{"type":"bundle","id":"bundle--forensicpost-case-files","objects":[{"type":"identity","spec_version":"2.1","id":"identity--forensicpost","name":"ForensicPost","identity_class":"organization"},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0817","created_by_ref":"identity--forensicpost","name":"26-0817 — Unisoc-based Android devices","description":"Not applicable via VoLTE modem firmware to kernel. Sector: Technology. Severity: Sev 4. Status: Open.","labels":["Technology","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0817"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0813","created_by_ref":"identity--forensicpost","name":"26-0813 — MyDr","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Open.","labels":["Healthcare","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0813"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0812","created_by_ref":"identity--forensicpost","name":"26-0812 — Defence, aerospace and aviation firms","description":"Lazarus Group via CVE-2026-68820 — Windows AFD.sys. Sector: Defence. Severity: Sev 5. Status: Closed.","labels":["Defence","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0812"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0811","created_by_ref":"identity--forensicpost","name":"26-0811 — Metabase deployments","description":"Unattributed via CVE-2026-72898. Sector: Technology. Severity: Sev 5. Status: Open.","labels":["Technology","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0811"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0810b","created_by_ref":"identity--forensicpost","name":"26-0810b — VMware vCenter operators","description":"Unattributed via CVE-2026-59310. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0810b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0810","created_by_ref":"identity--forensicpost","name":"26-0810 — Multiple critical infrastructure sectors","description":"Gunra via CVE-2024-55591, CVE-2025-24472. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0810"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0808","created_by_ref":"identity--forensicpost","name":"26-0808 — Polish combined heat and power plant","description":"Unattributed via Private APN pivot to OT. Sector: Energy. Severity: Sev 4. Status: Closed.","labels":["Energy","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0808"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0807b","created_by_ref":"identity--forensicpost","name":"26-0807b — Levi Strauss & Co.","description":"Unattributed via Social engineering. Sector: Retail. Severity: Sev 2. Status: Closed.","labels":["Retail","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0807b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0807","created_by_ref":"identity--forensicpost","name":"26-0807 — Bank of Baroda","description":"Unattributed via Compromised employee mailbox. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0807"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0806","created_by_ref":"identity--forensicpost","name":"26-0806 — Amgen","description":"Unattributed via Third-party cloud compromise. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0806"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0805","created_by_ref":"identity--forensicpost","name":"26-0805 — Unitel","description":"Unattributed via Not established. Sector: Telecom. Severity: Sev 5. Status: Closed.","labels":["Telecom","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0805"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0802b","created_by_ref":"identity--forensicpost","name":"26-0802b — Ministry of Justice, Colombia","description":"Unattributed via Not established. Sector: Government. Severity: Sev 4. Status: Closed.","labels":["Government","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0802b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0802","created_by_ref":"identity--forensicpost","name":"26-0802 — Not applicable","description":"Not applicable via Methodology. Sector: Multiple. Severity: Sev 1. Status: Open.","labels":["Multiple","Open","sev-1"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0802"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0731","created_by_ref":"identity--forensicpost","name":"26-0731 — Conduent Business Solutions","description":"SafePay via Ransomware. Sector: Healthcare. Severity: Sev 5. Status: Closed. Dwell: 84 days.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0731"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0730","created_by_ref":"identity--forensicpost","name":"26-0730 — Origin Energy","description":"Unattributed via Under review. Sector: Public sector. Severity: Sev 3. Status: Open.","labels":["Public sector","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0730"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0729","created_by_ref":"identity--forensicpost","name":"26-0729 — Water sector operators","description":"Unattributed via Guidance. Sector: Public sector. Severity: Sev 3. Status: Open.","labels":["Public sector","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0729"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0728","created_by_ref":"identity--forensicpost","name":"26-0728 — Critical infrastructure operators","description":"Unattributed via Guidance. Sector: Public sector. Severity: Sev 3. Status: Open.","labels":["Public sector","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0728"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0727","created_by_ref":"identity--forensicpost","name":"26-0727 — Minnesota water utilities","description":"Iran-affiliated (reported) via Internet-facing PLC. Sector: Public sector. Severity: Sev 5. Status: Open.","labels":["Public sector","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0727"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0726","created_by_ref":"identity--forensicpost","name":"26-0726 — AssuranceAmerica","description":"Unattributed via Under review. Sector: Insurance. Severity: Sev 4. Status: Open.","labels":["Insurance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0726"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0725","created_by_ref":"identity--forensicpost","name":"26-0725 — UK retail sector","description":"Scattered Spider via Enforcement action. Sector: Retail. Severity: Sev 3. Status: Open.","labels":["Retail","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0725"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0723","created_by_ref":"identity--forensicpost","name":"26-0723 — RevolutionParts","description":"Unattributed via Under review. Sector: Retail. Severity: Sev 3. Status: Open.","labels":["Retail","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0723"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0722","created_by_ref":"identity--forensicpost","name":"26-0722 — Cryptocurrency platforms","description":"DPRK-linked via Multiple. Sector: Finance. Severity: Sev 5. Status: Open.","labels":["Finance","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0722"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0721b","created_by_ref":"identity--forensicpost","name":"26-0721b — Unlimited Systems","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed. Dwell: 5 days.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0721b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0721","created_by_ref":"identity--forensicpost","name":"26-0721 — Hugging Face infrastructure","description":"Disputed via Registry → escalation. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0721"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0719","created_by_ref":"identity--forensicpost","name":"26-0719 — Enterprise organisations","description":"Insider via Negligence & credential theft. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0719"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0718","created_by_ref":"identity--forensicpost","name":"26-0718 — Salesforce tenants","description":"ShinyHunters via Multiple paths. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0718"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0717","created_by_ref":"identity--forensicpost","name":"26-0717 — AsyncAPI npm packages","description":"Unattributed via Import-time payload. Sector: Cloud. Severity: Sev 4. Status: Contained.","labels":["Cloud","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0717"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0716b","created_by_ref":"identity--forensicpost","name":"26-0716b — Transport for London","description":"Scattered Spider via Not applicable. Sector: Transport. Severity: Sev 2. Status: Closed.","labels":["Transport","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0716b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0716","created_by_ref":"identity--forensicpost","name":"26-0716 — Craneware","description":"Unattributed via Under review. Sector: Healthcare. Severity: Sev 3. Status: Open.","labels":["Healthcare","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0716"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0715b","created_by_ref":"identity--forensicpost","name":"26-0715b — TruStage","description":"Unattributed via Not established. Sector: Insurance. Severity: Sev 4. Status: Open.","labels":["Insurance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0715b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0715","created_by_ref":"identity--forensicpost","name":"26-0715 — Telecom carriers, multiple","description":"Salt Typhoon via Edge & network devices. Sector: Telecom. Severity: Sev 5. Status: Open.","labels":["Telecom","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0715"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0714b","created_by_ref":"identity--forensicpost","name":"26-0714b — On-premises SharePoint operators","description":"Unattributed via Remote code execution. Sector: Technology. Severity: Sev 5. Status: Open.","labels":["Technology","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0714b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0714","created_by_ref":"identity--forensicpost","name":"26-0714 — Abbott Laboratories","description":"ShinyHunters via Vishing → SSO (claimed). Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0714"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0713","created_by_ref":"identity--forensicpost","name":"26-0713 — Ernst & Young","description":"Unattributed via Third-party platform. Sector: Finance. Severity: Sev 3. Status: Contained. Dwell: 15 days.","labels":["Finance","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0713"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0712","created_by_ref":"identity--forensicpost","name":"26-0712 — Corporate payment processes","description":"Multiple via BEC with synthetic media. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0712"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0711","created_by_ref":"identity--forensicpost","name":"26-0711 — jscrambler npm package","description":"Unattributed via Install-time binary. Sector: Cloud. Severity: Sev 4. Status: Contained.","labels":["Cloud","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0711"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0707","created_by_ref":"identity--forensicpost","name":"26-0707 — Dysphoria botnet","description":"Unattributed via Ledger-based C2. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0707"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0705","created_by_ref":"identity--forensicpost","name":"26-0705 — Check Point VPN appliances","description":"Qilin affiliates via Authentication bypass. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0705"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0704","created_by_ref":"identity--forensicpost","name":"26-0704 — Shared airport IT platforms","description":"Multiple via Concentration risk. Sector: Logistics. Severity: Sev 4. Status: Open.","labels":["Logistics","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0704"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0703","created_by_ref":"identity--forensicpost","name":"26-0703 — Enterprise remote access","description":"Multiple via Legacy VPN. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0703"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0702","created_by_ref":"identity--forensicpost","name":"26-0702 — Qantas","description":"Scattered Lapsus$ Hunters via Third-party platform. Sector: Retail. Severity: Sev 4. Status: Open.","labels":["Retail","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0702"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0701","created_by_ref":"identity--forensicpost","name":"26-0701 — DHS information-sharing environment","description":"Unattributed via Unpatched vulnerability. Sector: Public sector. Severity: Sev 4. Status: Open. Dwell: 21 days.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0701"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0630","created_by_ref":"identity--forensicpost","name":"26-0630 — Enterprise networks, multiple","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0630"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0628","created_by_ref":"identity--forensicpost","name":"26-0628 — Texas Parks and Wildlife","description":"Unattributed via Third-party vendor. Sector: Public sector. Severity: Sev 3. Status: Contained.","labels":["Public sector","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0628"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0627","created_by_ref":"identity--forensicpost","name":"26-0627 — Logistics operators","description":"Multiple via Various. Sector: Logistics. Severity: Sev 4. Status: Open.","labels":["Logistics","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0627"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0626","created_by_ref":"identity--forensicpost","name":"26-0626 — Lumma Stealer infrastructure","description":"Unattributed via Infostealer. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0626"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0625","created_by_ref":"identity--forensicpost","name":"26-0625 — Multiple organisations","description":"Scattered Lapsus$ Hunters via Social engineering. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0625"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0624","created_by_ref":"identity--forensicpost","name":"26-0624 — Amadey, StealC, SocGholish infrastructure","description":"Multiple via Enforcement action. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0624"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0623","created_by_ref":"identity--forensicpost","name":"26-0623 — KDDI and five other ISPs","description":"Unattributed via Third-party software. Sector: Telecom. Severity: Sev 3. Status: Contained.","labels":["Telecom","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0623"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0622","created_by_ref":"identity--forensicpost","name":"26-0622 — Tata Electronics","description":"World Leaks via Ransomware. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0622"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0620","created_by_ref":"identity--forensicpost","name":"26-0620 — Estée Lauder","description":"Unattributed via Oracle EBS flaw. Sector: Retail. Severity: Sev 3. Status: Contained. Dwell: 304 days.","labels":["Retail","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0620"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0619","created_by_ref":"identity--forensicpost","name":"26-0619 — Google (corporate CRM)","description":"UNC6040 via Vishing → OAuth consent. Sector: Cloud. Severity: Sev 2. Status: Closed.","labels":["Cloud","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0619"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0617","created_by_ref":"identity--forensicpost","name":"26-0617 — iRhythm","description":"Extortion actor, unnamed via Third-party application. Sector: Healthcare. Severity: Sev 3. Status: Contained.","labels":["Healthcare","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0617"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0616","created_by_ref":"identity--forensicpost","name":"26-0616 — Kodak","description":"ShinyHunters via Unauthorised access. Sector: Manufacturing. Severity: Sev 3. Status: Open.","labels":["Manufacturing","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0616"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0615","created_by_ref":"identity--forensicpost","name":"26-0615 — Exposed Elasticsearch instance","description":"Exposure via Misconfiguration. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0615"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0614","created_by_ref":"identity--forensicpost","name":"26-0614 — AudiA6 laundering service","description":"Multiple via Enforcement action. Sector: Finance. Severity: Sev 3. Status: Closed.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0614"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0613","created_by_ref":"identity--forensicpost","name":"26-0613 — Amazon One Medical","description":"ShinyHunters via Legacy archive access. Sector: Healthcare. Severity: Sev 4. Status: Open. Dwell: 3 days.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0613"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0612b","created_by_ref":"identity--forensicpost","name":"26-0612b — Mount Royal University","description":"CMD Organization via Ransomware. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0612b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0612","created_by_ref":"identity--forensicpost","name":"26-0612 — DentaQuest","description":"ShinyHunters via Credential compromise. Sector: Healthcare. Severity: Sev 4. Status: Closed. Dwell: 30 days.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0612"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0611","created_by_ref":"identity--forensicpost","name":"26-0611 — Klue","description":"Unattributed via OAuth token theft. Sector: Cloud. Severity: Sev 4. Status: Contained.","labels":["Cloud","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0611"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0610","created_by_ref":"identity--forensicpost","name":"26-0610 — Allianz Life","description":"ShinyHunters via Social engineering. Sector: Insurance. Severity: Sev 4. Status: Contained.","labels":["Insurance","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0610"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0609","created_by_ref":"identity--forensicpost","name":"26-0609 — ServiceNow","description":"Unattributed via Unauthenticated API. Sector: Cloud. Severity: Sev 3. Status: Contained.","labels":["Cloud","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0609"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0608","created_by_ref":"identity--forensicpost","name":"26-0608 — Chick-fil-A","description":"Unattributed via Credential stuffing. Sector: Retail. Severity: Sev 3. Status: Contained.","labels":["Retail","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0608"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0607b","created_by_ref":"identity--forensicpost","name":"26-0607b — Evanston Township High School","description":"Unattributed via Ransomware. Sector: Education. Severity: Sev 3. Status: Closed.","labels":["Education","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0607b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0607","created_by_ref":"identity--forensicpost","name":"26-0607 — Salesforce tenants","description":"UNC6040 via Vishing → OAuth consent. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0607"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0606","created_by_ref":"identity--forensicpost","name":"26-0606 — Red Hat-associated npm packages","description":"Unattributed via Package compromise. Sector: Cloud. Severity: Sev 4. Status: Contained.","labels":["Cloud","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0606"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0604","created_by_ref":"identity--forensicpost","name":"26-0604 — Suno","description":"Unattributed via Source code breach. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0604"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0603","created_by_ref":"identity--forensicpost","name":"26-0603 — Cyber insurance market","description":"Multiple via Ransomware. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0603"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0602","created_by_ref":"identity--forensicpost","name":"26-0602 — FortiGate firewalls","description":"Unattributed via Credential compromise. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0602"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0601","created_by_ref":"identity--forensicpost","name":"26-0601 — US critical infrastructure","description":"Volt Typhoon via Living off the land. Sector: Public sector. Severity: Sev 5. Status: Open.","labels":["Public sector","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0601"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0531","created_by_ref":"identity--forensicpost","name":"26-0531 — Multi-agent deployments","description":"Research via Prompt injection chain. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0531"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0530","created_by_ref":"identity--forensicpost","name":"26-0530 — Udemy","description":"ShinyHunters via Under review. Sector: Education. Severity: Sev 3. Status: Contained.","labels":["Education","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0530"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0529","created_by_ref":"identity--forensicpost","name":"26-0529 — Telecommunications carriers","description":"Multiple via Volumetric DDoS. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0529"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0528","created_by_ref":"identity--forensicpost","name":"26-0528 — Asocks proxy network","description":"Unattributed via Enforcement action. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0528"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0527","created_by_ref":"identity--forensicpost","name":"26-0527 — Carnival Corporation","description":"Unattributed via Phishing → account. Sector: Retail. Severity: Sev 4. Status: Contained. Dwell: 12 days.","labels":["Retail","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0527"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0526","created_by_ref":"identity--forensicpost","name":"26-0526 — Charter Communications","description":"ShinyHunters via Vishing → Entra. Sector: Telecom. Severity: Sev 4. Status: Contained. Dwell: 55 days.","labels":["Telecom","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0526"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0524","created_by_ref":"identity--forensicpost","name":"26-0524 — Vulnerability disclosure ecosystem","description":"Unattributed via Volume growth. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0524"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0523","created_by_ref":"identity--forensicpost","name":"26-0523 — Enterprise AI agent deployments","description":"Multiple via Various. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0523"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0522","created_by_ref":"identity--forensicpost","name":"26-0522 — First VPN service","description":"Multiple via Enforcement action. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0522"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0520","created_by_ref":"identity--forensicpost","name":"26-0520 — npm ecosystem","description":"Unattributed via Install-time execution. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0520"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0519","created_by_ref":"identity--forensicpost","name":"26-0519 — Legal document estates","description":"Multiple via Targeted access. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0519"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0518","created_by_ref":"identity--forensicpost","name":"26-0518 — University of Nottingham","description":"ShinyHunters via System compromise. Sector: Education. Severity: Sev 3. Status: Contained.","labels":["Education","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0518"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0517","created_by_ref":"identity--forensicpost","name":"26-0517 — Tchap (French government)","description":"misere via Account hijacking. Sector: Public sector. Severity: Sev 3. Status: Contained.","labels":["Public sector","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0517"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0516","created_by_ref":"identity--forensicpost","name":"26-0516 — Idaho State University","description":"ShinyHunters via Vendor incident. Sector: Education. Severity: Sev 3. Status: Closed.","labels":["Education","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0516"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0515","created_by_ref":"identity--forensicpost","name":"26-0515 — Vacation Myrtle Beach","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed. Dwell: 365 days.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0515"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0514","created_by_ref":"identity--forensicpost","name":"26-0514 — Global cryptographic estate","description":"Unattributed via Standards migration. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0514"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0513","created_by_ref":"identity--forensicpost","name":"26-0513 — Delano Public Schools","description":"LockBit via Ransomware. Sector: Education. Severity: Sev 3. Status: Closed.","labels":["Education","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0513"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0512","created_by_ref":"identity--forensicpost","name":"26-0512 — Foxconn","description":"Nitrogen via Ransomware. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0512"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0511","created_by_ref":"identity--forensicpost","name":"26-0511 — Cyber insurance claimants","description":"Multiple via Various. