{"licence":"CC-BY-4.0; attribution=\"ForensicPost Case Files\"","count":760,"files":[{"id":"26-0817","target":"Unisoc-based Android devices","actor":"Not applicable","vector":"VoLTE modem firmware to kernel","sector":"Technology","dwell":null,"sev":4,"status":"Open","jurisdiction":"Not established","sortDate":"2026-08-17","date":"17 August 2026","href":"/files/26-0817-unisoc-modem-flaw-gives-android-kernel-access-through-a-video-call"},{"id":"26-0813","target":"MyDr","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Open","jurisdiction":"Poland","geo":{"place":"Warsaw","country":"Poland","lon":21.0122,"lat":52.2297},"sortDate":"2026-08-13","date":"13 August 2026","href":"/files/26-0813-19-million-medical-records-stolen-in-polish-mydr-hack"},{"id":"26-0812","target":"Defence, aerospace and aviation firms","actor":"Lazarus Group","vector":"CVE-2026-68820 — Windows AFD.sys","sector":"Defence","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Not established","sortDate":"2026-08-12","date":"12 August 2026","href":"/files/26-0812-defence-aerospace-and-aviation-lazarus-paired-a-windows-zero-day"},{"id":"26-0811","target":"Metabase deployments","actor":"Unattributed","vector":"CVE-2026-72898","sector":"Technology","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2026-08-11","date":"11 August 2026","href":"/files/26-0811-metabase-zero-day-hit-five-companies-before-the-flaw-was-disclosed"},{"id":"26-0810b","target":"VMware vCenter operators","actor":"Unattributed","vector":"CVE-2026-59310","sector":"Multiple","dwell":null,"sev":5,"status":"Open","jurisdiction":"Germany","geo":{"place":"Berlin","country":"Germany","lon":13.405,"lat":52.52},"sortDate":"2026-08-10","date":"10 August 2026","href":"/files/26-0810b-vmware-vcenter-flaw-exploited-in-47-countries-within-a-week-of-the-patch"},{"id":"26-0810","target":"Multiple critical infrastructure sectors","actor":"Gunra","vector":"CVE-2024-55591, CVE-2025-24472","sector":"Multiple","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2026-08-10","date":"10 August 2026","href":"/files/26-0810-multiple-critical-infrastructure-six-agencies-warn-gunra-ransomware-runs"},{"id":"26-0808","target":"Polish combined heat and power plant","actor":"Unattributed","vector":"Private APN pivot to OT","sector":"Energy","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Poland","geo":{"place":"Warsaw","country":"Poland","lon":21.0122,"lat":52.2297},"sortDate":"2026-08-08","date":"8 August 2026","href":"/files/26-0808-polish-heat-plant-attackers-reached-the-plcs-through-a-private-apn"},{"id":"26-0807b","target":"Levi Strauss & Co.","actor":"Unattributed","vector":"Social engineering","sector":"Retail","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2026-08-07","date":"7 August 2026","href":"/files/26-0807b-levi-strauss-says-social-engineering-compromised-three-employee"},{"id":"26-0807","target":"Bank of Baroda","actor":"Unattributed","vector":"Compromised employee mailbox","sector":"Finance","dwell":null,"sev":4,"status":"Open","jurisdiction":"India","geo":{"place":"Vadodara","country":"India","lon":73.1812,"lat":22.3072},"sortDate":"2026-08-07","date":"7 August 2026","href":"/files/26-0807-bank-of-baroda-confirms-leak-after-employee-email-compromise-with-700gb"},{"id":"26-0806","target":"Amgen","actor":"Unattributed","vector":"Third-party cloud compromise","sector":"Pharma","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2026-08-06","date":"6 August 2026","href":"/files/26-0806-amgen-says-patient-health-data-was-taken-from-third-party-cloud-systems"},{"id":"26-0805","target":"Unitel","actor":"Unattributed","vector":"Not established","sector":"Telecom","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Angola","geo":{"place":"Luanda","country":"Angola","lon":13.2344,"lat":-8.8383},"sortDate":"2026-08-05","date":"5 August 2026","href":"/files/26-0805-unitel-outage-cut-voice-and-data-for-21-million-angolans-over-eight-days"},{"id":"26-0802b","target":"Ministry of Justice, Colombia","actor":"Unattributed","vector":"Not established","sector":"Government","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Colombia","geo":{"place":"Bogotá","country":"Colombia","lon":-74.0721,"lat":4.711},"sortDate":"2026-08-02","date":"2 August 2026","href":"/files/26-0802b-colombias-justice-ministry-hit-by-ransomware-five-days-before"},{"id":"26-0802","target":"Not applicable","actor":"Not applicable","vector":"Methodology","sector":"Multiple","dwell":null,"sev":1,"status":"Open","sortDate":"2026-08-02","date":"2 August 2026","href":"/files/26-0802-corpus-audit-251-of-587-files-record-no-established-entry-route"},{"id":"26-0731","target":"Conduent Business Solutions","actor":"SafePay","vector":"Ransomware","sector":"Healthcare","dwell":84,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2026-07-30","date":"31 July 2026","href":"/files/26-0731-conduent-breach-affected-more-than-62-million-people-final-count-shows"},{"id":"26-0730","target":"Origin Energy","actor":"Unattributed","vector":"Under review","sector":"Public sector","dwell":null,"sev":3,"status":"Open","jurisdiction":"Australia","sortDate":"2026-07-29","date":"30 July 2026","href":"/files/26-0730-origin-energy-an-energy-retailer-and-the-customers-who-cannot-switch"},{"id":"26-0729","target":"Water sector operators","actor":"Unattributed","vector":"Guidance","sector":"Public sector","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2026-07-29","date":"29 July 2026","href":"/files/26-0729-fbi-and-cisa-warn-water-utilities-to-protect-internet-facing-plcs-after"},{"id":"26-0728","target":"Critical infrastructure operators","actor":"Unattributed","vector":"Guidance","sector":"Public sector","dwell":null,"sev":3,"status":"Open","sortDate":"2026-07-28","date":"28 July 2026","href":"/files/26-0728-ci-fortify-guidance-tells-critical-infrastructure-operators-to-plan"},{"id":"26-0727","target":"Minnesota water utilities","actor":"Iran-affiliated (reported)","vector":"Internet-facing PLC","sector":"Public sector","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2026-07-27","date":"27 July 