Data Breach News & Insights The Cyber Express

Mirae Asset Securities confirmed separate attacks exposing about 3,800 customers’ account numbers and information on 35,255 staff, including some encrypted passwords. A Web3Auth flaw exposed private keys for some Keplr wallets made with Google or Apple login. In a filing with Maine’s attorney general, DISA said the breach affected more than 3.3 million people who had undergone employee screening tests. CHC, which provides such services as school-based healthcare and substance abuse programs, said that the unnamed hacker compromised its network on January 2 to steal patients’ personal data and sensitive health information. PowerSchool hasn’t confirmed or denied the reported 62 million figure, but various filings have confirmed that millions of people were affected by the breach. Earlier in March, a data breach broker dumped online a full cache of 73 million customer records to a known cybercrime forum for anyone to see, some three years after a much smaller sample was teased online.

The exploitation of zero-day "ToolShell" flaws in Microsoft SharePoint led to compromises of organisations across four continents — including U.S. agencies NNSA, HHS, and DHS. Chinese state-linked threat actor Jewelbug (also known as Earth Alux) breached the systems of Russian IT service provider Positive Technologies between January and May 2025, compromising its software build and code-repository environments and potentially exposing dozens of Russian companies to further infiltration. The incident disrupted several online services in Sugar Land—including the 311 contact centre, utility billing, permit and inspection scheduling, payments, and building-applications; but no threat actor was publicly named.

Information access policies should make sure that the right people have access to the right level of ePHI at the right time. It is also important that NPIs are used correctly in claims and billing transactions to make sure payments are received on time. It is felt (although cannot not proven) that anonymous reporting channels generate more reports because members of the workforce feel protected against retaliation. OCR’s investigators determined OSF Healthcare System failed to conduct a HIPAA-compliant risk analysis, there was an impermissible disclosure of the ePHI of 53,907 individuals, and a failure to provide timely notifications to OCR and the affected individuals.

ShinyHunters claimed responsibility and said 234 GB of data was exfiltrated in the incident, then started leaking the stolen data as it failed to reach an agreement with DentaQuest on a ransom payment. In early June 2026, DentaQuest announced that it was investigating a cybersecurity incident involving a limited part of its computer network. The exact same number of data breaches are listed on the OCR data breach portal for January to July as this time in 2025, and it is likely that some breaches have yet to be added to the portal.

NCSC Assured Building & Optimising Cyber Incident Response Playbooks Course

Dairy Farmers of America confirmed a ransomware attack in June 2025, claiming there was no evidence of misuse of the exposed employee data, while the Play ransomware gang claimed responsibility, asserting they had stolen sensitive company and employee information before leaking it online. The impact of the cyber attack was that “unauthorised access by a third party to a limited number of its IT systems” resulted in the compromise of “certain employee, customer and supplier information” at Australian Fluid Power. The Obscura ransomware gang claimed responsibility for the September 23 attack on Michigan City, Indiana, which forced many systems offline, disrupted employee access, and resulted in the theft and public release of 450 GB of data after the ransom deadline expired. The cyber attack on Mango, the global fashion retailer, caused compromise of one of its external marketing service providers, exposing customer contact information such as names, email addresses, phone numbers, postal codes, and countries. From the compromise of Motility Software Solutions and Envoy Air to the Discord data leak and F5’s BIG-IP vulnerability exploit, the month was marked by a mix of ransomware, supply chain, and data exposure incidents that shook both public and private sectors. If you want to know whether your organization's credentials are circulating, check whether your accounts have been compromised and monitor the dark web for credential dumps tied to your domain.

The Chinese state-sponsored hacking group tracked as Volt Typhoon for three years has maintained a highly structured network of compromised devices and rented infrastructure to conceal access to critical infrastructure and other strategic targets, said Michael Horka of Black Lotus Labs at Lumen. The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive after a nation-state-linked threat actor gained persistent access to F5 Networks’s systems, exfiltrating portions of the BIG-IP source code and undocumented vulnerability information, posing an “imminent threat” to U.S. federal networks. Qantas Airways confirmed that the stolen customer data from its July breach had been published online by the hacker collective Scattered Lapsus$ Hunters, including 2.8 million records with names, email addresses and Frequent Flyer numbers, and 1.7 million with additional details (such as home addresses, dates of birth, phone numbers, gender or meal preferences). A report said the hackers, identified as threat actor Storm‑2657, used phishing campaigns to compromise HR/payment systems at U.S. universities and divert employee salaries into attacker-controlled accounts. Jaguar Land Rover (JLR) initiated a phased restart of its manufacturing operations on October 7, 2025, following the massive cyberattack that halted global production since early September; the company also introduced a financing scheme to provide upfront payments to suppliers to mitigate financial difficulties caused by the shutdown.