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0511"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0510","created_by_ref":"identity--forensicpost","name":"26-0510 — Reported fraud, US","description":"Multiple via Various. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0510"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0509","created_by_ref":"identity--forensicpost","name":"26-0509 — Agentic AI deployments","description":"Multiple via Prompt injection. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0509"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0507","created_by_ref":"identity--forensicpost","name":"26-0507 — West Pharmaceutical Services","description":"Unattributed via Ransomware. Sector: Manufacturing. Severity: Sev 4. Status: Contained.","labels":["Manufacturing","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0507"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0506","created_by_ref":"identity--forensicpost","name":"26-0506 — Enterprise patch management","description":"Multiple via Rapid exploitation. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0506"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0505","created_by_ref":"identity--forensicpost","name":"26-0505 — Mediaworks Hungary","description":"Unattributed via Intrusion. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0505"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0504","created_by_ref":"identity--forensicpost","name":"26-0504 — Trellix","description":"RansomHouse via Repository access. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0504"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0503","created_by_ref":"identity--forensicpost","name":"26-0503 — Medtronic","description":"ShinyHunters via Not established. Sector: Healthcare. Severity: Sev 3. Status: Open.","labels":["Healthcare","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0503"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0502","created_by_ref":"identity--forensicpost","name":"26-0502 — Kochava","description":"None — commercial sale via Data brokerage. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0502"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0501","created_by_ref":"identity--forensicpost","name":"26-0501 — Instructure — Canvas","description":"ShinyHunters via Service weakness. Sector: Education. Severity: Sev 5. Status: Closed. Dwell: 16 days.","labels":["Education","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0501"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0429","created_by_ref":"identity--forensicpost","name":"26-0429 — SaaS tenants, multiple","description":"ShinyHunters via Device code phishing. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0429"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0428","created_by_ref":"identity--forensicpost","name":"26-0428 — Anthropic","description":"Internal error via Misconfigured publication. Sector: Cloud. Severity: Sev 2. Status: Closed.","labels":["Cloud","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0428"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0427","created_by_ref":"identity--forensicpost","name":"26-0427 — Public-key cryptography estate","description":"Unattributed via Standards migration. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0427"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0426","created_by_ref":"identity--forensicpost","name":"26-0426 — Healthcare sector suppliers","description":"Multiple via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0426"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0425","created_by_ref":"identity--forensicpost","name":"26-0425 — ADT","description":"ShinyHunters via Under review. Sector: Retail. Severity: Sev 3. Status: Contained.","labels":["Retail","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0425"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0424","created_by_ref":"identity--forensicpost","name":"26-0424 — Adidas, Pandora, LVMH houses","description":"ShinyHunters via Social engineering → CRM. Sector: Retail. Severity: Sev 3. Status: Contained.","labels":["Retail","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0424"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0423","created_by_ref":"identity--forensicpost","name":"26-0423 — 7-Eleven","description":"ShinyHunters via Salesforce misconfiguration. Sector: Retail. Severity: Sev 3. Status: Contained.","labels":["Retail","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0423"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0422","created_by_ref":"identity--forensicpost","name":"26-0422 — Privileged communications","description":"Multiple via Various. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0422"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0421","created_by_ref":"identity--forensicpost","name":"26-0421 — Corporate finance functions","description":"Multiple via Voice cloning. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0421"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0420","created_by_ref":"identity--forensicpost","name":"26-0420 — France Titres (ANTS)","description":"Single operator via Portal compromise. Sector: Public sector. Severity: Sev 4. Status: Closed. Dwell: 3 days.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0420"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0419","created_by_ref":"identity--forensicpost","name":"26-0419 — US breach notification regime","description":"Unattributed via Regulatory. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0419"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0417","created_by_ref":"identity--forensicpost","name":"26-0417 — Kelp DAO","description":"DPRK-linked via Protocol exploit. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0417"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0416","created_by_ref":"identity--forensicpost","name":"26-0416 — Insured organisations","description":"Unattributed via Coverage dispute. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0416"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0415","created_by_ref":"identity--forensicpost","name":"26-0415 — Incident severity classification","description":"Unattributed via Methodology. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0415"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0414","created_by_ref":"identity--forensicpost","name":"26-0414 — McGraw Hill","description":"ShinyHunters via Misconfiguration. Sector: Education. Severity: Sev 3. Status: Contained.","labels":["Education","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0414"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0413","created_by_ref":"identity--forensicpost","name":"26-0413 — Outsourced IT service desks","description":"Scattered Spider via Help-desk social engineering. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0413"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0412","created_by_ref":"identity--forensicpost","name":"26-0412 — Vulnerability management pipeline","description":"Unattributed via Process change. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0412"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0411","created_by_ref":"identity--forensicpost","name":"26-0411 — Marks & Spencer and Co-op","description":"Scattered Spider via Help-desk social engineering. Sector: Retail. Severity: Sev 5. Status: Closed.","labels":["Retail","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0411"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0410","created_by_ref":"identity--forensicpost","name":"26-0410 — Open-source maintainers","description":"Research consortium via Disclosure volume. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0410"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0409","created_by_ref":"identity--forensicpost","name":"26-0409 — European Commission web properties","description":"Unattributed via Cloud infrastructure flaw. Sector: Public sector. Severity: Sev 2. Status: Closed.","labels":["Public sector","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0409"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0408","created_by_ref":"identity--forensicpost","name":"26-0408 — SAP-related npm packages","description":"Unattributed via Package compromise. Sector: Cloud. Severity: Sev 3. Status: Contained.","labels":["Cloud","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0408"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0407","created_by_ref":"identity--forensicpost","name":"26-0407 — Signature Healthcare (Brockton)","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Contained.","labels":["Healthcare","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0407"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0406","created_by_ref":"identity--forensicpost","name":"26-0406 — European airport passenger systems","description":"Unattributed via Shared platform compromise. Sector: Logistics. Severity: Sev 4. Status: Closed.","labels":["Logistics","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0406"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0405","created_by_ref":"identity--forensicpost","name":"26-0405 — National Vulnerability Database","description":"Unattributed via Process capacity. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0405"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0404","created_by_ref":"identity--forensicpost","name":"26-0404 — Open-source software estate","description":"Research consortium via Autonomous discovery. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0404"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0403","created_by_ref":"identity--forensicpost","name":"26-0403 — US public companies","description":"Unattributed via Disclosure regime. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0403"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0331","created_by_ref":"identity--forensicpost","name":"26-0331 — Cisco","description":"Unattributed via Stolen scanner credentials. Sector: Cloud. Severity: Sev 4. Status: Contained.","labels":["Cloud","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0331"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0330","created_by_ref":"identity--forensicpost","name":"26-0330 — State and local government","description":"Multiple via Ransomware. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0330"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0329","created_by_ref":"identity--forensicpost","name":"26-0329 — Vulnerability tooling","description":"Unattributed via Data classification. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0329"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0328","created_by_ref":"identity--forensicpost","name":"26-0328 — Long-lived open-source code","description":"Research consortium via Autonomous discovery. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0328"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0327","created_by_ref":"identity--forensicpost","name":"26-0327 — Air France-KLM","description":"Unattributed via Third-party platform. Sector: Logistics. Severity: Sev 3. Status: Contained.","labels":["Logistics","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0327"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0326","created_by_ref":"identity--forensicpost","name":"26-0326 — London Hydro","description":"Unattributed via System breach. Sector: Public sector. Severity: Sev 3. Status: Contained.","labels":["Public sector","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0326"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0325","created_by_ref":"identity--forensicpost","name":"26-0325 — Global botnet ecosystem","description":"Multiple via IoT compromise. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0325"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0324","created_by_ref":"identity--forensicpost","name":"26-0324 — NYC Health + Hospitals","description":"Unattributed via Network intrusion. Sector: Healthcare. Severity: Sev 4. Status: Contained. Dwell: 96 days.","labels":["Healthcare","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0324"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0323","created_by_ref":"identity--forensicpost","name":"26-0323 — Disclosure governance","description":"Unattributed via Process. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0323"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0322","created_by_ref":"identity--forensicpost","name":"26-0322 — Adobe (alleged)","description":"Mr. Raccoon via BPO vendor phishing. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0322"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0321","created_by_ref":"identity--forensicpost","name":"26-0321 — Open-source maintenance","description":"Unattributed via Funding structure. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0321"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0320","created_by_ref":"identity--forensicpost","name":"26-0320 — Network origin controls","description":"Multiple via Residential proxy. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0320"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0318","created_by_ref":"identity--forensicpost","name":"26-0318 — Fleet and telematics platforms","description":"Multiple via Various. Sector: Logistics. Severity: Sev 3. Status: Open.","labels":["Logistics","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0318"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0316","created_by_ref":"identity--forensicpost","name":"26-0316 — Production database","description":"Agent action via Delegated write access. Sector: Cloud. Severity: Sev 3. Status: Closed.","labels":["Cloud","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0316"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0315","created_by_ref":"identity--forensicpost","name":"26-0315 — Vulnerability research capability","description":"Multiple via Dual use. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0315"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0314","created_by_ref":"identity--forensicpost","name":"26-0314 — Salesforce Experience Cloud tenants","description":"ShinyHunters via Portal misconfiguration. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0314"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0313","created_by_ref":"identity--forensicpost","name":"26-0313 — Law firm client portals","description":"Multiple via Weak authentication. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0313"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0311","created_by_ref":"identity--forensicpost","name":"26-0311 — Edge VPN and firewall appliances","description":"Multiple via Appliance exploitation. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0311"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0310","created_by_ref":"identity--forensicpost","name":"26-0310 — Foster City, California","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0310"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0309","created_by_ref":"identity--forensicpost","name":"26-0309 — Law firms","description":"Multiple via Various. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0309"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0307","created_by_ref":"identity--forensicpost","name":"26-0307 — Disclosure ecosystem","description":"Unattributed via Coordination failure. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0307"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0306","created_by_ref":"identity--forensicpost","name":"26-0306 — Consumer location data","description":"None — inference via Data aggregation. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0306"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0305","created_by_ref":"identity--forensicpost","name":"26-0305 — Education sector","description":"Multiple via Various. Sector: Education. Severity: Sev 4. Status: Open.","labels":["Education","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0305"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0304","created_by_ref":"identity--forensicpost","name":"26-0304 — US healthcare providers","description":"Multiple via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0304"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0303","created_by_ref":"identity--forensicpost","name":"26-0303 — Financial services AI agent","description":"Unattributed via Prompt injection. Sector: Finance. Severity: Sev 3. Status: Contained. Dwell: 21 days.","labels":["Finance","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0303"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0302","created_by_ref":"identity--forensicpost","name":"26-0302 — Consumer IoT device estate","description":"Multiple via Enforcement action. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0302"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0301","created_by_ref":"identity--forensicpost","name":"26-0301 — Education institutions","description":"Multiple via Ransomware. Sector: Education. Severity: Sev 4. Status: Open.","labels":["Education","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0301"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0228","created_by_ref":"identity--forensicpost","name":"26-0228 — K-12 school districts","description":"Multiple via Third-party vendor. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0228"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0227","created_by_ref":"identity--forensicpost","name":"26-0227 — youX","description":"Unattributed via Under review. Sector: Finance. Severity: Sev 4. Status: Contained.","labels":["Finance","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0227"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0226","created_by_ref":"identity--forensicpost","name":"26-0226 — Enterprise AI assistants","description":"Multiple via Various. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0226"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0225","created_by_ref":"identity--forensicpost","name":"26-0225 — Water utility (Mexico)","description":"Unattributed via AI-assisted recon. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0225"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0224","created_by_ref":"identity--forensicpost","name":"26-0224 — Figure Technology Solutions","description":"ShinyHunters via Employee social engineering. Sector: Finance. Severity: Sev 4. Status: Contained.","labels":["Finance","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0224"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0223","created_by_ref":"identity--forensicpost","name":"26-0223 — Cyber insurance market","description":"Unattributed via Market pricing. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0223"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0222","created_by_ref":"identity--forensicpost","name":"26-0222 — Kopran Ltd","description":"DragonForce via Ransomware. Sector: Manufacturing. Severity: Sev 3. Status: Open.","labels":["Manufacturing","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0222"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0220","created_by_ref":"identity--forensicpost","name":"26-0220 — Attribution practice","description":"Multiple via Methodology. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0220"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0219","created_by_ref":"identity--forensicpost","name":"26-0219 — IDMerit","description":"Exposure via Unsecured database. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0219"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0218","created_by_ref":"identity--forensicpost","name":"26-0218 — Hospital Caribbean Medical Center","description":"The Gentlemen via Ransomware. Sector: Healthcare. Severity: Sev 3. Status: Closed.","labels":["Healthcare","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0218"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0217","created_by_ref":"identity--forensicpost","name":"26-0217 — Senegal national ID system","description":"Green Blood via Server compromise. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0217"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0216","created_by_ref":"identity--forensicpost","name":"26-0216 — Foundational open-source components","description":"Unattributed via Governance gap. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0216"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0215","created_by_ref":"identity--forensicpost","name":"26-0215 — National Diplomatic Academy (KR)","description":"Unattributed via Under review. Sector: Public sector. Severity: Sev 3. Status: Contained. Dwell: 300 days.","labels":["Public sector","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0215"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0214","created_by_ref":"identity--forensicpost","name":"26-0214 — UFP Technologies","description":"Payouts King via Ransomware. Sector: Manufacturing. Severity: Sev 3. Status: Contained.","labels":["Manufacturing","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0214"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0213","created_by_ref":"identity--forensicpost","name":"26-0213 — Washington Hotel chain (JP)","description":"Unattributed via Ransomware. Sector: Retail. Severity: Sev 2. Status: Closed.","labels":["Retail","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0213"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0212","created_by_ref":"identity--forensicpost","name":"26-0212 — Odido","description":"Unattributed via Under review. Sector: Telecom. Severity: Sev 4. Status: Contained.","labels":["Telecom","Contained","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0212"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0211","created_by_ref":"identity--forensicpost","name":"26-0211 — Volvo Group North America","description":"SafePay via Supplier intrusion. Sector: Manufacturing. Severity: Sev 3. Status: Closed.","labels":["Manufacturing","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0211"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0210","created_by_ref":"identity--forensicpost","name":"26-0210 — Nippon Medical School Musashi Kosugi","description":"NetRunner via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0210"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0209","created_by_ref":"identity--forensicpost","name":"26-0209 — BridgePay / Bryan Texas Utilities","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 2. Status: Closed.","labels":["Public sector","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0209"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0208","created_by_ref":"identity--forensicpost","name":"26-0208 — Coinbase","description":"Insider — contractor via Improper access. Sector: Finance. Severity: Sev 2. Status: Closed.","labels":["Finance","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0208"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0207","created_by_ref":"identity--forensicpost","name":"26-0207 — US data broker market","description":"Unattributed via Regulatory. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0207"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0206","created_by_ref":"identity--forensicpost","name":"26-0206 — European Commission","description":"Unattributed via Ivanti EPMM. Sector: Public sector. Severity: Sev 2. Status: Closed. Dwell: 1 days.","labels":["Public sector","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0206"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0205","created_by_ref":"identity--forensicpost","name":"26-0205 — Account recovery infrastructure","description":"Multiple via Number portability abuse. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0205"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0204","created_by_ref":"identity--forensicpost","name":"26-0204 — Harrods","description":"Scattered Spider via Not disclosed. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0204"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0203","created_by_ref":"identity--forensicpost","name":"26-0203 — PayPal Working Capital","description":"Unattributed via Account compromise. Sector: Finance. Severity: Sev 3. Status: Contained. Dwell: 164 days.","labels":["Finance","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0203"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0202","created_by_ref":"identity--forensicpost","name":"26-0202 — Panera Bread","description":"ShinyHunters via System compromise. Sector: Retail. Severity: Sev 2. Status: Contained.","labels":["Retail","Contained","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0202"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0201","created_by_ref":"identity--forensicpost","name":"26-0201 — Chanel","description":"Unattributed via Third-party platform. Sector: Retail. Severity: Sev 3. Status: Contained.","labels":["Retail","Contained","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0201"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0131","created_by_ref":"identity--forensicpost","name":"26-0131 — Municipal emergency systems","description":"Multiple via Ransomware. Sector: Public sector. Severity: Sev 3. Status: Open.","labels":["Public sector","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0131"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0130","created_by_ref":"identity--forensicpost","name":"26-0130 — Government, defence and aid bodies","description":"Pawn Storm via Office zero-day. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0130"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0128","created_by_ref":"identity--forensicpost","name":"26-0128 — NetScaler appliances","description":"Multiple via Memory disclosure. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0128"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0127","created_by_ref":"identity--forensicpost","name":"26-0127 — Credit union technology provider","description":"Unattributed via Ransomware. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0127"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0126","created_by_ref":"identity--forensicpost","name":"26-0126 — New Britain, Connecticut","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 3. Status: Closed.","labels":["Public sector","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0126"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0124","created_by_ref":"identity--forensicpost","name":"26-0124 — Digital-only financial services","description":"Unattributed via Continuity gap. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0124"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0123","created_by_ref":"identity--forensicpost","name":"26-0123 — Vietnam Airlines","description":"Unattributed via Third-party platform. Sector: Logistics. Severity: Sev 3. Status: Open.","labels":["Logistics","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0123"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0122","created_by_ref":"identity--forensicpost","name":"26-0122 — Canada Computers","description":"Unattributed via Payment page compromise. Sector: Retail. Severity: Sev 3. Status: Closed. Dwell: 25 days.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0122"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0121","created_by_ref":"identity--forensicpost","name":"26-0121 — Automotive manufacturers","description":"Multiple via Various. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0121"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0120","created_by_ref":"identity--forensicpost","name":"26-0120 — Mobile subscribers","description":"Multiple via SIM swap. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0120"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0119","created_by_ref":"identity--forensicpost","name":"26-0119 — Jaguar Land Rover","description":"Unattributed via Not established. Sector: Manufacturing. Severity: Sev 5. Status: Closed.","labels":["Manufacturing","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0119"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0113","created_by_ref":"identity--forensicpost","name":"26-0113 — PowerSchool","description":"Unattributed via Portal without MFA. Sector: Education. Severity: Sev 5. Status: Closed.","labels":["Education","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0113"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0112","created_by_ref":"identity--forensicpost","name":"26-0112 — Chime","description":"Team 313 via Service disruption. Sector: Finance. Severity: Sev 3. Status: Closed.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0112"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0111","created_by_ref":"identity--forensicpost","name":"26-0111 — Consumers in broker datasets","description":"None — commercial via Data aggregation. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0111"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0110","created_by_ref":"identity--forensicpost","name":"26-0110 — Consumer connected devices","description":"Multiple via Unpatched firmware. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0110"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0109","created_by_ref":"identity--forensicpost","name":"26-0109 — Open-source ecosystem","description":"Unattributed via Funding structure. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0109"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0107","created_by_ref":"identity--forensicpost","name":"26-0107 — Aviation and aerospace sector","description":"Multiple via Various. Sector: Logistics. Severity: Sev 4. Status: Open.","labels":["Logistics","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0107"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0106","created_by_ref":"identity--forensicpost","name":"26-0106 — Encrypted traffic in transit","description":"Multiple nation-states via Bulk collection. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0106"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0105","created_by_ref":"identity--forensicpost","name":"26-0105 — Wireless carriers","description":"Unattributed via Regulatory. Sector: Telecom. Severity: Sev 3. Status: Open.","labels":["Telecom","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0105"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0104","created_by_ref":"identity--forensicpost","name":"26-0104 — Healthcare technology estate","description":"Multiple via Unpatched dependencies. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0104"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-26-0102","created_by_ref":"identity--forensicpost","name":"26-0102 — Supplier security obligations","description":"Unattributed via Litigation. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"26-0102"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1231b","created_by_ref":"identity--forensicpost","name":"25-1231b — Breach measurement","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1231b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1231","created_by_ref":"identity--forensicpost","name":"25-1231 — Extortion negotiation","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1231"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1230b","created_by_ref":"identity--forensicpost","name":"25-1230b — Australian organisations","description":"Multiple and none via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1230b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1230","created_by_ref":"identity--forensicpost","name":"25-1230 — Ransomware measurement","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1230"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1229b","created_by_ref":"identity--forensicpost","name":"25-1229b — Australian organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1229b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1229","created_by_ref":"identity--forensicpost","name":"25-1229 — Polish power grid","description":"Unattributed via Not established. Sector: Utilities. Severity: Sev 4. Status: Open.","labels":["Utilities","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1229"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1228b","created_by_ref":"identity--forensicpost","name":"25-1228b — ManageMyHealth","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Open.","labels":["Healthcare","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1228b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1228","created_by_ref":"identity--forensicpost","name":"25-1228 — Breached organisations","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1228"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1227b","created_by_ref":"identity--forensicpost","name":"25-1227b — Breach measurement","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1227b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1227","created_by_ref":"identity--forensicpost","name":"25-1227 — Affected individuals","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1227"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1226b","created_by_ref":"identity--forensicpost","name":"25-1226b — Containment measurement","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1226b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1226","created_by_ref":"identity--forensicpost","name":"25-1226 — Ransomware ecosystem","description":"Multiple via Ransomware-as-a-service. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1226"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1225b","created_by_ref":"identity--forensicpost","name":"25-1225b — This database","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1225b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1225","created_by_ref":"identity--forensicpost","name":"25-1225 — This database","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1225"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1224b","created_by_ref":"identity--forensicpost","name":"25-1224b — Detection capability","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open. Dwell: 9 days.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1224b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1224","created_by_ref":"identity--forensicpost","name":"25-1224 — AI agent deployments","description":"Multiple via Prompt injection. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1224"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1223b","created_by_ref":"identity--forensicpost","name":"25-1223b — Dwell time measurement","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1223b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1223","created_by_ref":"identity--forensicpost","name":"25-1223 — Regulatory coverage","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1223"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1222b","created_by_ref":"identity--forensicpost","name":"25-1222b — Healthcare sector","description":"Multiple via Various. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1222b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1222","created_by_ref":"identity--forensicpost","name":"25-1222 — Ransomware ecosystem","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1222"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1221","created_by_ref":"identity--forensicpost","name":"25-1221 — Corpus findings","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1221"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1220c","created_by_ref":"identity--forensicpost","name":"25-1220c — UK public services","description":"Multiple via Various. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1220c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1220b","created_by_ref":"identity--forensicpost","name":"25-1220b — Healthcare sector","description":"Multiple via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1220b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1220","created_by_ref":"identity--forensicpost","name":"25-1220 — Breached organisations","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1220"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1219b","created_by_ref":"identity--forensicpost","name":"25-1219b — Supplier concentration","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1219b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1219","created_by_ref":"identity--forensicpost","name":"25-1219 — Breach harm evidence","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1219"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1218c","created_by_ref":"identity--forensicpost","name":"25-1218c — Incident record formation","description":"Not applicable via Not applicable. Sector: Healthcare. Severity: Sev 2. Status: Open.","labels":["Healthcare","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1218c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1218b","created_by_ref":"identity--forensicpost","name":"25-1218b — Ransomware measurement","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1218b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1218","created_by_ref":"identity--forensicpost","name":"25-1218 — National populations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1218"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1217b","created_by_ref":"identity--forensicpost","name":"25-1217b — Ransomware victims","description":"Multiple via Data extortion. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1217b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1217","created_by_ref":"identity--forensicpost","name":"25-1217 — Latin American government bodies","description":"Multiple via Various. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1217"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1216b","created_by_ref":"identity--forensicpost","name":"25-1216b — Ransomware defence","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1216b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1216","created_by_ref":"identity--forensicpost","name":"25-1216 — Enterprise software estates","description":"Multiple via Various. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1216"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1215b","created_by_ref":"identity--forensicpost","name":"25-1215b — US healthcare providers","description":"Multiple via Ransomware-as-a-service. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1215b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1215","created_by_ref":"identity--forensicpost","name":"25-1215 — Cross-border suppliers","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1215"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1214b","created_by_ref":"identity--forensicpost","name":"25-1214b — DXS International","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1214b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1214","created_by_ref":"identity--forensicpost","name":"25-1214 — Global breach measurement","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1214"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1213","created_by_ref":"identity--forensicpost","name":"25-1213 — Southeast Asian organisations","description":"Chinese state-linked actors via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1213"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1212","created_by_ref":"identity--forensicpost","name":"25-1212 — French Interior Ministry","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1212"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1211b","created_by_ref":"identity--forensicpost","name":"25-1211b — Medical organisations","description":"Multiple via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1211b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1211","created_by_ref":"identity--forensicpost","name":"25-1211 — Security workforce","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1211"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1210b","created_by_ref":"identity--forensicpost","name":"25-1210b — Ransomware measurement","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1210b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1210","created_by_ref":"identity--forensicpost","name":"25-1210 — Digital asset platforms","description":"Multiple via Various. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1210"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1209","created_by_ref":"identity--forensicpost","name":"25-1209 — Security workforce","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1209"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1208","created_by_ref":"identity--forensicpost","name":"25-1208 — Princeton; Harvard","description":"Unattributed via Voice phishing. Sector: Education. Severity: Sev 4. Status: Closed. Dwell: 1 days.","labels":["Education","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1208"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1207","created_by_ref":"identity--forensicpost","name":"25-1207 — SaaS authorisations","description":"Multiple via Durable credentials. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1207"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1206","created_by_ref":"identity--forensicpost","name":"25-1206 — Asia-Pacific organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1206"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1205","created_by_ref":"identity--forensicpost","name":"25-1205 — Scattered Spider cluster","description":"Scattered Spider via Social engineering. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1205"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1204","created_by_ref":"identity--forensicpost","name":"25-1204 — Industrial sector","description":"Multiple via Various. Sector: Manufacturing. Severity: Sev 3. Status: Open.","labels":["Manufacturing","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1204"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1203","created_by_ref":"identity--forensicpost","name":"25-1203 — Asia and South Pacific","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1203"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1202","created_by_ref":"identity--forensicpost","name":"25-1202 — Asia and South Pacific","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1202"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1201","created_by_ref":"identity--forensicpost","name":"25-1201 — Global breach landscape","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1201"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1130","created_by_ref":"identity--forensicpost","name":"25-1130 — Coupang","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 4. Status: Open.","labels":["Retail","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1130"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1129","created_by_ref":"identity--forensicpost","name":"25-1129 — Upbit","description":"Lazarus Group via Not established. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1129"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1128b","created_by_ref":"identity--forensicpost","name":"25-1128b — Multiple sectors","description":"Qilin via Ransomware-as-a-service. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1128b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1128","created_by_ref":"identity--forensicpost","name":"25-1128 — Eurofiber","description":"Unattributed via Not established. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1128"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1127c","created_by_ref":"identity--forensicpost","name":"25-1127c — BioPharma Services Inc.","description":"Qilin via Not established. Sector: Pharma. Severity: Sev 3. Status: Open.","labels":["Pharma","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1127c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1127b","created_by_ref":"identity--forensicpost","name":"25-1127b — London borough residents","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1127b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1127","created_by_ref":"identity--forensicpost","name":"25-1127 — Nevada state government","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 3. Status: Closed.","labels":["Public sector","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1127"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1126c","created_by_ref":"identity--forensicpost","name":"25-1126c — Kensington and Chelsea","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1126c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1126b","created_by_ref":"identity--forensicpost","name":"25-1126b — Securities firms","description":"Regulator via Not applicable. Sector: Finance. Severity: Sev 2. Status: Closed.","labels":["Finance","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1126b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1126","created_by_ref":"identity--forensicpost","name":"25-1126 — Puerto Rico government agencies","description":"Unattributed via Compromised credentials. Sector: Public sector. Severity: Sev 3. Status: Open.","labels":["Public sector","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1126"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1125b","created_by_ref":"identity--forensicpost","name":"25-1125b — Three London boroughs","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1125b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1125","created_by_ref":"identity--forensicpost","name":"25-1125 — Nevada state government","description":"Unattributed via Trojanised software download. Sector: Public sector. Severity: Sev 5. Status: Closed. Dwell: 102 days.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1125"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1124b","created_by_ref":"identity--forensicpost","name":"25-1124b — Client institutions","description":"Unattributed via Not established. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1124b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1124","created_by_ref":"identity--forensicpost","name":"25-1124 — UK supplier population","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1124"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1123","created_by_ref":"identity--forensicpost","name":"25-1123 — African disclosure regimes","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1123"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1122","created_by_ref":"identity--forensicpost","name":"25-1122 — US consumers","description":"Multiple via Social engineering. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1122"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1121b","created_by_ref":"identity--forensicpost","name":"25-1121b — SaaS tenants","description":"Unattributed via Integration compromise. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1121b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1121","created_by_ref":"identity--forensicpost","name":"25-1121 — UK regulated entities","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1121"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1120","created_by_ref":"identity--forensicpost","name":"25-1120 — Automotive sector","description":"Multiple via Various. Sector: Manufacturing. Severity: Sev 3. Status: Open.","labels":["Manufacturing","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1120"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1119b","created_by_ref":"identity--forensicpost","name":"25-1119b — DoorDash","description":"Unattributed via Social engineering. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1119b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1119","created_by_ref":"identity--forensicpost","name":"25-1119 — UK regulated entities","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1119"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1118","created_by_ref":"identity--forensicpost","name":"25-1118 — Browsing AI agents","description":"Unattributed via Indirect prompt injection. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1118"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1117","created_by_ref":"identity--forensicpost","name":"25-1117 — Regional risk measurement","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1117"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1116","created_by_ref":"identity--forensicpost","name":"25-1116 — Latin American organisations","description":"Multiple via Ransomware. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1116"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1115","created_by_ref":"identity--forensicpost","name":"25-1115 — Latin American organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1115"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1114","created_by_ref":"identity--forensicpost","name":"25-1114 — Logistics sector","description":"Multiple via Various. Sector: Logistics. Severity: Sev 3. Status: Open.","labels":["Logistics","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1114"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1113","created_by_ref":"identity--forensicpost","name":"25-1113 — UK regulated entities","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1113"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1112c","created_by_ref":"identity--forensicpost","name":"25-1112c — Small organisations","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1112c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1112b","created_by_ref":"identity--forensicpost","name":"25-1112b — SitusAMC","description":"Unattributed via Not established. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1112b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1112","created_by_ref":"identity--forensicpost","name":"25-1112 — Telecom subscribers","description":"Salt Typhoon via Lawful-intercept infrastructure. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1112"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1111b","created_by_ref":"identity--forensicpost","name":"25-1111b — South Korean asset managers","description":"Qilin via MSP compromise. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1111b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1111","created_by_ref":"identity--forensicpost","name":"25-1111 — SIAD Group","description":"Everest via Not established. Sector: Manufacturing. Severity: Sev 3. Status: Open.","labels":["Manufacturing","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1111"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1110b","created_by_ref":"identity--forensicpost","name":"25-1110b — South Korean asset managers","description":"Qilin via MSP compromise. Sector: Finance. Severity: Sev 5. Status: Open.","labels":["Finance","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1110b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1110","created_by_ref":"identity--forensicpost","name":"25-1110 — Oracle EBS customers, multiple","description":"Cl0p via CVE-2025-61882. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1110"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1109","created_by_ref":"identity--forensicpost","name":"25-1109 — Telecommunications sector","description":"Qilin via Ransomware-as-a-service. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1109"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1108","created_by_ref":"identity--forensicpost","name":"25-1108 — Ransomware ecosystem","description":"Qilin via Ransomware-as-a-service. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1108"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1107b","created_by_ref":"identity--forensicpost","name":"25-1107b — Edge appliance estates","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1107b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1107","created_by_ref":"identity--forensicpost","name":"25-1107 — Public-sector disclosure practice","description":"Not applicable via Not applicable. Sector: Public sector. Severity: Sev 2. Status: Open.","labels":["Public sector","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1107"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1106b","created_by_ref":"identity--forensicpost","name":"25-1106b — Congressional Budget Office","description":"Unattributed via Unpatched edge device. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1106b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1106","created_by_ref":"identity--forensicpost","name":"25-1106 — City of Saint Paul","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 3. Status: Closed.","labels":["Public sector","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1106"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1105","created_by_ref":"identity--forensicpost","name":"25-1105 — Prosper Marketplace","description":"Unattributed via Not established. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1105"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1104","created_by_ref":"identity--forensicpost","name":"25-1104 — US consumers","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1104"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1103","created_by_ref":"identity--forensicpost","name":"25-1103 — Security vendors","description":"State-sponsored via Supply chain positioning. Sector: Cloud. Severity: Sev 5. Status: Open.","labels":["Cloud","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1103"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1102","created_by_ref":"identity--forensicpost","name":"25-1102 — Security labour market","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1102"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1101","created_by_ref":"identity--forensicpost","name":"25-1101 — Asahi Group Holdings","description":"Qilin via Not established. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1101"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1031","created_by_ref":"identity--forensicpost","name":"25-1031 — Settlement class members","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1031"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1030","created_by_ref":"identity--forensicpost","name":"25-1030 — UK automotive sector","description":"Multiple via Various. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1030"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1029","created_by_ref":"identity--forensicpost","name":"25-1029 — Tenant clients and personnel","description":"ShinyHunters via Targeted phishing. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1029"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1028","created_by_ref":"identity--forensicpost","name":"25-1028 — University of Pennsylvania","description":"Unattributed via Not established. Sector: Education. Severity: Sev 4. Status: Closed.","labels":["Education","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1028"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1027","created_by_ref":"identity--forensicpost","name":"25-1027 — Marquis client institutions","description":"Akira via Unpatched edge device. Sector: Finance. Severity: Sev 3. Status: Closed. Dwell: 74 days.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1027"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1026","created_by_ref":"identity--forensicpost","name":"25-1026 — Princeton University","description":"Unattributed via Voice phishing. Sector: Education. Severity: Sev 3. Status: Closed. Dwell: 1 days.","labels":["Education","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1026"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1025","created_by_ref":"identity--forensicpost","name":"25-1025 — Higher education sector","description":"Multiple via Various. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1025"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1024","created_by_ref":"identity--forensicpost","name":"25-1024 — University advancement offices","description":"Multiple via Voice phishing. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1024"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1023","created_by_ref":"identity--forensicpost","name":"25-1023 — UK water suppliers","description":"Multiple via Various. Sector: Utilities. Severity: Sev 3. Status: Open.","labels":["Utilities","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1023"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1022","created_by_ref":"identity--forensicpost","name":"25-1022 — Multiple sectors","description":"Multiple via Voice phishing. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1022"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1021","created_by_ref":"identity--forensicpost","name":"25-1021 — Middle East organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1021"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1020","created_by_ref":"identity--forensicpost","name":"25-1020 — University donors","description":"Unattributed via Voice phishing. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1020"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1019","created_by_ref":"identity--forensicpost","name":"25-1019 — Nigerian organisations","description":"Multiple via Various. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1019"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1018","created_by_ref":"identity--forensicpost","name":"25-1018 — M-TIBA","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1018"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1017","created_by_ref":"identity--forensicpost","name":"25-1017 — Envoy Air","description":"Cl0p via CVE-2025-61882. Sector: Logistics. Severity: Sev 3. Status: Closed.","labels":["Logistics","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1017"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1016","created_by_ref":"identity--forensicpost","name":"25-1016 — The Washington Post","description":"Cl0p via CVE-2025-61882. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1016"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1015b","created_by_ref":"identity--forensicpost","name":"25-1015b — Pharmaceutical sector","description":"Multiple via Various. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1015b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1015","created_by_ref":"identity--forensicpost","name":"25-1015 — F5","description":"Nation-state via Long-term compromise. Sector: Cloud. Severity: Sev 5. Status: Contained.","labels":["Cloud","Contained","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1015"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1014b","created_by_ref":"identity--forensicpost","name":"25-1014b — Pharmaceutical sector","description":"Regulator via Not applicable. Sector: Pharma. Severity: Sev 3. Status: Open.","labels":["Pharma","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1014b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1014","created_by_ref":"identity--forensicpost","name":"25-1014 — BreachForums","description":"Multiple via Marketplace. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1014"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1013b","created_by_ref":"identity--forensicpost","name":"25-1013b — Goldman Sachs clients","description":"Unattributed via Third party. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1013b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1013","created_by_ref":"identity--forensicpost","name":"25-1013 — US consumers","description":"Multiple via Identity theft. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1013"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1012","created_by_ref":"identity--forensicpost","name":"25-1012 — Harvard University","description":"Cl0p via CVE-2025-61882. Sector: Education. Severity: Sev 4. Status: Closed.","labels":["Education","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1012"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1011b","created_by_ref":"identity--forensicpost","name":"25-1011b — Self-service estates","description":"Multiple via Delegated authority abuse. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1011b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1011","created_by_ref":"identity--forensicpost","name":"25-1011 — Askul Corporation","description":"RansomHouse via Not established. Sector: Logistics. Severity: Sev 4. Status: Closed.","labels":["Logistics","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1011"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1010b","created_by_ref":"identity--forensicpost","name":"25-1010b — Affected employees","description":"Not applicable via Not applicable. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1010b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1010","created_by_ref":"identity--forensicpost","name":"25-1010 — Healthcare sector records","description":"Multiple via Various. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1010"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1009b","created_by_ref":"identity--forensicpost","name":"25-1009b — US university employees","description":"Unattributed via HR self-service abuse. Sector: Education. Severity: Sev 4. Status: Open.","labels":["Education","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1009b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1009","created_by_ref":"identity--forensicpost","name":"25-1009 — Agent deployments","description":"Multiple via Tool poisoning. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1009"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1008","created_by_ref":"identity--forensicpost","name":"25-1008 — Jaguar Land Rover","description":"Scattered Lapsus$ Hunters via Not established. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1008"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1007","created_by_ref":"identity--forensicpost","name":"25-1007 — Oracle enterprise estates","description":"Cl0p via Mass exploitation. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1007"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1006","created_by_ref":"identity--forensicpost","name":"25-1006 — CRM tenants","description":"Multiple via Various. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1006"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1005b","created_by_ref":"identity--forensicpost","name":"25-1005b — Small organisations","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1005b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1005","created_by_ref":"identity--forensicpost","name":"25-1005 — Chess.com","description":"Unattributed via Third-party file transfer. Sector: Cloud. Severity: Sev 2. Status: Closed. Dwell: 13 days.","labels":["Cloud","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1005"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1004c","created_by_ref":"identity--forensicpost","name":"25-1004c — Jaguar Land Rover","description":"Scattered Lapsus$ Hunters via Downstream of 25-0902. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1004c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1004b","created_by_ref":"identity--forensicpost","name":"25-1004b — Customer support estates","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1004b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1004","created_by_ref":"identity--forensicpost","name":"25-1004 — Ransomware ecosystem","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1004"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1003c","created_by_ref":"identity--forensicpost","name":"25-1003c — JLR supply chain","description":"Not applicable via Not applicable. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1003c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1003b","created_by_ref":"identity--forensicpost","name":"25-1003b — Discord","description":"Unattributed via Third-party support provider. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1003b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1003","created_by_ref":"identity--forensicpost","name":"25-1003 — Logitech","description":"Cl0p via Zero-day exploitation. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1003"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1002b","created_by_ref":"identity--forensicpost","name":"25-1002b — JLR supply chain","description":"Not applicable via Not applicable. Sector: Manufacturing. Severity: Sev 3. Status: Closed.","labels":["Manufacturing","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1002b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1002","created_by_ref":"identity--forensicpost","name":"25-1002 — Muji","description":"RansomHouse via Supplier incident. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1002"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1001b","created_by_ref":"identity--forensicpost","name":"25-1001b — Unnamed JLR supplier","description":"Scattered Lapsus$ Hunters via Downstream of 25-0902. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1001b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-1001","created_by_ref":"identity--forensicpost","name":"25-1001 — Under Armour","description":"Everest via Not established. Sector: Retail. Severity: Sev 3. Status: Open.","labels":["Retail","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-1001"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0930b","created_by_ref":"identity--forensicpost","name":"25-0930b — JLR small suppliers","description":"Scattered Lapsus$ Hunters via Downstream of 25-0902. Sector: Manufacturing. Severity: Sev 5. Status: Closed.","labels":["Manufacturing","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0930b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0930","created_by_ref":"identity--forensicpost","name":"25-0930 — Oracle EBS deployments","description":"Cl0p via CVE-2025-61882. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0930"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0929b","created_by_ref":"identity--forensicpost","name":"25-0929b — JLR supply chain","description":"Scattered Lapsus$ Hunters via Downstream of 25-0902. Sector: Manufacturing. Severity: Sev 5. Status: Closed.","labels":["Manufacturing","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0929b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0929","created_by_ref":"identity--forensicpost","name":"25-0929 — Harrods","description":"Unattributed via Supplier compromise. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0929"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0928","created_by_ref":"identity--forensicpost","name":"25-0928 — Jaguar Land Rover supply chain","description":"Scattered Lapsus$ Hunters via Not established. Sector: Manufacturing. Severity: Sev 5. Status: Closed.","labels":["Manufacturing","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0928"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0927","created_by_ref":"identity--forensicpost","name":"25-0927 — Children as data subjects","description":"Multiple via Various. Sector: Education. Severity: Sev 4. Status: Open.","labels":["Education","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0927"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0926","created_by_ref":"identity--forensicpost","name":"25-0926 — Kido International","description":"Unattributed via Not established. Sector: Education. Severity: Sev 5. Status: Open.","labels":["Education","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0926"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0925","created_by_ref":"identity--forensicpost","name":"25-0925 — Cross-border incident classification","description":"Unattributed via Governance. Sector: Logistics. Severity: Sev 3. Status: Closed.","labels":["Logistics","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0925"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0924b","created_by_ref":"identity--forensicpost","name":"25-0924b — Incident record formation","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0924b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0924","created_by_ref":"identity--forensicpost","name":"25-0924 — Incident disclosure practice","description":"Not applicable via Not applicable. Sector: Public sector. Severity: Sev 2. Status: Open.","labels":["Public sector","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0924"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0923c","created_by_ref":"identity--forensicpost","name":"25-0923c — Pharmaceutical research","description":"Multiple via Ransomware. Sector: Pharma. Severity: Sev 3. Status: Open.","labels":["Pharma","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0923c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0923b","created_by_ref":"identity--forensicpost","name":"25-0923b — Boyd Gaming Corporation","description":"Unattributed via Not established. Sector: Hospitality. Severity: Sev 3. Status: Closed.","labels":["Hospitality","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0923b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0923","created_by_ref":"identity--forensicpost","name":"25-0923 — SaaS platform tenants","description":"ShinyHunters via Consent phishing. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0923"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0922b","created_by_ref":"identity--forensicpost","name":"25-0922b — Life sciences sector","description":"Multiple via Various. Sector: Pharma. Severity: Sev 2. Status: Open.","labels":["Pharma","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0922b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0922","created_by_ref":"identity--forensicpost","name":"25-0922 — Nevada state government","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 5. Status: Closed. Dwell: 102 days.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0922"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0921b","created_by_ref":"identity--forensicpost","name":"25-0921b — Integrity failures","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0921b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0921","created_by_ref":"identity--forensicpost","name":"25-0921 — Nevada state government","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 5. Status: Closed. Dwell: 102 days.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0921"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0920b","created_by_ref":"identity--forensicpost","name":"25-0920b — Pharmaceutical manufacturing","description":"Multiple via Various. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0920b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0919","created_by_ref":"identity--forensicpost","name":"25-0919 — Collins Aerospace MUSE","description":"Unattributed via Ransomware. Sector: Logistics. Severity: Sev 4. Status: Closed.","labels":["Logistics","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0919"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0918","created_by_ref":"identity--forensicpost","name":"25-0918 — US public sector","description":"Multiple via Various. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0918"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0917","created_by_ref":"identity--forensicpost","name":"25-0917 — SonicWall cloud backup service","description":"State-sponsored via Service compromise. Sector: Cloud. Severity: Sev 5. Status: Contained.","labels":["Cloud","Contained","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0917"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0916","created_by_ref":"identity--forensicpost","name":"25-0916 — Legal sector clients","description":"Multiple via Various. Sector: Legal. Severity: Sev 3. Status: Open.","labels":["Legal","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0916"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0915b","created_by_ref":"identity--forensicpost","name":"25-0915b — Pharmaceutical research","description":"Multiple via Various. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0915b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0914b","created_by_ref":"identity--forensicpost","name":"25-0914b — Contract research organisations","description":"Multiple via Various. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0914b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0913b","created_by_ref":"identity--forensicpost","name":"25-0913b — Clinical trial participants","description":"Multiple via Various. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0913b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0912b","created_by_ref":"identity--forensicpost","name":"25-0912b — Novo Nordisk","description":"Unattributed via Not established. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0912b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0912","created_by_ref":"identity--forensicpost","name":"25-0912 — Asian internet users","description":"Multiple via Credential compromise. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0912"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0910","created_by_ref":"identity--forensicpost","name":"25-0910 — Legal sector","description":"Multiple via Various. Sector: Legal. Severity: Sev 3. Status: Open.","labels":["Legal","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0910"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0909","created_by_ref":"identity--forensicpost","name":"25-0909 — SFR","description":"Unattributed via Not established. Sector: Telecom. Severity: Sev 3. Status: Closed.","labels":["Telecom","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0909"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0908b","created_by_ref":"identity--forensicpost","name":"25-0908b — Plex","description":"Unattributed via Not established. Sector: Cloud. Severity: Sev 2. Status: Closed.","labels":["Cloud","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0908b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0908","created_by_ref":"identity--forensicpost","name":"25-0908 — Ransomware ecosystem","description":"LockBit via Ransomware-as-a-service. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0908"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0905","created_by_ref":"identity--forensicpost","name":"25-0905 — Ransomware ecosystem","description":"Scattered Lapsus$ Hunters via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0905"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0904","created_by_ref":"identity--forensicpost","name":"25-0904 — Incident measurement","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0904"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0903","created_by_ref":"identity--forensicpost","name":"25-0903 — File transfer estates","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0903"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0902","created_by_ref":"identity--forensicpost","name":"25-0902 — Jaguar Land Rover","description":"Scattered Lapsus$ Hunters via Not established. Sector: Manufacturing. Severity: Sev 5. Status: Closed.","labels":["Manufacturing","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0902"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0901","created_by_ref":"identity--forensicpost","name":"25-0901 — SaaS integration model","description":"Unattributed via Shared responsibility gap. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0901"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0830","created_by_ref":"identity--forensicpost","name":"25-0830 — Multiple sectors","description":"ShinyHunters via Social engineering. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0830"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0829","created_by_ref":"identity--forensicpost","name":"25-0829 — Motility Software Solutions","description":"Unattributed via Not established. Sector: Cloud. Severity: Sev 3. Status: Closed.","labels":["Cloud","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0829"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0828","created_by_ref":"identity--forensicpost","name":"25-0828 — Breach remediation","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0828"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0827","created_by_ref":"identity--forensicpost","name":"25-0827 — Global infrastructure operators","description":"Salt Typhoon via Various. Sector: Telecom. Severity: Sev 5. Status: Open.","labels":["Telecom","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0827"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0826","created_by_ref":"identity--forensicpost","name":"25-0826 — Cloudflare case records","description":"UNC6395 via OAuth token theft. Sector: Cloud. Severity: Sev 4. Status: Closed.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0826"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0824","created_by_ref":"identity--forensicpost","name":"25-0824 — State of Nevada","description":"Unattributed via Ransomware. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0824"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0821","created_by_ref":"identity--forensicpost","name":"25-0821 — African consumers","description":"Multiple via Social engineering. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0821"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0820","created_by_ref":"identity--forensicpost","name":"25-0820 — Incident response practice","description":"UNC6395 via Delayed exploitation. Sector: Cloud. Severity: Sev 4. Status: Closed. Dwell: 150 days.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0820"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0819b","created_by_ref":"identity--forensicpost","name":"25-0819b — Inotiv","description":"Unattributed via Not established. Sector: Pharma. Severity: Sev 4. Status: Open.","labels":["Pharma","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0819b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0819","created_by_ref":"identity--forensicpost","name":"25-0819 — Municipal governments","description":"Multiple via Various. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0819"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0818","created_by_ref":"identity--forensicpost","name":"25-0818 — Salesloft Drift integration","description":"UNC6395 via OAuth token theft. Sector: Cloud. Severity: Sev 5. Status: Closed.","labels":["Cloud","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0818"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0817","created_by_ref":"identity--forensicpost","name":"25-0817 — Production database","description":"No adversary via Autonomous agent action. Sector: Cloud. Severity: Sev 4. Status: Closed.