN Ghana has confirmed that approximately 5,700 of their customers may have been impacted.
Type of Data Exposed: MTN has indicated that the information accessed was personal information of some customers. While the specifics are still being determined, reports suggest it includes names, surnames, and mobile numbers.
Cause of the Breach: MTN has only stated that an "unknown third party" gained "unauthorized access to data linked to parts of our systems." The company has not yet provided details on the specific vulnerability exploited or the methods used by the attackers.
Official Notification: https://www.mtn.com/mtn-cybersecurity-incident-but-critical-infrastructure-secure/
NASCAR
NASCAR, the National Association for Stock Car Auto Racing, reportedly experienced a significant cybersecurity incident in early April 2025. The Medusa ransomware group claimed responsibility for the attack, alleging they exfiltrated over one terabyte of data from NASCAR's systems.
Scale of the Breach: The Medusa ransomware group claims to have stolen over 1 terabyte of data. The exact number of individuals affected is unclear, but the nature of the data suggests potential exposure of employee, partner, and operational information.
Type of Data Exposed: the exposed information may include:
-
- Personally Identifiable Information (PII) of NASCAR employees: Names, email addresses, and job titles.
- Credential-related details: Potentially access credentials for certain systems.
- Detailed raceway ground maps: Internal layouts and potentially security information of race tracks.
- Internal business documents: Including international business documents, invoices, and financial reports.
- Contact details of third-party services: Information about NASCAR's partners and vendors.
Cause of the Breach: The cause of the breach is attributed to a ransomware attack by the Medusa group.
March 2025
March 2025 has proven to be a stark reminder of the escalating cyber threats facing organizations across diverse sectors, from education and finance to healthcare and technology. This month's data breach report reveals a series of alarming incidents, each highlighting the vulnerabilities inherent in our increasingly interconnected digital landscape. From the massive exposure of applicant data at New York University to the alleged compromise of Oracle Cloud's legacy systems, and the ransomware attacks targeting Jaguar Land Rover and the Pennsylvania State Education Association, the sheer scale and sensitivity of the data compromised underscore the urgent need for enhanced cybersecurity measures.
New York University
On March 22, 2025, New York University (NYU) experienced a significant data breach where a hacker redirected the university's website and exposed the personal information of over 3 million applicants dating back to 1989.
Scale of the Breach: The breach exposed the personal information of over 3 million applicants to NYU. This includes both accepted and rejected students.
Type of Data Exposed: A wide range of sensitive personal details was compromised, including names, test scores (SAT/ACT), GPAs, intended majors, demographic information, family backgrounds, and financial aid details.
Cause of the Breach: The breach occurred due to unauthorized access to NYU's IT systems, allowing a hacker to redirect web traffic and access underlying databases containing applicant information
Oracle Cloud
The alleged Oracle Cloud data breach in March 2025 involved a significant cybersecurity incident in which a threat actor claimed to have compromised approximately 6 million records from Oracle Cloud's systems.
Oracle initially denied any compromise of its core Oracle Cloud infrastructure but later reports indicate that Oracle has privately acknowledged to certain customers that a breach did occur, albeit affecting older "legacy environments."
Scale of the Breach: The threat actor claims to have compromised approximately 6 million records, potentially affecting over 140,000 Oracle Cloud tenants, indicating a very broad impact.
Type of Data Exposed: Highly sensitive credentials were reportedly exposed, including Java KeyStore (JKS) files, encrypted passwords and password hashes, key files, and Java Process Status (JPS) keys, all of which could allow for significant unauthorized access.
Cause of the Breach: There are conflicting reports, but evidence points to the exploitation of vulnerabilities within Oracle's systems, possibly related to older "legacy enviroments" of Oracle cloud, and potentially related to vulnerabilities within Oracle Fusion Middleware instances that could allow unauthorized access via Oracle Access Manager.
Jaguar Land Rover (JLR)
Jaguar Land Rover (JLR) experienced a significant data breach in March 2025, attributed to the HELLCAT ransomware group, which resulted in the exposure of internal documents, source code, tracking data, and employee credentials. The breach was facilitated by compromised login information, including credentials from an LG Electronics employee, highlighting the interconnectedness of supply chain vulnerabilities.
Scale of the Breach: The breach involved the exfiltration of 700 documents in the first wave and 350 gigabytes of data in the second wave, impacting internal operations and potentially compromising sensitive information.
Type of Data Exposed: Compromised data included internal documents, source code, tracking data, and employee credentials, posing risks to intellectual property and employee privacy.