2026","href":"/files/26-0727-attacks-on-water-controllers-disrupt-operations-across-30-minnesota"},{"id":"26-0726","target":"AssuranceAmerica","actor":"Unattributed","vector":"Under review","sector":"Insurance","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2026-07-26","date":"26 July 2026","href":"/files/26-0726-assuranceamerica-breach-exposed-6-9-million-drivers-licence-numbers"},{"id":"26-0725","target":"UK retail sector","actor":"Scattered Spider","vector":"Enforcement action","sector":"Retail","dwell":null,"sev":3,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2026-07-25","date":"25 July 2026","href":"/files/26-0725-four-arrested-over-uk-retail-attacks-linked-to-scattered-spider"},{"id":"26-0723","target":"RevolutionParts","actor":"Unattributed","vector":"Under review","sector":"Retail","dwell":null,"sev":3,"status":"Open","sortDate":"2026-07-23","date":"23 July 2026","href":"/files/26-0723-revolutionparts-breach-exposed-more-than-five-million-records"},{"id":"26-0722","target":"Cryptocurrency platforms","actor":"DPRK-linked","vector":"Multiple","sector":"Finance","dwell":null,"sev":5,"status":"Open","sortDate":"2026-07-22","date":"22 July 2026","href":"/files/26-0722-cryptocurrency-platforms-three-quarters-of-the-years-stolen-crypto-one"},{"id":"26-0721b","target":"Unlimited Systems","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":5,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2026-07-21","date":"21 July 2026","href":"/files/26-0721b-unlimited-systems-patients-learned-about-an-october-2025-intrusion"},{"id":"26-0721","target":"Hugging Face infrastructure","actor":"Disputed","vector":"Registry → escalation","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-07-21","date":"21 July 2026","href":"/files/26-0721-hugging-face-agent-containment-escape-reported-characterisation-disputed"},{"id":"26-0719","target":"Enterprise organisations","actor":"Insider","vector":"Negligence & credential theft","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-07-19","date":"19 July 2026","href":"/files/26-0719-enterprise-organisations-research-puts-three-quarters-of-insider"},{"id":"26-0718","target":"Salesforce tenants","actor":"ShinyHunters","vector":"Multiple paths","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-07-18","date":"18 July 2026","href":"/files/26-0718-vendor-analysis-maps-three-shinyhunters-attack-paths-into-salesforce"},{"id":"26-0717","target":"AsyncAPI npm packages","actor":"Unattributed","vector":"Import-time payload","sector":"Cloud","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-07-17","date":"17 July 2026","href":"/files/26-0717-asyncapi-npm-compromise-ran-its-payload-at-import-not-install"},{"id":"26-0716b","target":"Transport for London","actor":"Scattered Spider","vector":"Not applicable","sector":"Transport","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2026-07-16","date":"16 July 2026","href":"/files/26-0716b-two-men-jailed-for-five-and-a-half-years-over-the-transport-for-london"},{"id":"26-0716","target":"Craneware","actor":"Unattributed","vector":"Under review","sector":"Healthcare","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2026-07-16","date":"16 July 2026","href":"/files/26-0716-craneware-discloses-compromise-of-hospital-billing-and-pricing-software"},{"id":"26-0715b","target":"TruStage","actor":"Unattributed","vector":"Not established","sector":"Insurance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-15","date":"15 July 2026","href":"/files/26-0715b-trustage-they-shut-the-network-down-and-forty-two-million-relationships"},{"id":"26-0715","target":"Telecom carriers, multiple","actor":"Salt Typhoon","vector":"Edge & network devices","sector":"Telecom","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2026-07-15","date":"15 July 2026","href":"/files/26-0715-telecom-carriers-multiple-salt-typhoon-campaign-reached-more-than-600"},{"id":"26-0714b","target":"On-premises SharePoint operators","actor":"Unattributed","vector":"Remote code execution","sector":"Technology","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2026-07-14","date":"14 July 2026","href":"/files/26-0714b-on-premises-sharepoint-operators-cisa-tells-sharepoint-operators-to-hunt"},{"id":"26-0714","target":"Abbott Laboratories","actor":"ShinyHunters","vector":"Vishing → SSO (claimed)","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","geo":{"place":"Abbott Park, Illinois","country":"United States","lon":-87.93,"lat":42.3},"sortDate":"2026-07-31","date":"31 July 2026","href":"/files/26-0714-abbott-laboratories-thirty-million-rows-claimed-a-limited-number"},{"id":"26-0713","target":"Ernst & Young","actor":"Unattributed","vector":"Third-party platform","sector":"Finance","dwell":15,"sev":3,"status":"Contained","sortDate":"2026-07-13","date":"13 July 2026","href":"/files/26-0713-ernst-young-the-support-ticket-is-the-breach"},{"id":"26-0712","target":"Corporate payment processes","actor":"Multiple","vector":"BEC with synthetic media","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-12","date":"12 July 2026","href":"/files/26-0712-corporate-payment-processes-deepfakes-reported-in-40-of-business-email"},{"id":"26-0711","target":"jscrambler npm package","actor":"Unattributed","vector":"Install-time binary","sector":"Cloud","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-07-11","date":"11 July 2026","href":"/files/26-0711-malicious-jscrambler-npm-versions-ran-native-binaries-during"},{"id":"26-0707","target":"Dysphoria botnet","actor":"Unattributed","vector":"Ledger-based C2","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-07","date":"7 July 2026","href":"/files/26-0707-dysphoria-botnet-reported-rebuilt-within-six-days-of-seizure"},{"id":"26-0705","target":"Check Point VPN appliances","actor":"Qilin affiliates","vector":"Authentication bypass","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-05","date":"5 July 2026","href":"/files/26-0705-qilin-affiliates-linked-to-exploitation-of-check-point-vpn"},{"id":"26-0704","target":"Shared airport IT platforms","actor":"Multiple","vector":"Concentration