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0817"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0815b","created_by_ref":"identity--forensicpost","name":"25-0815b — Workday","description":"ShinyHunters via Social engineering. Sector: Cloud. Severity: Sev 2. Status: Closed.","labels":["Cloud","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0815b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0815","created_by_ref":"identity--forensicpost","name":"25-0815 — City of Saint Paul","description":"Unattributed via Data extortion. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0815"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0814","created_by_ref":"identity--forensicpost","name":"25-0814 — Marquis Software","description":"Akira via Unpatched edge device. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0814"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0813","created_by_ref":"identity--forensicpost","name":"25-0813 — Enterprise SSO accounts","description":"ShinyHunters via MFA enrolment. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0813"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0812","created_by_ref":"identity--forensicpost","name":"25-0812 — Scattered Spider member","description":"Convicted individual via Social engineering. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0812"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0811","created_by_ref":"identity--forensicpost","name":"25-0811 — Ransomware proceeds","description":"Multiple via Various. Sector: Multiple. Severity: Sev 2. Status: Closed.","labels":["Multiple","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0811"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0810","created_by_ref":"identity--forensicpost","name":"25-0810 — Google","description":"ShinyHunters via Third-party platform. Sector: Cloud. Severity: Sev 3. Status: Closed.","labels":["Cloud","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0810"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0808b","created_by_ref":"identity--forensicpost","name":"25-0808b — Attribution practice","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0808b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0808","created_by_ref":"identity--forensicpost","name":"25-0808 — Retail sector","description":"Multiple via Various. Sector: Retail. Severity: Sev 3. Status: Open.","labels":["Retail","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0808"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0807b","created_by_ref":"identity--forensicpost","name":"25-0807b — HR platforms","description":"Multiple via Various. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0807b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0807","created_by_ref":"identity--forensicpost","name":"25-0807 — Pakistan Petroleum Limited","description":"Unattributed via Ransomware. Sector: Energy. Severity: Sev 2. Status: Closed.","labels":["Energy","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0807"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0806b","created_by_ref":"identity--forensicpost","name":"25-0806b — Workday","description":"ShinyHunters via Voice and SMS phishing. Sector: Cloud. Severity: Sev 3. Status: Closed.","labels":["Cloud","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0806b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0806","created_by_ref":"identity--forensicpost","name":"25-0806 — Enterprise SaaS tenants","description":"ShinyHunters via Consent phishing. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0806"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0805","created_by_ref":"identity--forensicpost","name":"25-0805 — Security appliance estates","description":"Multiple via Various. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0805"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0804","created_by_ref":"identity--forensicpost","name":"25-0804 — Bouygues Telecom","description":"Unattributed via Not established. Sector: Telecom. Severity: Sev 4. Status: Closed.","labels":["Telecom","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0804"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0802b","created_by_ref":"identity--forensicpost","name":"25-0802b — Australian health providers","description":"Multiple via Various. Sector: Healthcare. Severity: Sev 3. Status: Open.","labels":["Healthcare","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0802b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0802","created_by_ref":"identity--forensicpost","name":"25-0802 — City of Saint Paul","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0802"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0801","created_by_ref":"identity--forensicpost","name":"25-0801 — Healthcare back-office vendor","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0801"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0731b","created_by_ref":"identity--forensicpost","name":"25-0731b — Australian organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0731b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0731","created_by_ref":"identity--forensicpost","name":"25-0731 — Gulf energy and government","description":"Iranian state-linked sets via Various. Sector: Energy. Severity: Sev 4. Status: Open.","labels":["Energy","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0731"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0730","created_by_ref":"identity--forensicpost","name":"25-0730 — City of Saint Paul","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0730"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0729","created_by_ref":"identity--forensicpost","name":"25-0729 — Utility sector","description":"Multiple via Various. Sector: Utilities. Severity: Sev 4. Status: Open.","labels":["Utilities","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0729"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0728","created_by_ref":"identity--forensicpost","name":"25-0728 — Financial sector","description":"Multiple via Ransomware. Sector: Finance. Severity: Sev 4. Status: Open.","labels":["Finance","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0728"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0727","created_by_ref":"identity--forensicpost","name":"25-0727 — TransUnion","description":"ShinyHunters via Third-party platform. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0727"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0726","created_by_ref":"identity--forensicpost","name":"25-0726 — City of Saint Paul","description":"Unattributed via Not established. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0726"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0725b","created_by_ref":"identity--forensicpost","name":"25-0725b — Hospitality platforms","description":"Multiple via Various. Sector: Hospitality. Severity: Sev 3. Status: Open.","labels":["Hospitality","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0725b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0725","created_by_ref":"identity--forensicpost","name":"25-0725 — Multiple sectors","description":"Salt Typhoon via Various. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0725"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0724","created_by_ref":"identity--forensicpost","name":"25-0724 — UK retail campaign","description":"Scattered Spider via Social engineering. Sector: Retail. Severity: Sev 3. Status: Open.","labels":["Retail","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0724"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0723","created_by_ref":"identity--forensicpost","name":"25-0723 — On-premises SharePoint estates","description":"Multiple via Stolen key material. Sector: Cloud. Severity: Sev 5. Status: Open.","labels":["Cloud","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0723"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0722","created_by_ref":"identity--forensicpost","name":"25-0722 — Healthcare sector","description":"Multiple via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0722"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0721","created_by_ref":"identity--forensicpost","name":"25-0721 — AI agent deployments","description":"Multiple via Prompt injection. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0721"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0720","created_by_ref":"identity--forensicpost","name":"25-0720 — Telecom subscribers","description":"Multiple via Various. Sector: Telecom. Severity: Sev 3. Status: Open.","labels":["Telecom","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0720"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0719","created_by_ref":"identity--forensicpost","name":"25-0719 — On-premises SharePoint estates","description":"Multiple via Zero-day exploit chain. Sector: Cloud. Severity: Sev 5. Status: Closed.","labels":["Cloud","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0719"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0718","created_by_ref":"identity--forensicpost","name":"25-0718 — Telecommunications sector","description":"Multiple via Various. Sector: Telecom. Severity: Sev 3. Status: Open.","labels":["Telecom","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0718"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0717","created_by_ref":"identity--forensicpost","name":"25-0717 — Allianz Life","description":"ShinyHunters via Social engineering. Sector: Insurance. Severity: Sev 4. Status: Closed.","labels":["Insurance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0717"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0716","created_by_ref":"identity--forensicpost","name":"25-0716 — Telecommunications sector","description":"Multiple via Data theft. Sector: Telecom. Severity: Sev 3. Status: Open.","labels":["Telecom","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0716"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0715","created_by_ref":"identity--forensicpost","name":"25-0715 — US hospitals","description":"Multiple via Various. Sector: Healthcare. Severity: Sev 4. Status: Open.","labels":["Healthcare","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0715"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0714","created_by_ref":"identity--forensicpost","name":"25-0714 — Telecommunications sector","description":"Multiple via Ransomware. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0714"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0713","created_by_ref":"identity--forensicpost","name":"25-0713 — Gulf financial institutions","description":"Multiple via Ransomware. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0713"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0711","created_by_ref":"identity--forensicpost","name":"25-0711 — Regional risk measurement","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0711"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0710","created_by_ref":"identity--forensicpost","name":"25-0710 — LVMH brands","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0710"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0709","created_by_ref":"identity--forensicpost","name":"25-0709 — Gulf organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0709"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0708","created_by_ref":"identity--forensicpost","name":"25-0708 — Availability incidents","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0708"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0704","created_by_ref":"identity--forensicpost","name":"25-0704 — Workforce data","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0704"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0703","created_by_ref":"identity--forensicpost","name":"25-0703 — Outcomes One","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 3. Status: Closed.","labels":["Healthcare","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0703"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0702","created_by_ref":"identity--forensicpost","name":"25-0702 — Multiple sectors","description":"Scattered Spider via Social engineering. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0702"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0701","created_by_ref":"identity--forensicpost","name":"25-0701 — Qantas","description":"Unattributed via Social engineering. Sector: Aviation. Severity: Sev 4. Status: Closed.","labels":["Aviation","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0701"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0630","created_by_ref":"identity--forensicpost","name":"25-0630 — US healthcare sector","description":"Multiple via Various. Sector: Healthcare. Severity: Sev 3. Status: Open.","labels":["Healthcare","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0630"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0629","created_by_ref":"identity--forensicpost","name":"25-0629 — Water infrastructure contractor","description":"Ralord via Not established. Sector: Utilities. Severity: Sev 3. Status: Open.","labels":["Utilities","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0629"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0628","created_by_ref":"identity--forensicpost","name":"25-0628 — Airline operational systems","description":"Scattered Spider via Social engineering. Sector: Aviation. Severity: Sev 3. Status: Closed.","labels":["Aviation","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0628"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0627","created_by_ref":"identity--forensicpost","name":"25-0627 — North American and Australian carriers","description":"Scattered Spider via Social engineering. Sector: Aviation. Severity: Sev 4. Status: Closed.","labels":["Aviation","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0627"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0626","created_by_ref":"identity--forensicpost","name":"25-0626 — Credential leak reporting","description":"None — measurement via Verification dispute. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0626"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0625","created_by_ref":"identity--forensicpost","name":"25-0625 — Enterprise authentication estates","description":"Scattered Spider via Legacy authentication. Sector: Aviation. Severity: Sev 4. Status: Open.","labels":["Aviation","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0625"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0624","created_by_ref":"identity--forensicpost","name":"25-0624 — NetScaler appliances","description":"Multiple via Memory disclosure. Sector: Cloud. Severity: Sev 4. Status: Closed.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0624"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0623","created_by_ref":"identity--forensicpost","name":"25-0623 — Viasat","description":"Salt Typhoon via Remote management abuse. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0623"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0622","created_by_ref":"identity--forensicpost","name":"25-0622 — US insurers","description":"Scattered Spider via Social engineering. Sector: Insurance. Severity: Sev 4. Status: Closed.","labels":["Insurance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0622"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0621","created_by_ref":"identity--forensicpost","name":"25-0621 — US consumers","description":"Multiple via Identity theft. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0621"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0620","created_by_ref":"identity--forensicpost","name":"25-0620 — Exposed credential aggregates","description":"Exposure via Misconfiguration. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0620"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0619","created_by_ref":"identity--forensicpost","name":"25-0619 — Japanese organisations","description":"Unattributed via Hacktivism. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0619"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0618","created_by_ref":"identity--forensicpost","name":"25-0618 — Aflac","description":"Scattered Spider via Social engineering. Sector: Insurance. Severity: Sev 5. Status: Closed.","labels":["Insurance","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0618"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0617","created_by_ref":"identity--forensicpost","name":"25-0617 — Nobitex","description":"Unattributed via Not established. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0617"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0616b","created_by_ref":"identity--forensicpost","name":"25-0616b — Small organisations","description":"Regulator via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0616b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0616","created_by_ref":"identity--forensicpost","name":"25-0616 — Financial sector","description":"Multiple via Various. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0616"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0615b","created_by_ref":"identity--forensicpost","name":"25-0615b — UK businesses and charities","description":"Multiple via Phishing. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0615b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0615","created_by_ref":"identity--forensicpost","name":"25-0615 — Ahold Delhaize USA","description":"Scattered Spider via Not established. Sector: Retail. Severity: Sev 3. Status: Open.","labels":["Retail","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0615"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0614b","created_by_ref":"identity--forensicpost","name":"25-0614b — Nonprofit sector","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0614b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0613b","created_by_ref":"identity--forensicpost","name":"25-0613b — This database","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0613b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0613","created_by_ref":"identity--forensicpost","name":"25-0613 — Chain IQ Group AG","description":"Unattributed via Not established. Sector: Finance. Severity: Sev 3. Status: Closed.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0613"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0612b","created_by_ref":"identity--forensicpost","name":"25-0612b — Small businesses","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0612b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0612","created_by_ref":"identity--forensicpost","name":"25-0612 — Texas Department of Transportation","description":"Unattributed via Compromised credentials. Sector: Public sector. Severity: Sev 3. Status: Closed.","labels":["Public sector","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0612"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0611b","created_by_ref":"identity--forensicpost","name":"25-0611b — Small and medium businesses","description":"Multiple via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0611b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0611","created_by_ref":"identity--forensicpost","name":"25-0611 — US Army National Guard","description":"Unattributed via Not established. Sector: Defence. Severity: Sev 4. Status: Open.","labels":["Defence","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0611"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0610b","created_by_ref":"identity--forensicpost","name":"25-0610b — Small businesses","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0610b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0607","created_by_ref":"identity--forensicpost","name":"25-0607 — Security functions","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0607"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0606","created_by_ref":"identity--forensicpost","name":"25-0606 — United Natural Foods","description":"Unattributed via Not established. Sector: Logistics. Severity: Sev 4. Status: Closed.","labels":["Logistics","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0606"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0605","created_by_ref":"identity--forensicpost","name":"25-0605 — Episource","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0605"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0604b","created_by_ref":"identity--forensicpost","name":"25-0604b — Management plane estates","description":"Multiple via Various. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0604b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0603b","created_by_ref":"identity--forensicpost","name":"25-0603b — Managed service model","description":"Multiple via Various. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0603b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0603","created_by_ref":"identity--forensicpost","name":"25-0603 — Cartier","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 2. Status: Closed.","labels":["Retail","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0603"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0602b","created_by_ref":"identity--forensicpost","name":"25-0602b — MSP customer estates","description":"DragonForce via RMM platform abuse. Sector: Cloud. Severity: Sev 4. Status: Closed.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0602b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0602","created_by_ref":"identity--forensicpost","name":"25-0602 — Senegalese petroleum company","description":"Unattributed via Business email compromise. Sector: Energy. Severity: Sev 4. Status: Open.","labels":["Energy","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0602"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0601b","created_by_ref":"identity--forensicpost","name":"25-0601b — Managed service provider","description":"DragonForce via Unpatched RMM platform. Sector: Cloud. Severity: Sev 5. Status: Closed.","labels":["Cloud","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0601b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0601","created_by_ref":"identity--forensicpost","name":"25-0601 — Insurance sector","description":"ShinyHunters via Social engineering. Sector: Insurance. Severity: Sev 3. Status: Open.","labels":["Insurance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0601"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0530","created_by_ref":"identity--forensicpost","name":"25-0530 — Coinbase customers","description":"Unattributed via Insider recruitment. Sector: Finance. Severity: Sev 3. Status: Closed.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0530"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0529","created_by_ref":"identity--forensicpost","name":"25-0529 — Farmers Insurance","description":"ShinyHunters via Third-party platform. Sector: Insurance. Severity: Sev 4. Status: Closed.","labels":["Insurance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0529"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0528","created_by_ref":"identity--forensicpost","name":"25-0528 — Southeast Asian energy provider","description":"NightSpire via Ransomware. Sector: Energy. Severity: Sev 3. Status: Open.","labels":["Energy","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0528"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0527","created_by_ref":"identity--forensicpost","name":"25-0527 — Not applicable","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0527"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0526","created_by_ref":"identity--forensicpost","name":"25-0526 — Victoria’s Secret","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0526"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0525","created_by_ref":"identity--forensicpost","name":"25-0525 — Not applicable","description":"LockBit via Not applicable. Sector: Criminal. Severity: Sev 3. Status: Closed.","labels":["Criminal","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0525"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0524","created_by_ref":"identity--forensicpost","name":"25-0524 — African cybercrime networks","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0524"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0523","created_by_ref":"identity--forensicpost","name":"25-0523 — Cetus Protocol","description":"Unattributed via Contract logic manipulation. Sector: Finance. Severity: Sev 3. Status: Closed.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0523"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0522","created_by_ref":"identity--forensicpost","name":"25-0522 — US utility","description":"Volt Typhoon via Not established. Sector: Utilities. Severity: Sev 4. Status: Open.","labels":["Utilities","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0522"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0521","created_by_ref":"identity--forensicpost","name":"25-0521 — PowerSchool","description":"Convicted individual via Compromised credentials. Sector: Education. Severity: Sev 3. Status: Closed.","labels":["Education","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0521"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0520","created_by_ref":"identity--forensicpost","name":"25-0520 — Kettering Health","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0520"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0519","created_by_ref":"identity--forensicpost","name":"25-0519 — Multiple, unidentified","description":"LockBit affiliates via Extortion pricing. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0519"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0518","created_by_ref":"identity--forensicpost","name":"25-0518 — IT personnel","description":"Unattributed via Search engine poisoning. Sector: Public sector. Severity: Sev 4. Status: Open.","labels":["Public sector","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0518"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0517","created_by_ref":"identity--forensicpost","name":"25-0517 — Multiple, global","description":"LockBit affiliates via Various. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0517"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0516","created_by_ref":"identity--forensicpost","name":"25-0516 — Nevada state government","description":"Unattributed via Trojanised software download. Sector: Public sector. Severity: Sev 5. Status: Closed. Dwell: 102 days.