Cause of the Breach: The breach was caused by the exploitation of compromised credentials, including those obtained through infostealer malware, and the subsequent use of those credentials by the HELLCAT ransomware group to gain access to JLR's systems.
SpyX Stalkerware App
The SpyX stalkerware app data breach in March 2025 exposed highly sensitive personal information of nearly 2 million individuals, raising serious privacy and safety concerns.
Scale of the Breach: Nearly 2 million individuals were affected, indicating a massive exposure of personal data from users of the SpyX stalkerware application.
Type of Data Exposed: Highly sensitive data including iCloud usernames and passwords (in plaintext), email addresses, IP addresses, device information, and potentially messages and photos were exposed, posing a significant risk to user privacy and security.
Cause of the Breach: The breach resulted from a severe security lapse, specifically the lack of proper authentication and protection for the app's user database, making it easily accessible to unauthorized individuals.
Have I Been Pwned: https://haveibeenpwned.com/PwnedWebsites#SpyX
Angel One
Angel One, a major Indian stock brokerage firm, disclosed a data breach in March 2025, revealing unauthorized access to client information stored in its Amazon Web Services (AWS) account. While Angel One assured clients that their funds and securities remained secure, the incident raised concerns about cybersecurity practices within the financial sector and impacted the company's stock value.
Scale of the Breach: The scale of the breach involved the compromise of client information stored within Angel One's AWS environment, though the precise number of affected clients has not been publicly released.
Type of Data Exposed: The exposed data consisted of client information held within the company's AWS account, which although Angel one has not released the type of data, it is assumed to be contact information, and potentially financial information.
Cause of the Breach: The breach resulted from unauthorized access to Angel One's AWS account, with the specific vulnerability exploited still under investigation, but it shows a weakness within the security of their cloud storage.
Western Alliance Bank
Western Alliance Bank experienced a data breach in March 2025, stemming from the exploitation of a zero-day vulnerability in a third-party secure file transfer tool provided by Cleo. The Clop ransomware group gained unauthorized access, compromising the sensitive personal information of approximately 22,000 customers. The breach, which occurred in October 2024 but was disclosed in March 2025.
Scale of the Breach: Approximately 22,000 customers' personal information was compromised, indicating a significant exposure of sensitive financial and personal data.
Type of Data Exposed: The exposed data included highly sensitive information such as names, Social Security numbers, dates of birth, financial account numbers, driver's license numbers, tax identification numbers, and passport information, creating a substantial risk of identity theft.
Cause of the Breach: The breach was caused by the exploitation of a zero-day vulnerability in a third-party secure file transfer tool provided by Cleo, allowing the Clop ransomware group to gain unauthorized access to Western Alliance Bank's systems.
Pennsylvania State Education Association
The Pennsylvania State Education Association (PSEA), a labor union representing public school employees, experienced a significant data breach in March 2025, impacting over 500,000 individuals. The Rhysida ransomware group claimed responsibility for the attack, which resulted in the exposure of highly sensitive personal information.
Scale of the Breach: Over 500,000 individuals were affected, which includes current and former members and their dependents, making it a very large scale data breach.
Type of Data Exposed: The compromised data included highly sensitive information such as Social Security numbers, driver's license and state ID numbers, financial account information, payment card details, passport numbers, medical information, and taxpayer ID numbers, significantly increasing the risk of identity theft.
Cause of the Breach: The breach was caused by a ransomware attack carried out by the Rhysida ransomware group, which gained unauthorized access to PSEA's systems and exfiltrated sensitive data.
Official Notification: https://www.psea.org/pages-without-a-home/notice-of-data-security-incident/
California Cryobank
California Cryobank (CCB), a company specializing in sperm and egg donation services, experienced a data breach in March 2025, revealing unauthorized access to customer data from April 2024. The breach, discovered in October 2024 and CCB began sending out data breach notification letters to affected individuals in March 2025.
Scale of the Breach: The scale of the breach involved the potential compromise of customer data stored within CCB's IT environment, affecting individuals who have utilized their services.
Type of Data Exposed: The exposed data included sensitive personal information such as names, driver's license numbers, bank account and routing numbers, Social Security numbers (SSN), and health insurance information, which poses a significant risk of identity theft and privacy violations.
Cause of the Breach: The breach was caused by unauthorized access to CCB's IT environment, with the specific vulnerability exploited still under investigation, but it resulted in the potential access and/or acquisition of files containing customer data.
Data Breach Notification: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6b6aacae-67b7-414e-be1a-ea17b44a7f12.html
Numotion
Numotion, a provider of complex rehabilitation technology, experienced a significant data breach in March 2025, stemming from unauthorized access to employee email accounts between September and November 2024.