risk","sector":"Logistics","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-04","date":"4 July 2026","href":"/files/26-0704-shared-airport-it-platforms-identified-as-a-sector-wide-single-point"},{"id":"26-0703","target":"Enterprise remote access","actor":"Multiple","vector":"Legacy VPN","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-03","date":"3 July 2026","href":"/files/26-0703-enterprise-remote-access-seventy-three-per-cent-of-intrusions-came"},{"id":"26-0702","target":"Qantas","actor":"Scattered Lapsus$ Hunters","vector":"Third-party platform","sector":"Retail","dwell":null,"sev":4,"status":"Open","sortDate":"2026-07-02","date":"2 July 2026","href":"/files/26-0702-qantas-customer-data-published-a-year-after-third-party-platform-breach"},{"id":"26-0701","target":"DHS information-sharing environment","actor":"Unattributed","vector":"Unpatched vulnerability","sector":"Public sector","dwell":21,"sev":4,"status":"Open","sortDate":"2026-07-01","date":"1 July 2026","href":"/files/26-0701-dhs-information-sharing-environment-intrusion-involved-deleted-logs"},{"id":"26-0630","target":"Enterprise networks, multiple","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-06-30","date":"30 June 2026","href":"/files/26-0630-enterprise-networks-multiple-adversary-breakout-time-falls-to-72-minutes"},{"id":"26-0628","target":"Texas Parks and Wildlife","actor":"Unattributed","vector":"Third-party vendor","sector":"Public sector","dwell":null,"sev":3,"status":"Contained","jurisdiction":"United States","sortDate":"2026-06-28","date":"28 June 2026","href":"/files/26-0628-texas-parks-and-wildlife-vendor-breach-exposed-three-million-licence"},{"id":"26-0627","target":"Logistics operators","actor":"Multiple","vector":"Various","sector":"Logistics","dwell":null,"sev":4,"status":"Open","sortDate":"2026-06-27","date":"27 June 2026","href":"/files/26-0627-attacks-on-logistics-are-up-tenfold-since-2021"},{"id":"26-0626","target":"Lumma Stealer infrastructure","actor":"Unattributed","vector":"Infostealer","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-06-26","date":"26 June 2026","href":"/files/26-0626-lumma-stealer-reported-on-394-000-machines-after-two-takedowns"},{"id":"26-0625","target":"Multiple organisations","actor":"Scattered Lapsus$ Hunters","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-06-25","date":"25 June 2026","href":"/files/26-0625-multiple-organisations-scattered-lapsus-hunters-name-combines-three"},{"id":"26-0624","target":"Amadey, StealC, SocGholish infrastructure","actor":"Multiple","vector":"Enforcement action","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-06-24","date":"24 June 2026","href":"/files/26-0624-amadey-stealc-socgholish-operation-endgame-seized-326-servers"},{"id":"26-0623","target":"KDDI and five other ISPs","actor":"Unattributed","vector":"Third-party software","sector":"Telecom","dwell":null,"sev":3,"status":"Contained","jurisdiction":"Japan","sortDate":"2026-06-23","date":"23 June 2026","href":"/files/26-0623-third-party-flaw-exposed-14-2-million-mailboxes-at-kddi-and-five-other"},{"id":"26-0622","target":"Tata Electronics","actor":"World Leaks","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","sortDate":"2026-06-22","date":"22 June 2026","href":"/files/26-0622-world-leaks-claims-630gb-of-records-from-tata-electronics"},{"id":"26-0620","target":"Estée Lauder","actor":"Unattributed","vector":"Oracle EBS flaw","sector":"Retail","dwell":304,"sev":3,"status":"Contained","sortDate":"2026-06-20","date":"20 June 2026","href":"/files/26-0620-estee-lauder-reports-oracle-e-business-suite-breach-undetected-for-ten"},{"id":"26-0619","target":"Google (corporate CRM)","actor":"UNC6040","vector":"Vishing → OAuth consent","sector":"Cloud","dwell":null,"sev":2,"status":"Closed","sortDate":"2026-06-19","date":"19 June 2026","href":"/files/26-0619-google-corporate-crm-the-company-that-named-the-technique-was-also-hit"},{"id":"26-0617","target":"iRhythm","actor":"Extortion actor, unnamed","vector":"Third-party application","sector":"Healthcare","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-06-17","date":"17 June 2026","href":"/files/26-0617-irhythm-a-cardiac-monitor-produces-a-continuous-record-of-you"},{"id":"26-0616","target":"Kodak","actor":"ShinyHunters","vector":"Unauthorised access","sector":"Manufacturing","dwell":null,"sev":3,"status":"Open","sortDate":"2026-06-16","date":"16 June 2026","href":"/files/26-0616-shinyhunters-claim-2-2-million-records-from-kodak"},{"id":"26-0615","target":"Exposed Elasticsearch instance","actor":"Exposure","vector":"Misconfiguration","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2026-06-15","date":"15 June 2026","href":"/files/26-0615-exposed-elasticsearch-instance-held-24-billion-credential-records"},{"id":"26-0614","target":"AudiA6 laundering service","actor":"Multiple","vector":"Enforcement action","sector":"Finance","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-06-14","date":"14 June 2026","href":"/files/26-0614-audia6-laundering-service-the-laundering-service-is-the-part-that-has"},{"id":"26-0613","target":"Amazon One Medical","actor":"ShinyHunters","vector":"Legacy archive access","sector":"Healthcare","dwell":3,"sev":4,"status":"Open","sortDate":"2026-06-13","date":"13 June 2026","href":"/files/26-0613-shinyhunters-claim-8-8tb-from-amazon-one-medical-legacy-archives"},{"id":"26-0612b","target":"Mount Royal University","actor":"CMD Organization","vector":"Ransomware","sector":"Education","dwell":null,"sev":3,"status":"Open","sortDate":"2026-06-12","date":"12 June 2026","href":"/files/26-0612b-mount-royal-university-thirty-bitcoin-ten-terabytes-one-university"},{"id":"26-0612","target":"DentaQuest","actor":"ShinyHunters","vector":"Credential compromise","sector":"Healthcare","dwell":30,"sev":4,"status":"Closed","sortDate":"2026-06-12","date":"12 June 2026","href":"/files/26-0612-dentaquest-data-published-after-extortion-demand-refused"},{"id":"26-0611","target":"Klue","actor":"Unattributed","vector":"OAuth token theft","sector":"Cloud","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-06-11","date":"11 June 