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0516"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0515","created_by_ref":"identity--forensicpost","name":"25-0515 — Health IT vendor","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 3. Status: Closed.","labels":["Healthcare","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0515"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0514","created_by_ref":"identity--forensicpost","name":"25-0514 — Coinbase","description":"Unattributed via Insider recruitment. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0514"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0513","created_by_ref":"identity--forensicpost","name":"25-0513 — African organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0513"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0512","created_by_ref":"identity--forensicpost","name":"25-0512 — Retail sector","description":"Scattered Spider via Social engineering. Sector: Retail. Severity: Sev 4. Status: Open.","labels":["Retail","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0512"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0511","created_by_ref":"identity--forensicpost","name":"25-0511 — Not applicable","description":"LockBit via Extortion. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0511"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0510","created_by_ref":"identity--forensicpost","name":"25-0510 — Not applicable","description":"LockBit via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0510"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0509","created_by_ref":"identity--forensicpost","name":"25-0509 — Fraud measurement","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0509"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0508","created_by_ref":"identity--forensicpost","name":"25-0508 — LockBit","description":"Unattributed via Panel compromise. Sector: Criminal. Severity: Sev 5. Status: Closed.","labels":["Criminal","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0508"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0507","created_by_ref":"identity--forensicpost","name":"25-0507 — School districts","description":"Unattributed via Data re-extortion. Sector: Education. Severity: Sev 5. Status: Open.","labels":["Education","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0507"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0506","created_by_ref":"identity--forensicpost","name":"25-0506 — Middle East organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0506"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0505","created_by_ref":"identity--forensicpost","name":"25-0505 — North American steel producer","description":"Unattributed via Not established. Sector: Manufacturing. Severity: Sev 3. Status: Closed.","labels":["Manufacturing","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0505"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0503","created_by_ref":"identity--forensicpost","name":"25-0503 — Agent authorisation models","description":"Multiple via Prompt injection. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0503"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0502","created_by_ref":"identity--forensicpost","name":"25-0502 — Incident record formation","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0502"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0501","created_by_ref":"identity--forensicpost","name":"25-0501 — Co-operative Group","description":"Scattered Spider via Social engineering. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0501"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0430","created_by_ref":"identity--forensicpost","name":"25-0430 — Co-op","description":"Scattered Spider via Help-desk social engineering. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0430"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0428","created_by_ref":"identity--forensicpost","name":"25-0428 — Security leadership","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0428"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0426","created_by_ref":"identity--forensicpost","name":"25-0426 — Multiple sectors","description":"Multiple via Third party. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0426"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0424","created_by_ref":"identity--forensicpost","name":"25-0424 — SAP NetWeaver estates","description":"Unattributed via Unauthorised file upload. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0424"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0423","created_by_ref":"identity--forensicpost","name":"25-0423 — Asia-Pacific organisations","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0423"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0422","created_by_ref":"identity--forensicpost","name":"25-0422 — Dutch public facility","description":"Russian state-linked actors via Not established. Sector: Utilities. Severity: Sev 4. Status: Closed.","labels":["Utilities","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0422"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0421b","created_by_ref":"identity--forensicpost","name":"25-0421b — Incident response caseload","description":"Multiple via Valid credentials. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0421b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0415","created_by_ref":"identity--forensicpost","name":"25-0415 — Medical device manufacturer","description":"Unattributed via Ransomware suspected. Sector: Manufacturing. Severity: Sev 2. Status: Closed.","labels":["Manufacturing","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0415"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0412","created_by_ref":"identity--forensicpost","name":"25-0412 — DaVita","description":"Interlock via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Closed. Dwell: 19 days.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0412"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0411","created_by_ref":"identity--forensicpost","name":"25-0411 — File-transfer estate","description":"Cl0p via Edge product exploitation. Sector: Multiple. Severity: Sev 5. Status: Open.","labels":["Multiple","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0411"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0410","created_by_ref":"identity--forensicpost","name":"25-0410 — Laboratory Services Cooperative","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0410"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0409","created_by_ref":"identity--forensicpost","name":"25-0409 — Blue Shield of California","description":"Unattributed via Not established. Sector: Insurance. Severity: Sev 4. Status: Closed.","labels":["Insurance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0409"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0408","created_by_ref":"identity--forensicpost","name":"25-0408 — German Association for East European Studies","description":"Unattributed via Not established. Sector: Education. Severity: Sev 3. Status: Open.","labels":["Education","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0408"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0403","created_by_ref":"identity--forensicpost","name":"25-0403 — Hertz","description":"Cl0p via Supplier product exploitation. Sector: Travel. Severity: Sev 4. Status: Closed.","labels":["Travel","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0403"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0402","created_by_ref":"identity--forensicpost","name":"25-0402 — Ransomware ecosystem","description":"Multiple via Ransomware-as-a-service. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0402"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0331","created_by_ref":"identity--forensicpost","name":"25-0331 — Mobile-first markets","description":"Multiple via Various. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0331"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0325","created_by_ref":"identity--forensicpost","name":"25-0325 — Understaffed organisations","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0325"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0320","created_by_ref":"identity--forensicpost","name":"25-0320 — Mexican banks","description":"Multiple via Account takeover. Sector: Finance. Severity: Sev 3. Status: Open.","labels":["Finance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0320"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0317","created_by_ref":"identity--forensicpost","name":"25-0317 — Latin American consumers","description":"Multiple via Social engineering. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0317"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0314","created_by_ref":"identity--forensicpost","name":"25-0314 — Not applicable","description":"Medusa via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0314"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0312","created_by_ref":"identity--forensicpost","name":"25-0312 — Critical infrastructure","description":"Medusa via Various. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0312"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0311","created_by_ref":"identity--forensicpost","name":"25-0311 — SaaS consent models","description":"Multiple via Consent phishing. Sector: Cloud. Severity: Sev 3. Status: Open.","labels":["Cloud","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0311"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0308","created_by_ref":"identity--forensicpost","name":"25-0308 — Yale New Haven Health System","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0308"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0304","created_by_ref":"identity--forensicpost","name":"25-0304 — US telecommunications carriers","description":"Salt Typhoon via Lawful-intercept infrastructure. Sector: Telecom. Severity: Sev 5. Status: Open.","labels":["Telecom","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0304"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0228","created_by_ref":"identity--forensicpost","name":"25-0228 — US community water systems","description":"Not applicable via Not applicable. Sector: Water. Severity: Sev 3. Status: Open.","labels":["Water","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0228"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0227","created_by_ref":"identity--forensicpost","name":"25-0227 — Not applicable","description":"Black Basta via Extortion. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0227"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0226","created_by_ref":"identity--forensicpost","name":"25-0226 — Not applicable","description":"Black Basta via Not applicable. Sector: Multiple. Severity: Sev 2. Status: Open.","labels":["Multiple","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0226"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0225","created_by_ref":"identity--forensicpost","name":"25-0225 — Not applicable","description":"Black Basta via Not applicable. Sector: Criminal. Severity: Sev 3. Status: Closed.","labels":["Criminal","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0225"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0224","created_by_ref":"identity--forensicpost","name":"25-0224 — Language model systems","description":"Multiple via Prompt injection. Sector: Cloud. Severity: Sev 4. Status: Open.","labels":["Cloud","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0224"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0223","created_by_ref":"identity--forensicpost","name":"25-0223 — Not applicable","description":"Black Basta via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0223"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0222","created_by_ref":"identity--forensicpost","name":"25-0222 — Not applicable","description":"Black Basta via Not applicable. Sector: Criminal. Severity: Sev 2. Status: Open.","labels":["Criminal","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0222"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0221","created_by_ref":"identity--forensicpost","name":"25-0221 — Bybit","description":"TraderTraitor / Lazarus via Not established. Sector: Finance. Severity: Sev 5. Status: Closed.","labels":["Finance","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0221"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0220","created_by_ref":"identity--forensicpost","name":"25-0220 — Enterprise staff","description":"Black Basta and successors via Social engineering. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0220"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0219","created_by_ref":"identity--forensicpost","name":"25-0219 — Security practitioners","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0219"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0218","created_by_ref":"identity--forensicpost","name":"25-0218 — Black Basta","description":"Internal via Disclosure. Sector: Criminal. Severity: Sev 3. Status: Closed.","labels":["Criminal","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0218"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0217","created_by_ref":"identity--forensicpost","name":"25-0217 — Cleo customers","description":"Cl0p via Edge product exploitation. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0217"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0216","created_by_ref":"identity--forensicpost","name":"25-0216 — Southern Water","description":"Black Basta via Not established. Sector: Water. Severity: Sev 4. Status: Closed.","labels":["Water","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0216"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0215","created_by_ref":"identity--forensicpost","name":"25-0215 — Multiple, unidentified","description":"Black Basta via Extortion pricing. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0215"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0214","created_by_ref":"identity--forensicpost","name":"25-0214 — Western Alliance Bank","description":"Unattributed via Zero-day exploitation. Sector: Finance. Severity: Sev 3. Status: Closed.","labels":["Finance","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0214"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0213","created_by_ref":"identity--forensicpost","name":"25-0213 — Telecommunications firms","description":"Salt Typhoon via Not established. Sector: Telecom. Severity: Sev 4. Status: Open.","labels":["Telecom","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0213"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0212","created_by_ref":"identity--forensicpost","name":"25-0212 — Enterprise edge estate","description":"Black Basta via Vulnerability exploitation. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0212"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0211","created_by_ref":"identity--forensicpost","name":"25-0211 — Black Basta","description":"ExploitWhispers via Insider disclosure. Sector: Criminal. Severity: Sev 5. Status: Closed.","labels":["Criminal","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0211"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0210","created_by_ref":"identity--forensicpost","name":"25-0210 — PIH Health","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0210"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0208","created_by_ref":"identity--forensicpost","name":"25-0208 — US consumers","description":"Multiple via Social engineering. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0208"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0127b","created_by_ref":"identity--forensicpost","name":"25-0127b — Frederick Health","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0127b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0127","created_by_ref":"identity--forensicpost","name":"25-0127 — Frederick Health Medical Group","description":"Unattributed via Ransomware. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0127"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0123b","created_by_ref":"identity--forensicpost","name":"25-0123b — Otelier","description":"Unattributed via Not established. Sector: Hospitality. Severity: Sev 4. Status: Open.","labels":["Hospitality","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0123b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0117","created_by_ref":"identity--forensicpost","name":"25-0117 — EU financial entities","description":"Regulator via Not applicable. Sector: Finance. Severity: Sev 2. Status: Open.","labels":["Finance","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0117"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0109","created_by_ref":"identity--forensicpost","name":"25-0109 — Ivanti Connect Secure estates","description":"Multiple via Zero-day exploitation. Sector: Cloud. Severity: Sev 4. Status: Closed.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0109"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-25-0105","created_by_ref":"identity--forensicpost","name":"25-0105 — PowerSchool","description":"Unaffiliated individual via Compromised credentials. Sector: Education. Severity: Sev 5. Status: Closed.","labels":["Education","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"25-0105"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1231","created_by_ref":"identity--forensicpost","name":"24-1231 — Not applicable","description":"Multiple via Not applicable. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1231"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1219","created_by_ref":"identity--forensicpost","name":"24-1219 — Ascension","description":"Black Basta via Malicious file download. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1219"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1213","created_by_ref":"identity--forensicpost","name":"24-1213 — RIBridges","description":"Brain Cipher via Contractor VPN credentials. Sector: Government. Severity: Sev 5. Status: Closed. Dwell: 150 days.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1213"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1205","created_by_ref":"identity--forensicpost","name":"24-1205 — Blue Yonder","description":"Termite via Extortion. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1205"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1203","created_by_ref":"identity--forensicpost","name":"24-1203 — US telecommunications carriers","description":"Salt Typhoon via Not applicable. Sector: Telecom. Severity: Sev 5. Status: Open.","labels":["Telecom","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1203"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1129","created_by_ref":"identity--forensicpost","name":"24-1129 — Krispy Kreme","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1129"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1126","created_by_ref":"identity--forensicpost","name":"24-1126 — Firefox and Windows users","description":"RomCom via CVE-2024-9680 chained with CVE-2024-49039. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1126"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1125","created_by_ref":"identity--forensicpost","name":"24-1125 — Blue Yonder customers","description":"Termite via Not applicable. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1125"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1121","created_by_ref":"identity--forensicpost","name":"24-1121 — Blue Yonder","description":"Termite via Not established. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1121"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1120","created_by_ref":"identity--forensicpost","name":"24-1120 — Finastra","description":"Unattributed via Not established. Sector: Financial services. Severity: Sev 4. Status: Closed. Dwell: 8 days.","labels":["Financial services","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1120"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1104","created_by_ref":"identity--forensicpost","name":"24-1104 — Nokia","description":"IntelBroker via Third-party contractor server. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1104"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1031","created_by_ref":"identity--forensicpost","name":"24-1031 — Sophos perimeter devices","description":"China-based groups, per the vendor via Edge-device vulnerabilities. Sector: Technology. Severity: Sev 5. Status: Closed.","labels":["Technology","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1031"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1030","created_by_ref":"identity--forensicpost","name":"24-1030 — Not applicable","description":"UNC5537 via Not applicable. Sector: Multiple. Severity: Sev 3. Status: Open.","labels":["Multiple","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1030"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1029","created_by_ref":"identity--forensicpost","name":"24-1029 — East Asian internet provider","description":"Unattributed via UDP flood, Mirai-variant botnet. Sector: Telecom. Severity: Sev 3. Status: Closed.","labels":["Telecom","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1029"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1028","created_by_ref":"identity--forensicpost","name":"24-1028 — RedLine and META users","description":"Regulator via Infostealer malware. Sector: Multiple. Severity: Sev 3. Status: Closed.","labels":["Multiple","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1028"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1026","created_by_ref":"identity--forensicpost","name":"24-1026 — Free SAS","description":"Unattributed via Not established. Sector: Telecom. Severity: Sev 5. Status: Closed.","labels":["Telecom","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1026"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1025","created_by_ref":"identity--forensicpost","name":"24-1025 — Hot Topic","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1025"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1024","created_by_ref":"identity--forensicpost","name":"24-1024 — City of Columbus","description":"Rhysida via Not applicable. Sector: Public sector. Severity: Sev 3. Status: Closed.","labels":["Public sector","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1024"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1023","created_by_ref":"identity--forensicpost","name":"24-1023 — Landmark Admin","description":"Unattributed via Not established. Sector: Insurance. Severity: Sev 4. Status: Closed.","labels":["Insurance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1023"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1015","created_by_ref":"identity--forensicpost","name":"24-1015 — National Public Data","description":"USDoD via Not applicable. Sector: Data broker. Severity: Sev 4. Status: Closed.","labels":["Data broker","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1015"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1010","created_by_ref":"identity--forensicpost","name":"24-1010 — Star Health and Allied Insurance","description":"Not established via Not applicable. Sector: Insurance. Severity: Sev 3. Status: Open.","labels":["Insurance","Open","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1010"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1009","created_by_ref":"identity--forensicpost","name":"24-1009 — Internet Archive","description":"Unattributed via Not established. Sector: Non-profit. Severity: Sev 3. Status: Closed.","labels":["Non-profit","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1009"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1008","created_by_ref":"identity--forensicpost","name":"24-1008 — Casio","description":"Unattributed via Not established. Sector: Manufacturing. Severity: Sev 3. Status: Closed.","labels":["Manufacturing","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1008"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1006","created_by_ref":"identity--forensicpost","name":"24-1006 — Lawful-intercept systems","description":"Salt Typhoon via Not established. Sector: Telecom. Severity: Sev 5. Status: Open.","labels":["Telecom","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1006"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1004","created_by_ref":"identity--forensicpost","name":"24-1004 — US telecommunications carriers","description":"Salt Typhoon via Not established. Sector: Telecom. Severity: Sev 5. Status: Open.","labels":["Telecom","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1004"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-1001","created_by_ref":"identity--forensicpost","name":"24-1001 — National Public Data","description":"USDoD via Not established. Sector: Data broker. Severity: Sev 4. Status: Closed.","labels":["Data broker","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-1001"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0920","created_by_ref":"identity--forensicpost","name":"24-0920 — Star Health and Allied Insurance","description":"Not established via Not established. Sector: Insurance. Severity: Sev 5. Status: Open.","labels":["Insurance","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0920"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0911","created_by_ref":"identity--forensicpost","name":"24-0911 — Unnamed Southeast Asian government body","description":"Clusters Alpha, Bravo, Charlie via Not established. Sector: Government. Severity: Sev 4. Status: Open.","labels":["Government","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0911"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0910","created_by_ref":"identity--forensicpost","name":"24-0910 — Transport for London","description":"Scattered Spider via Not applicable. Sector: Public sector. Severity: Sev 3. Status: Closed.","labels":["Public sector","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0910"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0905","created_by_ref":"identity--forensicpost","name":"24-0905 — Transport for London","description":"Scattered Spider via Not established. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0905"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0901","created_by_ref":"identity--forensicpost","name":"24-0901 — Transport for London","description":"Scattered Spider via Not established. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0901"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0829","created_by_ref":"identity--forensicpost","name":"24-0829 — City of Columbus","description":"Rhysida via Not applicable. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0829"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0821","created_by_ref":"identity--forensicpost","name":"24-0821 — Halliburton","description":"RansomHub via Not established. Sector: Energy services. Severity: Sev 3. Status: Closed.","labels":["Energy services","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0821"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0813","created_by_ref":"identity--forensicpost","name":"24-0813 — City of Columbus","description":"Rhysida via Not applicable. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0813"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0812","created_by_ref":"identity--forensicpost","name":"24-0812 — National Public Data","description":"USDoD via Not established. Sector: Data broker. Severity: Sev 4. Status: Closed.","labels":["Data broker","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0812"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0808","created_by_ref":"identity--forensicpost","name":"24-0808 — Sellafield Ltd","description":"Not applicable via Not applicable. Sector: Energy. Severity: Sev 3. Status: Closed.","labels":["Energy","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0808"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0806","created_by_ref":"identity--forensicpost","name":"24-0806 — National Public Data","description":"USDoD via Not established. Sector: Data broker. Severity: Sev 4. Status: Closed.","labels":["Data broker","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0806"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0725","created_by_ref":"identity--forensicpost","name":"24-0725 — Not applicable","description":"Not applicable via Not applicable. Sector: Multiple. Severity: Sev 4. Status: Open.","labels":["Multiple","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0725"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0722","created_by_ref":"identity--forensicpost","name":"24-0722 — CrowdStrike Falcon customers","description":"Not applicable via Faulty vendor update. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0722"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0720","created_by_ref":"identity--forensicpost","name":"24-0720 — CrowdStrike Falcon customers","description":"Not applicable via Faulty vendor update. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0720"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0719","created_by_ref":"identity--forensicpost","name":"24-0719 — CrowdStrike Falcon customers","description":"Not applicable via Faulty vendor update. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0719"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0718","created_by_ref":"identity--forensicpost","name":"24-0718 — City of Columbus","description":"Rhysida via Not established. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0718"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0716","created_by_ref":"identity--forensicpost","name":"24-0716 — Advance Auto Parts","description":"UNC5537 via Third-party cloud platform access. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0716"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0714","created_by_ref":"identity--forensicpost","name":"24-0714 — Rite Aid","description":"RansomHub via Not established. Sector: Retail. Severity: Sev 4. Status: Closed. Dwell: 1 days.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0714"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0713","created_by_ref":"identity--forensicpost","name":"24-0713 — Disney","description":"NullBulge via Not established. Sector: Media. Severity: Sev 4. Status: Closed.","labels":["Media","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0713"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0712","created_by_ref":"identity--forensicpost","name":"24-0712 — AT&T","description":"UNC5537 via Valid credentials, no MFA. Sector: Telecom. Severity: Sev 5. Status: Closed.","labels":["Telecom","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0712"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0711","created_by_ref":"identity--forensicpost","name":"24-0711 — CDK Global","description":"BlackSuit via Extortion. Sector: Automotive. Severity: Sev 5. Status: Closed.","labels":["Automotive","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0711"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0710","created_by_ref":"identity--forensicpost","name":"24-0710 — Squarespace domain customers","description":"Unattributed via Account takeover after migration. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0710"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0703","created_by_ref":"identity--forensicpost","name":"24-0703 — Twilio Authy","description":"Unattributed via Unauthenticated API enumeration. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0703"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0702","created_by_ref":"identity--forensicpost","name":"24-0702 — Fintech customers","description":"LockBit via Not applicable. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0702"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0626","created_by_ref":"identity--forensicpost","name":"24-0626 — Evolve Bank & Trust","description":"LockBit via Malicious link. Sector: Finance. Severity: Sev 5. Status: Closed.","labels":["Finance","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0626"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0625","created_by_ref":"identity--forensicpost","name":"24-0625 — Neiman Marcus","description":"UNC5537 via Third-party cloud database access. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0625"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0624","created_by_ref":"identity--forensicpost","name":"24-0624 — Synnovis","description":"Qilin via Extortion. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0624"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0623","created_by_ref":"identity--forensicpost","name":"24-0623 — Evolve Bank & Trust","description":"LockBit via Not established. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0623"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0620","created_by_ref":"identity--forensicpost","name":"24-0620 — Change Healthcare","description":"ALPHV via Valid credentials, no MFA. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0620"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0618","created_by_ref":"identity--forensicpost","name":"24-0618 — CDK Global","description":"BlackSuit via Not established. Sector: Automotive. Severity: Sev 5. Status: Closed.","labels":["Automotive","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0618"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0610","created_by_ref":"identity--forensicpost","name":"24-0610 — Synnovis","description":"Qilin via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0610"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0604","created_by_ref":"identity--forensicpost","name":"24-0604 — Synnovis","description":"Qilin via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0604"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0603","created_by_ref":"identity--forensicpost","name":"24-0603 — Synnovis","description":"Qilin via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0603"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0602","created_by_ref":"identity--forensicpost","name":"24-0602 — Snowflake customer environments","description":"UNC5537 via Stolen credentials, no MFA. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0602"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0531","created_by_ref":"identity--forensicpost","name":"24-0531 — Ticketmaster","description":"UNC5537 via Valid credentials, no MFA. Sector: Entertainment. Severity: Sev 4. Status: Closed.","labels":["Entertainment","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0531"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0530","created_by_ref":"identity--forensicpost","name":"24-0530 — Snowflake tenants","description":"UNC5537 via Valid credentials, no MFA. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0530"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0527","created_by_ref":"identity--forensicpost","name":"24-0527 — Christie’s","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed. Dwell: 1 days.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0527"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0514","created_by_ref":"identity--forensicpost","name":"24-0514 — Santander","description":"Unattributed via Third-party database access. Sector: Financial services. Severity: Sev 4. Status: Closed.","labels":["Financial services","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0514"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0510","created_by_ref":"identity--forensicpost","name":"24-0510 — Dell","description":"Unattributed via Partner portal enumeration. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0510"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0509","created_by_ref":"identity--forensicpost","name":"24-0509 — Ascension","description":"Black Basta via Malicious file download. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0509"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0508","created_by_ref":"identity--forensicpost","name":"24-0508 — Ascension","description":"Black Basta via Malicious file download. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0508"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0505","created_by_ref":"identity--forensicpost","name":"24-0505 — City of Wichita","description":"Unattributed via Not established. Sector: Government. Severity: Sev 3. Status: Closed.","labels":["Government","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0505"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0425","created_by_ref":"identity--forensicpost","name":"24-0425 — Kaiser Permanente","description":"Not applicable via Tracking technology, by design. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0425"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0417","created_by_ref":"identity--forensicpost","name":"24-0417 — Frontier Communications","description":"RansomHub via Not established. Sector: Telecom. Severity: Sev 4. Status: Closed.","labels":["Telecom","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0417"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0413","created_by_ref":"identity--forensicpost","name":"24-0413 — MediSecure","description":"Not established via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0413"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0405","created_by_ref":"identity--forensicpost","name":"24-0405 — Change Healthcare","description":"RansomHub via Re-extortion. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0405"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0329","created_by_ref":"identity--forensicpost","name":"24-0329 — Omni Hotels & Resorts","description":"Daixin Team via Not established. Sector: Hospitality. Severity: Sev 4. Status: Closed.","labels":["Hospitality","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0329"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0322","created_by_ref":"identity--forensicpost","name":"24-0322 — Panera Bread","description":"Unattributed via Not established. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0322"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0317","created_by_ref":"identity--forensicpost","name":"24-0317 — Fujitsu","description":"Unattributed via Not established. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0317"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0314","created_by_ref":"identity--forensicpost","name":"24-0314 — Giant Tiger","description":"Unattributed via Third-party vendor compromise. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0314"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0313","created_by_ref":"identity--forensicpost","name":"24-0313 — France Travail","description":"Unattributed via Not established. Sector: Government. Severity: Sev 5. Status: Closed. Dwell: 28 days.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0313"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0306","created_by_ref":"identity--forensicpost","name":"24-0306 — American Express","description":"Unattributed via Third-party processor compromise. Sector: Financial services. Severity: Sev 3. Status: Closed.","labels":["Financial services","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0306"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0301","created_by_ref":"identity--forensicpost","name":"24-0301 — Change Healthcare","description":"ALPHV via Extortion. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0301"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0221b","created_by_ref":"identity--forensicpost","name":"24-0221b — Cencora","description":"Dark Angels via Not established. Sector: Pharmaceutical distribution. Severity: Sev 4. Status: Closed.","labels":["Pharmaceutical distribution","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0221b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0221","created_by_ref":"identity--forensicpost","name":"24-0221 — Change Healthcare","description":"ALPHV via Valid credentials, no MFA. Sector: Healthcare. Severity: Sev 5. Status: Closed. Dwell: 9 days.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0221"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0212","created_by_ref":"identity--forensicpost","name":"24-0212 — Change Healthcare","description":"ALPHV via Valid credentials, no MFA. Sector: Healthcare. Severity: Sev 5. Status: Closed. Dwell: 9 days.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0212"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0123","created_by_ref":"identity--forensicpost","name":"24-0123 — Trello","description":"Unattributed via Unauthenticated API enumeration. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0123"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0112","created_by_ref":"identity--forensicpost","name":"24-0112 — Microsoft","description":"Midnight Blizzard via Password spray. Sector: Cloud. Severity: Sev 4. Status: Closed. Dwell: 45 days.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0112"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-24-0110","created_by_ref":"identity--forensicpost","name":"24-0110 — Ivanti Connect Secure operators","description":"Multiple via Vulnerability chaining. Sector: Cloud. Severity: Sev 4. Status: Closed.","labels":["Cloud","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"24-0110"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1224","created_by_ref":"identity--forensicpost","name":"23-1224 — Integris Health","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed. Dwell: 26 days.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1224"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1220","created_by_ref":"identity--forensicpost","name":"23-1220 — MongoDB","description":"Unattributed via Phishing. Sector: Technology. Severity: Sev 2. Status: Closed. Dwell: 71 days.","labels":["Technology","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1220"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1219","created_by_ref":"identity--forensicpost","name":"23-1219 — Insomniac Games","description":"Rhysida via Not established. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1219"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1218","created_by_ref":"identity--forensicpost","name":"23-1218 — Comcast Xfinity","description":"Unattributed via Memory disclosure. Sector: Telecom. Severity: Sev 4. Status: Closed. Dwell: 3 days.","labels":["Telecom","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1218"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1212","created_by_ref":"identity--forensicpost","name":"23-1212 — Kyivstar","description":"Sandworm via Not established. Sector: Telecom. Severity: Sev 5. Status: Closed. Dwell: 214 days.","labels":["Telecom","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1212"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1204","created_by_ref":"identity--forensicpost","name":"23-1204 — 23andMe","description":"Unattributed via Credential stuffing. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1204"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1125","created_by_ref":"identity--forensicpost","name":"23-1125 — Municipal Water Authority of Aliquippa","description":"CyberAv3ngers via Default credentials. Sector: Water. Severity: Sev 4. Status: Closed.","labels":["Water","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1125"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1123","created_by_ref":"identity--forensicpost","name":"23-1123 — Ardent Health Services","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1123"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1119","created_by_ref":"identity--forensicpost","name":"23-1119 — Fidelity National Financial","description":"Unattributed via Credential compromise. Sector: Finance. Severity: Sev 4. Status: Closed.","labels":["Finance","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1119"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1117","created_by_ref":"identity--forensicpost","name":"23-1117 — Welltok","description":"Cl0p via SQL injection. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1117"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1110","created_by_ref":"identity--forensicpost","name":"23-1110 — Boeing","description":"LockBit via CVE-2023-4966 — Citrix Bleed. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1110"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1108","created_by_ref":"identity--forensicpost","name":"23-1108 — ICBC Financial Services","description":"LockBit via Ransomware. Sector: Finance. Severity: Sev 5. Status: Closed.","labels":["Finance","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1108"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1031","created_by_ref":"identity--forensicpost","name":"23-1031 — Mr Cooper","description":"Unattributed via Not established. Sector: Financial services. Severity: Sev 5. Status: Closed. Dwell: 3 days.","labels":["Financial services","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1031"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1030","created_by_ref":"identity--forensicpost","name":"23-1030 — SolarWinds","description":"Regulator via Not applicable. Sector: Technology. Severity: Sev 2. Status: Open.","labels":["Technology","Open","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1030"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1028","created_by_ref":"identity--forensicpost","name":"23-1028 — British Library","description":"Rhysida via Partner terminal server, no MFA. Sector: Non-profit. Severity: Sev 5. Status: Closed. Dwell: 3 days.","labels":["Non-profit","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1028"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1020","created_by_ref":"identity--forensicpost","name":"23-1020 — Okta","description":"Unattributed via Stolen credentials. Sector: Technology. Severity: Sev 4. Status: Closed. Dwell: 19 days.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1020"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1016","created_by_ref":"identity--forensicpost","name":"23-1016 — Cisco IOS XE devices","description":"Unattributed via Unauthenticated privilege escalation. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1016"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1010b","created_by_ref":"identity--forensicpost","name":"23-1010b — HTTP/2 implementations","description":"Unattributed via CVE-2023-44487. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1010b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-1010","created_by_ref":"identity--forensicpost","name":"23-1010 — Citrix NetScaler appliances","description":"LockBit affiliates via Memory disclosure. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-1010"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0923","created_by_ref":"identity--forensicpost","name":"23-0923 — Johnson Controls International","description":"Dark Angels via Ransomware. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0923"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0919","created_by_ref":"identity--forensicpost","name":"23-0919 — International Criminal Court","description":"Unattributed via Not established. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0919"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0918","created_by_ref":"identity--forensicpost","name":"23-0918 — Microsoft AI research","description":"Exposure via Misconfiguration. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0918"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0913","created_by_ref":"identity--forensicpost","name":"23-0913 — Retool","description":"Unattributed via SMS phishing. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0913"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0911","created_by_ref":"identity--forensicpost","name":"23-0911 — MGM Resorts International","description":"Scattered Spider via Social engineering. Sector: Hospitality. Severity: Sev 4. Status: Closed.","labels":["Hospitality","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0911"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0907","created_by_ref":"identity--forensicpost","name":"23-0907 — Caesars Entertainment","description":"Scattered Spider via Social engineering — third-party help desk. Sector: Hospitality. Severity: Sev 4. Status: Closed.","labels":["Hospitality","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0907"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0823","created_by_ref":"identity--forensicpost","name":"23-0823 — Duolingo","description":"Unattributed via API scraping. Sector: Technology. Severity: Sev 2. Status: Closed.","labels":["Technology","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0823"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0818b","created_by_ref":"identity--forensicpost","name":"23-0818b — CloudNordic and AzeroCloud","description":"Unattributed via Pre-existing infection, network merged. Sector: Technology. Severity: Sev 5. Status: Closed.","labels":["Technology","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0818b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0818","created_by_ref":"identity--forensicpost","name":"23-0818 — Tesla","description":"Insider — former employees via Authorised access, unauthorised disclosure. Sector: Manufacturing. Severity: Sev 3. Status: Closed.","labels":["Manufacturing","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0818"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0814","created_by_ref":"identity--forensicpost","name":"23-0814 — The Clorox Company","description":"Unattributed via Not established. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0814"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0808b","created_by_ref":"identity--forensicpost","name":"23-0808b — UK Electoral Commission","description":"Unattributed via Impersonated account, known weaknesses. Sector: Government. Severity: Sev 4. Status: Closed. Dwell: 425 days.","labels":["Government","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0808b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0808","created_by_ref":"identity--forensicpost","name":"23-0808 — Police Service of Northern Ireland","description":"Not applicable via Accidental disclosure. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0808"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0728","created_by_ref":"identity--forensicpost","name":"23-0728 — Maximus","description":"Cl0p via SQL injection. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0728"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0724","created_by_ref":"identity--forensicpost","name":"23-0724 — Norwegian government ministries","description":"Unattributed via CVE-2023-35078 — zero-day. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0724"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0715","created_by_ref":"identity--forensicpost","name":"23-0715 — The Estée Lauder Companies","description":"ALPHV, Cl0p via MOVEit (Cl0p); not established (ALPHV). Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0715"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0712","created_by_ref":"identity--forensicpost","name":"23-0712 — JumpCloud","description":"UNC4899 via Spear-phishing. Sector: Technology. Severity: Sev 4. Status: Closed. Dwell: 13 days.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0712"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0711","created_by_ref":"identity--forensicpost","name":"23-0711 — Exchange Online tenants","description":"Storm-0558 via Forged authentication tokens. Sector: Public sector. Severity: Sev 5. Status: Closed. Dwell: 32 days.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0711"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0710","created_by_ref":"identity--forensicpost","name":"23-0710 — HCA Healthcare","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0710"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0625","created_by_ref":"identity--forensicpost","name":"23-0625 — Suncor Energy","description":"Unattributed via Not established. Sector: Energy. Severity: Sev 4. Status: Closed.","labels":["Energy","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0625"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0619","created_by_ref":"identity--forensicpost","name":"23-0619 — Reddit","description":"ALPHV/BlackCat via Phishing. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0619"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0616","created_by_ref":"identity--forensicpost","name":"23-0616 — St Margaret’s Health","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0616"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0614","created_by_ref":"identity--forensicpost","name":"23-0614 — Xplain / Swiss Federal Administration","description":"Play via Not established. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0614"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0608","created_by_ref":"identity--forensicpost","name":"23-0608 — Honda dealer platform","description":"Not applicable via Broken authentication. Sector: Manufacturing. Severity: Sev 2. Status: Closed.","labels":["Manufacturing","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0608"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0601b","created_by_ref":"identity--forensicpost","name":"23-0601b — Oregon DMV and Louisiana OMV","description":"Cl0p via SQL injection. Sector: Public sector. Severity: Sev 5. Status: Closed.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0601b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0601","created_by_ref":"identity--forensicpost","name":"23-0601 — MOVEit Transfer customers","description":"Cl0p via SQL injection. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0601"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0524","created_by_ref":"identity--forensicpost","name":"23-0524 — US critical infrastructure","description":"Volt Typhoon via Living off the land. Sector: Public sector. Severity: Sev 5. Status: Open.","labels":["Public sector","Open","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0524"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0518","created_by_ref":"identity--forensicpost","name":"23-0518 — Barracuda ESG appliances","description":"UNC4841 via Zero-day exploitation. Sector: Multiple. Severity: Sev 5. Status: Closed. Dwell: 210 days.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0518"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0512c","created_by_ref":"identity--forensicpost","name":"23-0512c — Discord","description":"Unattributed via Third-party account compromise. Sector: Technology. Severity: Sev 2. Status: Closed.","labels":["Technology","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0512c"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0512b","created_by_ref":"identity--forensicpost","name":"23-0512b — PharMerica","description":"Money Message via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed. Dwell: 2 days.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0512b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0512","created_by_ref":"identity--forensicpost","name":"23-0512 — Toyota Motor Corporation","description":"Exposure via Misconfiguration. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0512"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0502","created_by_ref":"identity--forensicpost","name":"23-0502 — Sysco Corporation","description":"Unattributed via Not established. Sector: Food and agriculture. Severity: Sev 4. Status: Closed. Dwell: 50 days.","labels":["Food and agriculture","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0502"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0420","created_by_ref":"identity--forensicpost","name":"23-0420 — 3CX","description":"UNC4736 via Trojanised X_TRADER installer. Sector: Technology. Severity: Sev 5. Status: Closed.","labels":["Technology","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0420"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0413","created_by_ref":"identity--forensicpost","name":"23-0413 — PaperCut MF/NG operators","description":"Cl0p, LockBit via CVE-2023-27350. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0413"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0412","created_by_ref":"identity--forensicpost","name":"23-0412 — NCR Aloha customers","description":"ALPHV/BlackCat via Ransomware. Sector: Retail. Severity: Sev 4. Status: Closed.","labels":["Retail","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0412"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0407","created_by_ref":"identity--forensicpost","name":"23-0407 — Micro-Star International","description":"Money Message via Ransomware. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0407"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0404","created_by_ref":"identity--forensicpost","name":"23-0404 — Genesis Market","description":"Not applicable via Not applicable. Sector: Not applicable. Severity: Sev 2. Status: Closed.","labels":["Not applicable","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0404"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0402","created_by_ref":"identity--forensicpost","name":"23-0402 — Western Digital","description":"Unattributed via Not established. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0402"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0331","created_by_ref":"identity--forensicpost","name":"23-0331 — Capita","description":"Black Basta via Malicious file execution. Sector: Public sector. Severity: Sev 5. Status: Closed. Dwell: 9 days.","labels":["Public sector","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0331"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0329","created_by_ref":"identity--forensicpost","name":"23-0329 — 3CX","description":"UNC4736 via Supply chain compromise. Sector: Technology. Severity: Sev 5. Status: Closed.","labels":["Technology","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0329"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0324","created_by_ref":"identity--forensicpost","name":"23-0324 — OpenAI","description":"Not applicable via Software defect. Sector: Technology. Severity: Sev 2. Status: Closed.","labels":["Technology","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0324"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0320","created_by_ref":"identity--forensicpost","name":"23-0320 — Ferrari","description":"Unattributed via Not established. Sector: Manufacturing. Severity: Sev 3. Status: Closed.","labels":["Manufacturing","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0320"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0317","created_by_ref":"identity--forensicpost","name":"23-0317 — American Bar Association","description":"Unattributed via Decommissioned system. Sector: Legal. Severity: Sev 3. Status: Closed. Dwell: 11 days.","labels":["Legal","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0317"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0316","created_by_ref":"identity--forensicpost","name":"23-0316 — Latitude Financial","description":"Unattributed via Stolen credentials. Sector: Finance. Severity: Sev 5. Status: Closed.","labels":["Finance","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0316"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0227","created_by_ref":"identity--forensicpost","name":"23-0227 — LastPass","description":"Unattributed via Keylogger on personal device. Sector: Technology. Severity: Sev 5. Status: Closed.","labels":["Technology","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0227"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0223","created_by_ref":"identity--forensicpost","name":"23-0223 — DISH Network","description":"Unattributed via Ransomware. Sector: Telecom. Severity: Sev 4. Status: Closed.","labels":["Telecom","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0223"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0217","created_by_ref":"identity--forensicpost","name":"23-0217 — US Marshals Service","description":"Unattributed via Not established. Sector: Government. Severity: Sev 4. Status: Closed.","labels":["Government","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0217"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0210","created_by_ref":"identity--forensicpost","name":"23-0210 — Dole Food Company","description":"Unattributed via Not established. Sector: Food and agriculture. Severity: Sev 4. Status: Closed.","labels":["Food and agriculture","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0210"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0208","created_by_ref":"identity--forensicpost","name":"23-0208 — VMware ESXi servers","description":"Unattributed via Unpatched vulnerability. Sector: Multiple. Severity: Sev 4. Status: Closed.","labels":["Multiple","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0208"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0203","created_by_ref":"identity--forensicpost","name":"23-0203 — GoAnywhere MFT customers","description":"Cl0p via Command injection. Sector: Multiple. Severity: Sev 5. Status: Closed.","labels":["Multiple","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0203"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0125","created_by_ref":"identity--forensicpost","name":"23-0125 — Ukrainian organisations","description":"Sandworm via Group Policy deployment. Sector: Public sector. Severity: Sev 4. Status: Closed.","labels":["Public sector","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0125"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0124","created_by_ref":"identity--forensicpost","name":"23-0124 — Riot Games","description":"Unattributed via Social engineering. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0124"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0119","created_by_ref":"identity--forensicpost","name":"23-0119 — T-Mobile US","description":"Unattributed via API abuse. Sector: Telecom. Severity: Sev 4. Status: Closed. Dwell: 41 days.","labels":["Telecom","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0119"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0118","created_by_ref":"identity--forensicpost","name":"23-0118 — Yum! Brands","description":"Unattributed via Ransomware. Sector: Retail. Severity: Sev 3. Status: Closed.","labels":["Retail","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0118"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0110","created_by_ref":"identity--forensicpost","name":"23-0110 — Royal Mail","description":"LockBit via Ransomware. Sector: Logistics. Severity: Sev 4. Status: Closed.","labels":["Logistics","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0110"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-23-0104","created_by_ref":"identity--forensicpost","name":"23-0104 — CircleCI","description":"Unattributed via Session token theft. Sector: Technology. Severity: Sev 4. Status: Closed. Dwell: 19 days.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"23-0104"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1222","created_by_ref":"identity--forensicpost","name":"22-1222 — LastPass","description":"Unattributed via Compromised engineer endpoint. Sector: Technology. Severity: Sev 5. Status: Closed.","labels":["Technology","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1222"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1220","created_by_ref":"identity--forensicpost","name":"22-1220 — The Guardian","description":"Unattributed via Phishing — as reported. Sector: Media. Severity: Sev 3. Status: Closed.","labels":["Media","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1220"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1218","created_by_ref":"identity--forensicpost","name":"22-1218 — Hospital for Sick Children","description":"LockBit via Not established. Sector: Healthcare. Severity: Sev 3. Status: Closed.","labels":["Healthcare","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1218"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1202","created_by_ref":"identity--forensicpost","name":"22-1202 — Rackspace","description":"Play via CVE-2022-41080 — zero-day. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1202"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1111","created_by_ref":"identity--forensicpost","name":"22-1111 — AirAsia Group","description":"Daixin Team via Not established. Sector: Aviation. Severity: Sev 4. Status: Closed.","labels":["Aviation","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1111"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1104b","created_by_ref":"identity--forensicpost","name":"22-1104b — Continental","description":"LockBit via Not established. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1104b"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1104","created_by_ref":"identity--forensicpost","name":"22-1104 — Government of Vanuatu","description":"Unattributed via Phishing — as reported. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1104"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1101","created_by_ref":"identity--forensicpost","name":"22-1101 — Dropbox","description":"Unattributed via Phishing → OTP relay. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1101"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1024","created_by_ref":"identity--forensicpost","name":"22-1024 — Medibank","description":"Unattributed via Stolen credential. Sector: Healthcare. Severity: Sev 5. Status: Closed.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1024"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1020","created_by_ref":"identity--forensicpost","name":"22-1020 — Advocate Aurora Health","description":"Not applicable via Tracking technology, by design. Sector: Healthcare. Severity: Sev 4. Status: Closed.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1020"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1005","created_by_ref":"identity--forensicpost","name":"22-1005 — Uber","description":"Not applicable via Not applicable. Sector: Technology. Severity: Sev 2. Status: Closed.","labels":["Technology","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1005"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-1002","created_by_ref":"identity--forensicpost","name":"22-1002 — CommonSpirit Health","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 5. Status: Closed. Dwell: 16 days.","labels":["Healthcare","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-1002"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0930","created_by_ref":"identity--forensicpost","name":"22-0930 — On-premises Exchange operators","description":"Unattributed via CVE-2022-41040 → CVE-2022-41082. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0930"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0922","created_by_ref":"identity--forensicpost","name":"22-0922 — Optus","description":"Unattributed via Unauthenticated API. Sector: Telecommunications. Severity: Sev 5. Status: Closed.","labels":["Telecommunications","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0922"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0915","created_by_ref":"identity--forensicpost","name":"22-0915 — Uber","description":"Lapsus$ via MFA fatigue → social engineering. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0915"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0903","created_by_ref":"identity--forensicpost","name":"22-0903 — Los Angeles Unified School District","description":"Vice Society via Not established. Sector: Education. Severity: Sev 5. Status: Closed. Dwell: 34 days.","labels":["Education","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0903"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0826","created_by_ref":"identity--forensicpost","name":"22-0826 — Government of Montenegro","description":"Cuba ransomware (claimed) via Not established. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0826"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0825","created_by_ref":"identity--forensicpost","name":"22-0825 — LastPass","description":"Unattributed via Compromised developer account. Sector: Technology. Severity: Sev 3. Status: Closed. Dwell: 4 days.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0825"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0815","created_by_ref":"identity--forensicpost","name":"22-0815 — Signal","description":"Unattributed via Third-party compromise — Twilio. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0815"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0808","created_by_ref":"identity--forensicpost","name":"22-0808 — Twilio","description":"0ktapus via SMS phishing → credential relay. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0808"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0804","created_by_ref":"identity--forensicpost","name":"22-0804 — Slack","description":"Not applicable via Application defect. Sector: Technology. Severity: Sev 2. Status: Closed.","labels":["Technology","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0804"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0801","created_by_ref":"identity--forensicpost","name":"22-0801 — Nomad bridge","description":"Unattributed via Faulty upgrade — proof validation. Sector: Financial services. Severity: Sev 4. Status: Closed.","labels":["Financial services","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0801"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0721","created_by_ref":"identity--forensicpost","name":"22-0721 — Twitter","description":"Unattributed via Unauthenticated API lookup. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0721"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0720","created_by_ref":"identity--forensicpost","name":"22-0720 — Neopets","description":"Unattributed via Not established. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0720"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0715","created_by_ref":"identity--forensicpost","name":"22-0715 — Government of Albania","description":"Homeland Justice via Not established. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0715"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0705","created_by_ref":"identity--forensicpost","name":"22-0705 — Marriott International","description":"Unattributed via Social engineering. Sector: Hospitality. Severity: Sev 2. Status: Closed. Dwell: 1 days.","labels":["Hospitality","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0705"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0630","created_by_ref":"identity--forensicpost","name":"22-0630 — Shanghai National Police database","description":"Unattributed via Unsecured internet-facing interface. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0630"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0627","created_by_ref":"identity--forensicpost","name":"22-0627 — Iranian steel producers","description":"Predatory Sparrow via Industrial control system access. Sector: Manufacturing. Severity: Sev 5. Status: Closed.","labels":["Manufacturing","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0627"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0620","created_by_ref":"identity--forensicpost","name":"22-0620 — Industrial control devices","description":"Not applicable via Insecure by design. Sector: Manufacturing. Severity: Sev 4. Status: Open.","labels":["Manufacturing","Open","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0620"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0617","created_by_ref":"identity--forensicpost","name":"22-0617 — Flagstar Bank","description":"Unattributed via Not established. Sector: Financial services. Severity: Sev 4. Status: Closed. Dwell: 2 days.","labels":["Financial services","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0617"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0527","created_by_ref":"identity--forensicpost","name":"22-0527 — Windows users","description":"Unattributed via CVE-2022-30190 — zero-day. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0527"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0525","created_by_ref":"identity--forensicpost","name":"22-0525 — SpiceJet","description":"Unattributed via Not established. Sector: Aviation. Severity: Sev 3. Status: Closed.","labels":["Aviation","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0525"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0524","created_by_ref":"identity--forensicpost","name":"22-0524 — Cisco","description":"Yanluowang via Synced credentials → vishing → MFA push. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0524"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0523","created_by_ref":"identity--forensicpost","name":"22-0523 — Clearview AI","description":"Not applicable via Web scraping, by design. Sector: Technology. Severity: Sev 3. Status: Closed.","labels":["Technology","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0523"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0508","created_by_ref":"identity--forensicpost","name":"22-0508 — Government of Costa Rica","description":"Conti via Not established. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0508"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0417","created_by_ref":"identity--forensicpost","name":"22-0417 — Beanstalk Farms","description":"Unattributed via Flash loan governance capture. Sector: Financial services. Severity: Sev 4. Status: Closed.","labels":["Financial services","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0417"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0412","created_by_ref":"identity--forensicpost","name":"22-0412 — GitHub customers, incl. npm","description":"Unattributed via Stolen OAuth tokens. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0412"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0404","created_by_ref":"identity--forensicpost","name":"22-0404 — Block — Cash App Investing","description":"Single operator via Insider — retained access. Sector: Financial services. Severity: Sev 3. Status: Closed.","labels":["Financial services","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0404"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0328","created_by_ref":"identity--forensicpost","name":"22-0328 — Shields Health Care Group","description":"Unattributed via Not established. Sector: Healthcare. Severity: Sev 4. Status: Closed. Dwell: 14 days.","labels":["Healthcare","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0328"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0324","created_by_ref":"identity--forensicpost","name":"22-0324 — Lapsus$","description":"Not applicable via Not applicable. Sector: Not applicable. Severity: Sev 2. Status: Closed.","labels":["Not applicable","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0324"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0323","created_by_ref":"identity--forensicpost","name":"22-0323 — Ronin bridge","description":"Lazarus Group via Validator key compromise. Sector: Financial services. Severity: Sev 5. Status: Closed. Dwell: 6 days.","labels":["Financial services","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0323"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0322","created_by_ref":"identity--forensicpost","name":"22-0322 — Nvidia, Samsung, Microsoft","description":"Lapsus$ via Not established. Sector: Technology. Severity: Sev 4. Status: Closed.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0322"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0301","created_by_ref":"identity--forensicpost","name":"22-0301 — Toyota Motor Corporation","description":"Unattributed via Not established. Sector: Manufacturing. Severity: Sev 4. Status: Closed.","labels":["Manufacturing","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0301"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0227","created_by_ref":"identity--forensicpost","name":"22-0227 — Not applicable","description":"Conti via Not applicable. Sector: Not applicable. Severity: Sev 2. Status: Closed.","labels":["Not applicable","Closed","sev-2"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0227"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0224","created_by_ref":"identity--forensicpost","name":"22-0224 — Viasat KA-SAT users","description":"Sandworm via Network management compromise. Sector: Telecommunications. Severity: Sev 5. Status: Closed.","labels":["Telecommunications","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0224"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0220","created_by_ref":"identity--forensicpost","name":"22-0220 — Expeditors International","description":"Unattributed via Not established. Sector: Logistics. Severity: Sev 4. Status: Closed.","labels":["Logistics","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0220"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0202","created_by_ref":"identity--forensicpost","name":"22-0202 — Wormhole bridge","description":"Unattributed via Signature verification flaw. Sector: Financial services. Severity: Sev 4. Status: Closed.","labels":["Financial services","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0202"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0120","created_by_ref":"identity--forensicpost","name":"22-0120 — Okta","description":"Lapsus$ via Contractor remote access. Sector: Technology. Severity: Sev 4. Status: Closed. Dwell: 5 days.","labels":["Technology","Closed","sev-4"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0120"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0118","created_by_ref":"identity--forensicpost","name":"22-0118 — International Committee of the Red Cross","description":"Unattributed via Known CVE — unpatched. Sector: Non-profit. Severity: Sev 5. Status: Closed. Dwell: 70 days.","labels":["Non-profit","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0118"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0117","created_by_ref":"identity--forensicpost","name":"22-0117 — Crypto.com","description":"Unattributed via Two-factor authentication bypass. Sector: Financial services. Severity: Sev 3. Status: Closed.","labels":["Financial services","Closed","sev-3"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0117"}]},{"type":"incident","spec_version":"2.1","id":"incident--forensicpost-22-0114","created_by_ref":"identity--forensicpost","name":"22-0114 — Ukrainian government organisations","description":"Unattributed via Not established. Sector: Government. Severity: Sev 5. Status: Closed.","labels":["Government","Closed","sev-5"],"external_references":[{"source_name":"ForensicPost Case Files","external_id":"22-0114"}]}]}