Scale of the Breach: Nearly half a million individuals were affected, demonstrating a large-scale exposure of sensitive data.
Type of Data Exposed: The compromised data included full names, dates of birth, payment information, financial account information, product information, health insurance details, medical information, driver's license numbers, and Social Security numbers, encompassing a wide range of highly sensitive personal and medical data.
Cause of the Breach: The breach resulted from unauthorized access to employee email accounts, likely due to phishing attacks, which allowed attackers to access and exfiltrate sensitive customer information.
Data Breach Notification: https://www.numotion.com/data-security-incident
February 2025
The February 2025 edition of our Data Breach Report highlights some of the most significant cybersecurity incidents affecting organizations across various industries. From massive data leaks exposing billions of records to targeted ransomware attacks compromising highly sensitive information, this month's breaches reveal critical vulnerabilities in cybersecurity defenses. Companies spanning IoT technology, healthcare, telecommunications, financial services, and government contractors have all suffered major security lapses, putting millions of individuals at risk of identity theft, financial fraud, and privacy violations. In this report, we break down the key details of each breach, including the scale of the exposure, the types of data compromised, and the underlying causes that led to these incidents.
Mars Hydro
The Mars Hydro data breach in February 2025 is a significant event highlighting the vulnerabilities within the Internet of Things (IoT) landscape.
Scale of the Breach: A massive 2.7 billion records were exposed in this data breach, highlighting the sheer volume of compromised data.
Type of Data Exposed: The types of data exposed included very sensitive information such as Wi-Fi passwords, IP addresses, and email addresses, which create severe security risks.
Cause of the Breach: The cause of the breach was a misconfigured, non-password-protected database, revealing a critical failure in basic security measures.
Genea Fertility Clinic
The Genea Fertility Clinic data breach in February 2025 resulted from a sophisticated cyberattack by the "Termite" ransomware gang. This incident compromised highly sensitive patient data, including personally identifiable information and detailed medical records.
Scale of the Breach: Approximately 940.7GB of data was exfiltrated, showing the significant volume of patient information that was compromised.
Type of Data Exposed: The breach exposed highly sensitive data, including personally identifiable information like names and addresses, and critical medical details such as Medicare numbers, medical histories, and treatment records, placing patients at considerable risk.
Cause of the Breach: The initial cause of the breach was the exploitation of a vulnerability within a Citrix server, which allowed the attackers to gain unauthorized access to Genea's network and patient management systems.
Genea Cyber Incident – Update and Support Resources: https://www.genea.com.au/pages/important-update-about-a-cyber-incident-MCI2XUN2KJWRFXNMZI2ZZ3QVD2JA
Orange Group
The Orange Group data breach in February 2025 stemmed from a cyberattack executed by the hacker "Rey," associated with the HellCat ransomware group. This incident primarily affected Orange Romania, resulting in the exposure of over 600,000 records. Exploiting vulnerabilities in Orange's systems, the attacker gained unauthorized access and exfiltrated sensitive data, including customer and employee information, email addresses, and partial payment card details.
Scale of the Breach: Over 600,000 records were exposed, and approximately 6.5GB of data was exfiltrated, showing a significant compromise of Orange Group's information.
Type of Data Exposed: The types of data exposed included sensitive information such as 380,000+ unique email addresses, source code, invoices, contracts, customer and employee records, and partial payment card details of Romanian customers, presenting various risks to those involved.
Cause of the Breach: The cause of the breach involved the exploitation of compromised credentials and vulnerabilities within Orange's Jira software and internal portals, allowing the attacker unauthorized access to their systems.
DISA Global
The DISA Global Solutions data breach, while discovered in April 2024, resulted in notification letters being sent to affected individuals around February 2025, revealing a significant delay. This incident compromised the sensitive personal information of over 3.3 million people, including Social Security numbers, financial account details, government-issued IDs, and full names.
Scale of the Breach: Over 3.3 million individuals' personal information was compromised, indicating a large-scale exposure of sensitive data.
Type of Data Exposed: The types of data exposed included highly sensitive information such as Social Security numbers, financial account details, government-issued identification documents, and full names.
Cause of the Breach: The cause of the breach was a cyberattack that infiltrated DISA's systems, with unauthorized access occurring over a prolonged period, highlighting vulnerabilities in their cybersecurity defenses.
DISA Global Solutions Data Breach Notice: https://ago.vermont.gov/sites/ago/files/documents/2025-02-24%20DISA%20Global%20Solutions%20Data%20Breach%20Notice%20to%20Consumers.pdf
Finastra
The Finastra data breach, detected in November 2024 with unauthorized access dating back to October 31st, involved a compromise of a Secure File Transfer Platform (SFTP) used for technical support. This resulted in the exposure of personal information, including names and financial account details, of individuals whose data was contained within the accessed files. Finastra, a global financial technology company, conducted an investigation with cybersecurity experts, notified law enforcement, and began notifying affected individuals in February 2025.