2026","href":"/files/26-0611-klue-compromise-reached-salesforce-environments-at-two-dozen-customers"},{"id":"26-0610","target":"Allianz Life","actor":"ShinyHunters","vector":"Social engineering","sector":"Insurance","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-06-10","date":"10 June 2026","href":"/files/26-0610-allianz-life-breach-affected-most-of-its-1-4-million-customers"},{"id":"26-0609","target":"ServiceNow","actor":"Unattributed","vector":"Unauthenticated API","sector":"Cloud","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-06-09","date":"9 June 2026","href":"/files/26-0609-servicenow-api-flaw-allowed-unauthenticated-table-queries-researchers"},{"id":"26-0608","target":"Chick-fil-A","actor":"Unattributed","vector":"Credential stuffing","sector":"Retail","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-06-08","date":"8 June 2026","href":"/files/26-0608-chick-fil-a-nobody-breached-anything-they-just-logged-in"},{"id":"26-0607b","target":"Evanston Township High School","actor":"Unattributed","vector":"Ransomware","sector":"Education","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-06-07","date":"7 June 2026","href":"/files/26-0607b-evanston-township-high-school-the-school-closed-and-so-did-everything"},{"id":"26-0607","target":"Salesforce tenants","actor":"UNC6040","vector":"Vishing → OAuth consent","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-06-07","date":"7 June 2026","href":"/files/26-0607-unc6040-phoned-staff-to-authorise-salesforce-connected-apps"},{"id":"26-0606","target":"Red Hat-associated npm packages","actor":"Unattributed","vector":"Package compromise","sector":"Cloud","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-06-06","date":"6 June 2026","href":"/files/26-0606-red-hat-associated-npm-packages-a-worm-in-the-registry-wearing-a-vendors"},{"id":"26-0604","target":"Suno","actor":"Unattributed","vector":"Source code breach","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-06-04","date":"4 June 2026","href":"/files/26-0604-suno-the-source-code-disclosed-what-the-training-data-was"},{"id":"26-0603","target":"Cyber insurance market","actor":"Multiple","vector":"Ransomware","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2026-06-03","date":"3 June 2026","href":"/files/26-0603-cyber-insurance-market-ransom-payments-fell-44-and-claims-rose-40"},{"id":"26-0602","target":"FortiGate firewalls","actor":"Unattributed","vector":"Credential compromise","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-06-02","date":"2 June 2026","href":"/files/26-0602-fortigate-firewalls-tens-of-thousands-of-firewalls-and-the-credentials"},{"id":"26-0601","target":"US critical infrastructure","actor":"Volt Typhoon","vector":"Living off the land","sector":"Public sector","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2026-06-01","date":"1 June 2026","href":"/files/26-0601-us-critical-infrastructure-five-years-in-a-grid-network-and-nothing"},{"id":"26-0531","target":"Multi-agent deployments","actor":"Research","vector":"Prompt injection chain","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-05-31","date":"31 May 2026","href":"/files/26-0531-research-describes-prompt-injection-developing-a-multistep-kill-chain"},{"id":"26-0530","target":"Udemy","actor":"ShinyHunters","vector":"Under review","sector":"Education","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-05-30","date":"30 May 2026","href":"/files/26-0530-udemy-breach-exposed-1-4-million-addresses-and-instructor-payout-details"},{"id":"26-0529","target":"Telecommunications carriers","actor":"Multiple","vector":"Volumetric DDoS","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-29","date":"29 May 2026","href":"/files/26-0529-telecommunications-carriers-the-record-attack-was-pointed-at-the-phone"},{"id":"26-0528","target":"Asocks proxy network","actor":"Unattributed","vector":"Enforcement action","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Netherlands","sortDate":"2026-05-28","date":"28 May 2026","href":"/files/26-0528-asocks-proxy-network-dutch-police-seize-200-servers-behind-proxy-network"},{"id":"26-0527","target":"Carnival Corporation","actor":"Unattributed","vector":"Phishing → account","sector":"Retail","dwell":12,"sev":4,"status":"Contained","sortDate":"2026-05-27","date":"27 May 2026","href":"/files/26-0527-carnival-reports-phishing-breach-affecting-close-to-six-million-guests"},{"id":"26-0526","target":"Charter Communications","actor":"ShinyHunters","vector":"Vishing → Entra","sector":"Telecom","dwell":55,"sev":4,"status":"Contained","sortDate":"2026-05-26","date":"26 May 2026","href":"/files/26-0526-charter-discloses-vishing-breach-affecting-4-9-million-customer-accounts"},{"id":"26-0524","target":"Vulnerability disclosure ecosystem","actor":"Unattributed","vector":"Volume growth","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-05-24","date":"24 May 2026","href":"/files/26-0524-vulnerability-disclosure-ecosystem-cve-submissions-rose-263-between-2020"},{"id":"26-0523","target":"Enterprise AI agent deployments","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-23","date":"23 May 2026","href":"/files/26-0523-eighty-eight-per-cent-of-enterprises-running-agents-had-an-incident"},{"id":"26-0522","target":"First VPN service","actor":"Multiple","vector":"Enforcement action","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-05-22","date":"22 May 2026","href":"/files/26-0522-operation-saffron-seizes-first-vpn-shared-by-25-ransomware-groups"},{"id":"26-0520","target":"npm ecosystem","actor":"Unattributed","vector":"Install-time execution","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-20","date":"20 May 2026","href":"/files/26-0520-npm-ecosystem-the-package-that-steals-the-pipeline-that-builds"},{"id":"26-0519","target":"Legal document estates","actor":"Multiple","vector":"Targeted access","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-19","date":"19 May 2026","href":"/files/26-0519-legal-document-estates-m-a-and-litigation-documents-identified"},{"id":"26-0518","target":"University of Nottingham","actor":"ShinyHunters","vector":"System