• ShinyHunters claimed it compromised an Abbott employee’s Microsoft Entra single sign-on account through a voice-phishing attack in mid-June.
• HSIN connects federal, state, local, tribal, international, and private-sector organizations that exchange threat information and coordinate emergency responses.
• ShinyHunters claimed theft of more than10 million records and set a27 Apr, 2026 leak deadline, while Have I Been Pwned later measured the exposed dataset at5.5 million people.
• The group claimed it breached Charter around 1 Apr, 2026 through a vishing attack that compromised an employee Microsoft Entra account and opened access to Salesforce data.
• Have I Been Pwned later listed 185.3 thousand exposed accounts, including names, email addresses, physical addresses, dates of birth, and phone numbers.
• Klue confirmed a June 2026 supply chain breach after attackers used compromised legacy credentials to access its integration environment and obtain OAuth tokens connected to customer platforms.

Most importantly, shorten your containment window so a compromised device is locked in minutes. The largest recent one is the 2024 National Public Data leak, which put roughly 2.9 billion records, including Social Security numbers, into circulation, some of it stored in plain text. It is important that all members of the workforce receive ongoing security awareness training for two reasons. Why is it important that all members of the workforce receive ongoing security awareness training?

Company #175 Listed by N0n Ransomware Group

The cyber attack on Radiologic Medical Services (RMS) compromised the personal and health information of 56,902 individuals. The cyber attack on Prosper Marketplace exposed personal data—including names, Social Security numbers, and income details—of approximately 17.6 million users due to unauthorised access via compromised administrative credentials, posing significant identity theft risks. A cyber attack compromised Discord's third-party customer service provider, exposing sensitive information of an undisclosed https://www.familiesforexcellentschools.org/privacy-policy number of users who had interacted with Discord's Customer Support or Trust & Safety teams. Allianz Life Insurance Company confirmed that on July 16, 2025, cybercriminals accessed a third-party CRM system, exposing personal data such as names, addresses, dates of birth, and Social Security numbers of 1.49 million customers and employees. Two major data breaches in the insurance and automotive dealership sectors have compromised sensitive information of over 2.25 million individuals.

Quest Diagnostics Hacked – Attackers Accessed the System to Order Tests and View Results

ShinyHunters claimed it breached FBIJobs.gov and stole more than 2TB of information concerning current and former FBI employees and job applicants. The hackers breached Canvas, the company’s flagship learning management system, to steal private data and personal information of over 30 million students and staff. The U.S. Federal Bureau of Investigation was forced to declare a “major cyber incident” in April, prompting a legally required disclosure to Congress, after it found that one of its surveillance systems was compromised.

The U.S. federal government was breached, several times over

From huge stores of customers’ personal information getting scraped, stolen, and posted online, to reams of medical data covering most people in the United States getting stolen, the worst data breaches of 2024 have surpassed 1 billion stolen records and are rising. Researchers found that 28 commercial residential proxy services routed outside internet traffic through six White House IP addresses hundreds of times, raising concerns that proxy software on government-connected devices could expose internal systems to unauthorized access and lateral movement. As reported by MS Now reporter https://www.softcourier.com/72538/details-pcmate-free-privacy-cleaner.html Ken Dilanian over the weekend, the FBI has since declared a “cyber security incident” in an internal notification to staff, telling employees that their names, addresses, job titles, and their Social Security numbers were exposed. The Federal Bureau of Investigation has reportedly told its agents and support staff that their personal information was stolen in a recent cyberattack that targeted the bureau’s job application portal. U.S. officials are urging healthcare organizations and other critical infrastructure operators to strengthen cyber protections for internet-connected refrigeration systems amid a wave of attacks in Europe that have disrupted cold storage equipment, including systems used to preserve blood supplies.