Scale of the Breach: The breach involved unauthorized access to a Secure File Transfer Platform (SFTP), indicating a compromise of files containing customer data, with the specific number of affected individuals still being assessed.
Type of Data Exposed: The types of data exposed included personal information such as names and financial account information, which poses risks related to financial fraud and identity theft.
Cause of the Breach: The cause of the breach was unauthorized access to Finastra's Secure File Transfer Platform (SFTP) used for technical support, highlighting vulnerabilities in their third-party vendor security.
Notice of Data Breach: https://www.mass.gov/doc/2025-249-finastra-technology-inc/download
Hospital Sisters Health System
The Hospital Sisters Health System (HSHS) data breach, stemming from a cyberattack in August 2023, resulted in the compromise of over 882,000 individuals' personal and health information. While the attack occurred in 2023, the full scope of individuals affected was released in February 2025.
Scale of the Breach: Over 882,000 individuals' personal and health information was compromised, representing a significant exposure of sensitive patient data.
Type of Data Exposed: The types of data exposed included highly sensitive information such as names, Social Security numbers, medical records, health insurance details, and treatment information.
Cause of the Breach: The cause of the breach was a cyberattack that resulted in unauthorized access to HSHS's network, indicating vulnerabilities in their cybersecurity defenses that allowed malicious actors to infiltrate their systems.
Data Breach Notification: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2bf19926-e137-4a41-9773-5429f08343ec.html
PowerSchool
The PowerSchool data breach in February 2025 compromised the sensitive information of approximately 62 million students, making it a major cybersecurity incident within the education sector. The breach exposed a wide range of highly sensitive data, including grades, medical histories, Social Security numbers, and restraining order details, raising significant concerns about student privacy and security.
Scale of the Breach: Approximately 62 million student records were compromised, indicating a massive breach affecting a significant portion of the student population.
Type of Data Exposed: The types of data exposed included highly sensitive information such as grades, medical histories, Social Security numbers, and restraining order details.
Cause of the Breach: The cause of the breach was a cyberattack that exploited vulnerabilities in PowerSchool's systems.
GrubHub
The GrubHub data breach in February 2025 compromised the personal and financial information of customers, merchants, and drivers due to a sophisticated cyberattack. The breach exposed customer names, addresses, order histories, merchant financial details, driver information, and partial credit card data, raising concerns about identity theft and financial fraud.
Scale of the Breach: The breach affected a significant number of customers, merchants, and drivers, though the precise number is still being investigated, indicating a widespread compromise of GrubHub's user base.
Type of Data Exposed: The types of data exposed included customer names, addresses, order histories, merchant financial information, driver personal information, and partial credit card data.
Cause of the Breach: The cause of the breach was a sophisticated cyberattack that exploited vulnerabilities in GrubHub's systems.
January 2025
January 2025 has already proven to be a stark reminder of the ever-present threat of data breaches, with a disturbing wave of incidents impacting millions of individuals and organizations across various sectors. From healthcare providers and law firms to global corporations and government agencies, the past month has exposed vulnerabilities and highlighted the critical need for robust cybersecurity measures.
This month's data breach report delves into the most significant incidents of January 2025, examining the scale of each breach, the types of data exposed, and the potential implications for those affected.
Gravy Analytics
In January 2025, Gravy Analytics suffered a significant data breach that exposed the personal information of millions of people worldwide. The breach occurred when a hacker exploited a compromised credential to access Gravy's cloud storage on Amazon's servers.
Scale of the Breach: While the full extent is still under investigation, reports suggest the breach could involve the location data of millions of individuals. Gravy Analytics is known to track over a billion devices globally, collecting over 17 billion signals from smartphones daily.
Type of Data Exposed: The exposed data includes precise location data points, revealing exactly where people have been, lived, worked, and traveled.
Cause of the Breach: The breach was reportedly caused by a "misappropriated key" that allowed unauthorized access to Gravy Analytics' AWS cloud storage environment.
Globe Life
Globe Life Inc., the parent company of American Income Life Insurance Company, disclosed a significant data breach in January 2025.This breach, initially reported in mid-2024, affected approximately 850,000 individuals, a substantial increase from the initial estimate of 5,000.
Scale of the Breach: The breach affected around 850,000 individuals, significantly more than the initially estimated 5,000.