compromise","sector":"Education","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-05-18","date":"18 May 2026","href":"/files/26-0518-university-of-nottingham-455-000-email-addresses-exposed-shinyhunters"},{"id":"26-0517","target":"Tchap (French government)","actor":"misere","vector":"Account hijacking","sector":"Public sector","dwell":null,"sev":3,"status":"Contained","jurisdiction":"France","sortDate":"2026-05-17","date":"17 May 2026","href":"/files/26-0517-tchap-french-government-the-secure-messenger-the-french-state-built"},{"id":"26-0516","target":"Idaho State University","actor":"ShinyHunters","vector":"Vendor incident","sector":"Education","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-05-16","date":"16 May 2026","href":"/files/26-0516-idaho-state-university-finals-week-was-cancelled-at-a-university-that"},{"id":"26-0515","target":"Vacation Myrtle Beach","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":365,"sev":3,"status":"Closed","sortDate":"2026-05-15","date":"15 May 2026","href":"/files/26-0515-vacation-myrtle-beach-breached-in-2024-found-in-2025-disclosed-in-2026"},{"id":"26-0514","target":"Global cryptographic estate","actor":"Unattributed","vector":"Standards migration","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-05-14","date":"14 May 2026","href":"/files/26-0514-global-cryptographic-estate-post-quantum-migration-costed-at-15-billion"},{"id":"26-0513","target":"Delano Public Schools","actor":"LockBit","vector":"Ransomware","sector":"Education","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-05-13","date":"13 May 2026","href":"/files/26-0513-delano-public-schools-the-attack-was-in-may-and-the-claim-arrived"},{"id":"26-0512","target":"Foxconn","actor":"Nitrogen","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-12","date":"12 May 2026","href":"/files/26-0512-foxconn-eight-terabytes-claimed-from-the-factory-floor-of-everything"},{"id":"26-0511","target":"Cyber insurance claimants","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2026-05-11","date":"11 May 2026","href":"/files/26-0511-cyber-insurance-claimants-a-quarter-of-the-claims-half-the-money"},{"id":"26-0510","target":"Reported fraud, US","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2026-05-10","date":"10 May 2026","href":"/files/26-0510-reported-fraud-us-fbi-recorded-1-008-597-fraud-complaints-and-20-9"},{"id":"26-0509","target":"Agentic AI deployments","actor":"Multiple","vector":"Prompt injection","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-09","date":"9 May 2026","href":"/files/26-0509-prompt-injection-remains-the-dominant-cause-of-agentic-ai-failures"},{"id":"26-0507","target":"West Pharmaceutical Services","actor":"Unattributed","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-05-07","date":"7 May 2026","href":"/files/26-0507-west-pharmaceutical-took-global-systems-offline-after-intrusion"},{"id":"26-0506","target":"Enterprise patch management","actor":"Multiple","vector":"Rapid exploitation","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-06","date":"6 May 2026","href":"/files/26-0506-enterprise-patch-management-the-disclosure-to-exploitation-window"},{"id":"26-0505","target":"Mediaworks Hungary","actor":"Unattributed","vector":"Intrusion","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-05-05","date":"5 May 2026","href":"/files/26-0505-mediaworks-hungary-intrusion-reportedly-took-15-million-files"},{"id":"26-0504","target":"Trellix","actor":"RansomHouse","vector":"Repository access","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-05-04","date":"4 May 2026","href":"/files/26-0504-ransomhouse-claims-access-to-trellix-source-code-repositories"},{"id":"26-0503","target":"Medtronic","actor":"ShinyHunters","vector":"Not established","sector":"Healthcare","dwell":null,"sev":3,"status":"Open","sortDate":"2026-05-03","date":"3 May 2026","href":"/files/26-0503-medtronic-nine-million-claimed-and-the-devices-kept-working"},{"id":"26-0502","target":"Kochava","actor":"None — commercial sale","vector":"Data brokerage","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2026-05-02","date":"2 May 2026","href":"/files/26-0502-ftc-bars-kochava-from-selling-sensitive-location-data-without-consent"},{"id":"26-0501","target":"Instructure — Canvas","actor":"ShinyHunters","vector":"Service weakness","sector":"Education","dwell":16,"sev":5,"status":"Closed","sortDate":"2026-05-14","date":"14 May 2026","href":"/files/26-0501-instructure-paid-and-got-shred-logs-back"},{"id":"26-0429","target":"SaaS tenants, multiple","actor":"ShinyHunters","vector":"Device code phishing","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-29","date":"29 April 2026","href":"/files/26-0429-saas-tenants-multiple-shinyhunters-campaign-compromised-more-than"},{"id":"26-0428","target":"Anthropic","actor":"Internal error","vector":"Misconfigured publication","sector":"Cloud","dwell":null,"sev":2,"status":"Closed","sortDate":"2026-04-28","date":"28 April 2026","href":"/files/26-0428-anthropic-not-a-breach-half-a-million-lines-published-by-mistake"},{"id":"26-0427","target":"Public-key cryptography estate","actor":"Unattributed","vector":"Standards migration","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-27","date":"27 April 2026","href":"/files/26-0427-public-key-cryptography-estate-nist-finalises-three-post-quantum"},{"id":"26-0426","target":"Healthcare sector suppliers","actor":"Multiple","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-26","date":"26 April 2026","href":"/files/26-0426-healthcare-ransomware-rose-14-in-early-2026-concentrated-on-suppliers"},{"id":"26-0425","target":"ADT","actor":"ShinyHunters","vector":"Under review","sector":"Retail","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-04-25","date":"25 April 2026","href":"/files/26-0425-adt-ten-million-claimed-five-and-a-half-million-verified"},{"id":"26-0424","target":"Adidas, Pandora, LVMH houses","actor":"ShinyHunters","vector":"Social engineering → CRM","sector":"Retail","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-04-24","date":"24 April 