Type of Data Exposed: The exposed data included names, Social Security numbers, contact details, dates of birth, health information, and insurance details.
Cause of the Breach: The breach, discovered on June 13, 2024, involved unauthorized access to databases maintained by a few independent agency owners.
SEC filing: https://www.sec.gov/ix?doc=/Archives/edgar/data/320335/000032033525000004/gl-20241017.htm
PayPal
The New York State Department of Financial Services has declared that PayPal will pay $2M in a settlement over charges that it failed to comply with state cybersecurity regulations. The organization's failure to comply led to a data breach in 2022, which may have compromised PII data.
Conduent
Conduent, a major business process outsourcing and IT services provider experienced a significant cybersecurity incident in January 2025. This incident caused disruptions to services across multiple states, particularly affecting government agencies and their ability to process payments and provide essential services.
Scale of the Breach: It's unclear how many individuals were directly affected, but the incident disrupted services in at least four states, suggesting a potentially large-scale impact. Conduent handles data for numerous government agencies, so the potential reach is significant.
Type of Data Exposed: Conduent provides services related to child support, food assistance, and other social programs. This means they likely handle sensitive personal information, including: Names, Social Security numbers, Addresses, Dates of birth, Financial information, Possibly health information in some cases.
Cause of the Breach: Conduent only stated that the disruptions were caused by a "cybersecurity incident." They haven't provided details about the specific attack vector.
ICAO
The International Civil Aviation Organization (ICAO), responsible for setting global aviation standards, suffered a data breach in January 2025, impacting nearly 12,000 individuals. This breach raises serious concerns, as the compromised data included records from key aviation regulatory bodies. Experts suggest the motive may extend beyond financial gain to espionage, targeting individuals with critical knowledge of aviation safety protocols and systems.
Scale of the Breach: Initially, a hacker claimed to have accessed 42,000 sensitive documents. After investigation, ICAO confirmed that nearly 12,000 individuals were affected.
Type of Data Exposed: The compromised data included personally identifiable information (PII) of job applicants from 2016 to 2024. This PII included names, email addresses, dates of birth, and employment history.
Cause of the Breach: The attack was reportedly executed through an SQL Injection vulnerability in a web application.
Official Statement: https://www.icao.int/Newsroom/Pages/ICAO-statement-on-reported-security-incident.aspx
Community Health Center, Inc.
Community Health Center, Inc. (CHC), a non-profit healthcare provider in Connecticut, suffered a significant data breach in January 2025, impacting over one million individuals. CHC detected unauthorized network activity and confirmed data exfiltration. This breach puts individuals at risk of identity theft, financial fraud, and potential misuse of their medical information.
Scale of the Breach: The breach affected approximately 1,060,936 individuals, including current and former patients and those who received COVID tests or vaccines at CHC clinics.
Type of Data Exposed: The compromised data included a wide range of sensitive personal, financial, and health information.
Cause of the Breach: CHC detected unusual activity on its computer network on January 2, 2025, indicating a potential data breach. An investigation revealed that an unauthorized third party had gained access to their systems and potentially copied files containing sensitive information.
Data Breach Notification: https://www.maine.gov/cgi-bin/agviewerad/ret?loc=1849
HCF Management
HCF Management, which operates 31 long-term care facilities in Ohio and Pennsylvania, suffered a significant data breach in 2024 that came to light in January 2025 as they have started sending letters to thousands of patients informing them of a data breach that gained access to their names, dates of birth, Social Security numbers, and other sensitive information.
Scale of the Breach: Approximately 70,000 residents of HCF Management-operated facilities were affected. The breach impacted residents across multiple facilities, including HCF Corry Manor, HCF Warren Manor, HCF Shawnee Manor, and HCF Edinboro Manor.
Type of Data Exposed: The compromised data included a variety of sensitive personal and medical information.
Cause of the Breach: The breach was the result of a cyberattack where hackers gained access to HCF Management's network. The intrusion was detected on October 3, 2024, but the investigation revealed that the network had been infiltrated as early as September 17, 2024.
Wolf Haldenstein
The law firm Wolf Haldenstein experienced a substantial data breach in January 2025, impacting approximately 3.4 million individuals. The breach, discovered in December 2023 but disclosed later, exposed highly sensitive personal and protected health information.
Scale of the Breach: The breach affected approximately 3.4 million individuals, making it one of the largest data breaches to occur at a law firm.
Type of Data Exposed: The compromised data included sensitive personal and protected health information (PHI),
Cause of the Breach: The law firm detected suspicious activity in its network environment on December 13, 2023. An investigation revealed that an unauthorized actor had gained access to certain files and data stored within the network.