2026","href":"/files/26-0424-adidas-pandora-lvmh-houses-luxury-houses-share-a-customer-list"},{"id":"26-0423","target":"7-Eleven","actor":"ShinyHunters","vector":"Salesforce misconfiguration","sector":"Retail","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-04-23","date":"23 April 2026","href":"/files/26-0423-7-eleven-six-hundred-thousand-claimed-185-000-stood-up"},{"id":"26-0422","target":"Privileged communications","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-22","date":"22 April 2026","href":"/files/26-0422-privileged-communications-attorney-client-privilege-offers-no-protection"},{"id":"26-0421","target":"Corporate finance functions","actor":"Multiple","vector":"Voice cloning","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-21","date":"21 April 2026","href":"/files/26-0421-corporate-finance-functions-voice-cloning-now-standard-in-executive"},{"id":"26-0420","target":"France Titres (ANTS)","actor":"Single operator","vector":"Portal compromise","sector":"Public sector","dwell":3,"sev":4,"status":"Closed","jurisdiction":"France","sortDate":"2026-04-20","date":"20 April 2026","href":"/files/26-0420-france-titres-ants-eleven-million-identity-records-and-a-suspect"},{"id":"26-0419","target":"US breach notification regime","actor":"Unattributed","vector":"Regulatory","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2026-04-19","date":"19 April 2026","href":"/files/26-0419-all-fifty-us-states-now-impose-breach-notification-duties-on-a-single"},{"id":"26-0417","target":"Kelp DAO","actor":"DPRK-linked","vector":"Protocol exploit","sector":"Finance","dwell":null,"sev":4,"status":"Closed","sortDate":"2026-04-17","date":"17 April 2026","href":"/files/26-0417-kelp-dao-two-hundred-and-ninety-two-million-and-no-perimeter-to-breach"},{"id":"26-0416","target":"Insured organisations","actor":"Unattributed","vector":"Coverage dispute","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2026-04-16","date":"16 April 2026","href":"/files/26-0416-insured-organisations-control-failures-are-the-most-common-ground"},{"id":"26-0415","target":"Incident severity classification","actor":"Unattributed","vector":"Methodology","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2026-04-15","date":"15 April 2026","href":"/files/26-0415-incident-severity-classification-uk-retail-attacks-classified"},{"id":"26-0414","target":"McGraw Hill","actor":"ShinyHunters","vector":"Misconfiguration","sector":"Education","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-04-14","date":"14 April 2026","href":"/files/26-0414-misconfigured-salesforce-environment-exposed-13-5-million-mcgraw-hill"},{"id":"26-0413","target":"Outsourced IT service desks","actor":"Scattered Spider","vector":"Help-desk social engineering","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-13","date":"13 April 2026","href":"/files/26-0413-you-outsourced-the-help-desk-and-kept-the-consequences"},{"id":"26-0412","target":"Vulnerability management pipeline","actor":"Unattributed","vector":"Process change","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-12","date":"12 April 2026","href":"/files/26-0412-nist-moves-vulnerability-database-to-triage-enriching-15-20-of-cves"},{"id":"26-0411","target":"Marks & Spencer and Co-op","actor":"Scattered Spider","vector":"Help-desk social engineering","sector":"Retail","dwell":null,"sev":5,"status":"Closed","sortDate":"2026-04-11","date":"11 April 2026","href":"/files/26-0411-marks-spencer-and-co-op-m-s-and-co-op-intrusions-assessed-as-a-single"},{"id":"26-0410","target":"Open-source maintainers","actor":"Research consortium","vector":"Disclosure volume","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-10","date":"10 April 2026","href":"/files/26-0410-only-97-of-1-596-vulnerabilities-disclosed-to-open-source-maintainers"},{"id":"26-0409","target":"European Commission web properties","actor":"Unattributed","vector":"Cloud infrastructure flaw","sector":"Public sector","dwell":null,"sev":2,"status":"Closed","sortDate":"2026-04-09","date":"9 April 2026","href":"/files/26-0409-the-second-european-commission-file-this-year"},{"id":"26-0408","target":"SAP-related npm packages","actor":"Unattributed","vector":"Package compromise","sector":"Cloud","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-04-08","date":"8 April 2026","href":"/files/26-0408-sap-related-npm-packages-enterprise-packages-consumer-registry-no"},{"id":"26-0407","target":"Signature Healthcare (Brockton)","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-04-07","date":"7 April 2026","href":"/files/26-0407-signature-healthcare-diverted-ambulances-after-systems-taken-offline"},{"id":"26-0406","target":"European airport passenger systems","actor":"Unattributed","vector":"Shared platform compromise","sector":"Logistics","dwell":null,"sev":4,"status":"Closed","sortDate":"2026-04-06","date":"6 April 2026","href":"/files/26-0406-cyber-incident-disrupted-check-in-and-baggage-at-major-european-airports"},{"id":"26-0405","target":"National Vulnerability Database","actor":"Unattributed","vector":"Process capacity","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-05","date":"5 April 2026","href":"/files/26-0405-federal-audit-found-national-vulnerability-database-backlog-past-27-000"},{"id":"26-0404","target":"Open-source software estate","actor":"Research consortium","vector":"Autonomous discovery","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-04-04","date":"4 April 2026","href":"/files/26-0404-open-source-software-estate-autonomous-vulnerability-research-reported"},{"id":"26-0403","target":"US public companies","actor":"Unattributed","vector":"Disclosure regime","sector":"Finance","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2026-04-03","date":"3 April 2026","href":"/files/26-0403-us-public-companies-must-disclose-material-cyber-incidents-within-four"},{"id":"26-0331","target":"Cisco","actor":"Unattributed","vector":"Stolen scanner credentials","sector":"Cloud","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-03-31","date":"31 March 2026","href":"/files/26-0331-cisco-three-hundred-repositories-reached-with-a-scanners-credentials"},{"id":"26-0330","target":"State and local government","actor":"Multiple","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-30","date":"30 March 2026","href":"/files/26-0330-state-and-local-government-government-ransomware-rose-65-and-the-target"},{"id":"26-0329","target":"Vulnerability tooling","actor":"Unattributed","vector":"Data classification","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-29","date":"29 March 2026","href":"/files/26-0329-vulnerability-tooling-around-29-000-cves-reclassified-as-never-to-be"},{"id":"26-0328","target":"Long-lived open-source code","actor":"Research consortium","vector":"Autonomous discovery","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-28","date":"28 March 2026","href":"/files/26-0328-long-lived-open-source-code-27-year-old-openbsd-flaw-and-16-year-old"},{"id":"26-0327","target":"Air France-KLM","actor":"Unattributed","vector":"Third-party platform","sector":"Logistics","dwell":null,"sev":3,"status":"Contained","jurisdiction":"France","sortDate":"2026-03-27","date":"27 March 2026","href":"/files/26-0327-air-france-klm-named-among-organisations-hit-in-third-party-data"},{"id":"26-0326","target":"London Hydro","actor":"Unattributed","vector":"System breach","sector":"Public sector","dwell":null,"sev":3,"status":"Contained","jurisdiction":"United Kingdom","sortDate":"2026-03-26","date":"26 March 2026","href":"/files/26-0326-london-hydro-breach-reportedly-exposed-more-than-170-000-customer"},{"id":"26-0325","target":"Global botnet ecosystem","actor":"Multiple","vector":"IoT compromise","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-25","date":"25 March 2026","href":"/files/26-0325-one-botnet-was-removed-and-twenty-took-its-place"},{"id":"26-0324","target":"NYC Health + Hospitals","actor":"Unattributed","vector":"Network intrusion","sector":"Healthcare","dwell":96,"sev":4,"status":"Contained","jurisdiction":"United States","sortDate":"2026-03-24","date":"24 March 2026","href":"/files/26-0324-nyc-health-hospitals-intrusion-touched-1-8-million-people-over-three"},{"id":"26-0323","target":"Disclosure governance","actor":"Unattributed","vector":"Process","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-03-23","date":"23 March 2026","href":"/files/26-0323-coordinated-disclosure-breaks-down-at-tens-of-thousands-of-findings"},{"id":"26-0322","target":"Adobe (alleged)","actor":"Mr. Raccoon","vector":"BPO vendor phishing","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-03-22","date":"22 March 2026","href":"/files/26-0322-adobe-alleged-thirteen-million-support-tickets-allegedly-through"},{"id":"26-0321","target":"Open-source maintenance","actor":"Unattributed","vector":"Funding structure","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-03-21","date":"21 March 2026","href":"/files/26-0321-open-source-security-grants-cover-about-four-per-cent-of-the-maintenance"},{"id":"26-0320","target":"Network origin controls","actor":"Multiple","vector":"Residential proxy","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-20","date":"20 March 2026","href":"/files/26-0320-residential-proxy-networks-sell-state-grade-traffic-origination-to-any"},{"id":"26-0318","target":"Fleet and telematics platforms","actor":"Multiple","vector":"Various","sector":"Logistics","dwell":null,"sev":3,"status":"Open","sortDate":"2026-03-18","date":"18 March 2026","href":"/files/26-0318-taxi-fleets-and-truck-telematics-are-industrial-control-systems-now"},{"id":"26-0316","target":"Production database","actor":"Agent action","vector":"Delegated write access","sector":"Cloud","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-03-16","date":"16 March 2026","href":"/files/26-0316-production-database-it-deleted-the-database-then-said-the-rollback-would"},{"id":"26-0315","target":"Vulnerability research capability","actor":"Multiple","vector":"Dual use","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-15","date":"15 March 2026","href":"/files/26-0315-vulnerability-research-capability-the-same-capability-pointed-the-other"},{"id":"26-0314","target":"Salesforce Experience Cloud tenants","actor":"ShinyHunters","vector":"Portal misconfiguration","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-14","date":"14 March 2026","href":"/files/26-0314-shinyhunters-campaign-hit-public-facing-salesforce-experience-cloud"},{"id":"26-0313","target":"Law firm client portals","actor":"Multiple","vector":"Weak authentication","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-13","date":"13 March 2026","href":"/files/26-0313-law-firm-client-portals-the-client-portal-is-where-the-documents"},{"id":"26-0311","target":"Edge VPN and firewall appliances","actor":"Multiple","vector":"Appliance exploitation","sector":"Multiple","dwell":null,"sev":5,"status":"Open","sortDate":"2026-03-11","date":"11 March 2026","href":"/files/26-0311-edge-vpn-and-firewall-exploitation-becomes-dominant-initial-access-route"},{"id":"26-0310","target":"Foster City, California","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2026-03-10","date":"10 March 2026","href":"/files/26-0310-ransomware-took-foster-city-permits-licences-and-utility-billing-offline"},{"id":"26-0309","target":"Law firms","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-09","date":"9 March 2026","href":"/files/26-0309-two-in-five-law-firms-were-breached-and-most-exposed-client-data"},{"id":"26-0307","target":"Disclosure ecosystem","actor":"Unattributed","vector":"Coordination failure","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-07","date":"7 March 2026","href":"/files/26-0307-disclosure-ecosystem-thousands-of-unfixed-findings-publish-with-no-party"},{"id":"26-0306","target":"Consumer location data","actor":"None — inference","vector":"Data aggregation","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-03-06","date":"6 March 2026","href":"/files/26-0306-consumer-location-data-the-clinic-visit-was-never-a-field"},{"id":"26-0305","target":"Education sector","actor":"Multiple","vector":"Various","sector":"Education","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-05","date":"5 March 2026","href":"/files/26-0305-education-sector-combines-minors-records-with-the-thinnest-security"},{"id":"26-0304","target":"US healthcare providers","actor":"Multiple","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2026-03-04","date":"4 March 2026","href":"/files/26-0304-us-healthcare-downtime-costs-around-900-000-per-day"},{"id":"26-0303","target":"Financial services AI agent","actor":"Unattributed","vector":"Prompt injection","sector":"Finance","dwell":21,"sev":3,"status":"Contained","sortDate":"2026-03-03","date":"3 March 2026","href":"/files/26-0303-financial-services-ai-agent-disclosed-internal-pricing-for-three-weeks"},{"id":"26-0302","target":"Consumer IoT device estate","actor":"Multiple","vector":"Enforcement action","sector":"Telecom","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2026-03-02","date":"2 March 2026","href":"/files/26-0302-consumer-iot-device-estate-three-million-routers-and-a-record-set-at-31"},{"id":"26-0301","target":"Education institutions","actor":"Multiple","vector":"Ransomware","sector":"Education","dwell":null,"sev":4,"status":"Open","sortDate":"2026-03-01","date":"1 March 2026","href":"/files/26-0301-education-ransomware-closed-schools-and-universities-across-several"},{"id":"26-0228","target":"K-12 school districts","actor":"Multiple","vector":"Third-party vendor","sector":"Education","dwell":null,"sev":3,"status":"Open","sortDate":"2026-02-28","date":"28 February 2026","href":"/files/26-0228-a-third-of-school-breaches-happen-at-somebody-elses-company"},{"id":"26-0227","target":"youX","actor":"Unattributed","vector":"Under review","sector":"Finance","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-02-27","date":"27 February 2026","href":"/files/26-0227-youx-breach-affected-444-500-borrowers-and-229-200-drivers-licence"},{"id":"26-0226","target":"Enterprise AI assistants","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2026-02-26","date":"26 February 2026","href":"/files/26-0226-enterprise-ai-assistants-agent-security-incidents-documented-across"},{"id":"26-0225","target":"Water utility (Mexico)","actor":"Unattributed","vector":"AI-assisted recon","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Mexico","sortDate":"2026-02-25","date":"25 February 2026","href":"/files/26-0225-water-utility-mexico-the-model-found-the-scada-gateway"},{"id":"26-0224","target":"Figure Technology Solutions","actor":"ShinyHunters","vector":"Employee social engineering","sector":"Finance","dwell":null,"sev":4,"status":"Contained","sortDate":"2026-02-24","date":"24 February 2026","href":"/files/26-0224-employee-compromise-at-figure-technology-solutions-affected-967-000"},{"id":"26-0223","target":"Cyber insurance market","actor":"Unattributed","vector":"Market pricing","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2026-02-23","date":"23 February 2026","href":"/files/26-0223-cyber-insurance-market-premiums-fell-for-the-first-time-and-the-bill"},{"id":"26-0222","target":"Kopran Ltd","actor":"DragonForce","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":3,"status":"Open","sortDate":"2026-02-22","date":"22 February 2026","href":"/files/26-0222-dragonforce-claims-attack-on-pharmaceutical-manufacturer-kopran"},{"id":"26-0220","target":"Attribution practice","actor":"Multiple","vector":"Methodology","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-02-20","date":"20 February 2026","href":"/files/26-0220-attribution-practice-a-political-name-is-a-claim-not-a-finding"},{"id":"26-0219","target":"IDMerit","actor":"Exposure","vector":"Unsecured database","sector":"Finance","dwell":null,"sev":4,"status":"Closed","sortDate":"2026-02-19","date":"19 February 2026","href":"/files/26-0219-idmerit-three-billion-identity-records-and-no-attacker-required"},{"id":"26-0218","target":"Hospital Caribbean Medical Center","actor":"The Gentlemen","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-02-18","date":"18 February 2026","href":"/files/26-0218-hospital-caribbean-medical-center-attack-affected-about-92-000-people"},{"id":"26-0217","target":"Senegal national ID system","actor":"Green Blood","vector":"Server compromise","sector":"Public sector","dwell":null,"sev":4,"status":"Open","sortDate":"2026-02-17","date":"17 February 2026","href":"/files/26-0217-senegal-national-id-system-identity-card-issuance-stopped-while"},{"id":"26-0216","target":"Foundational open-source components","actor":"Unattributed","vector":"Governance gap","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-02-16","date":"16 February 2026","href":"/files/26-0216-vulnerability-programme-targeted-the-foundational-libraries-everything"},{"id":"26-0215","target":"National Diplomatic Academy (KR)","actor":"Unattributed","vector":"Under review","sector":"Public sector","dwell":300,"sev":3,"status":"Contained","jurisdiction":"South Korea","sortDate":"2026-02-15","date":"15 February 2026","href":"/files/26-0215-south-koreas-national-diplomatic-academy-intrusion-ran-ten-months"},{"id":"26-0214","target":"UFP Technologies","actor":"Payouts King","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-02-14","date":"14 February 2026","href":"/files/26-0214-ufp-technologies-ufp-technologies-warned-of-billing-and-shipment-delays"},{"id":"26-0213","target":"Washington Hotel chain (JP)","actor":"Unattributed","vector":"Ransomware","sector":"Retail","dwell":null,"sev":2,"status":"Closed","jurisdiction":"Japan","sortDate":"2026-02-13","date":"13 February 2026","href":"/files/26-0213-washington-hotel-chain-jp-japanese-hotel-chain-ransomware-hit-business"},{"id":"26-0212","target":"Odido","actor":"Unattributed","vector":"Under review","sector":"Telecom","dwell":null,"sev":4,"status":"Contained","jurisdiction":"Netherlands","sortDate":"2026-02-12","date":"12 February 2026","href":"/files/26-0212-odido-contact-system-compromise-affected-up-to-6-4-million-customers"},{"id":"26-0211","target":"Volvo Group North America","actor":"SafePay","vector":"Supplier intrusion","sector":"Manufacturing","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-02-11","date":"11 February 2026","href":"/files/26-0211-conduent-intrusion-affected-17-000-volvo-group-north-america-staff"},{"id":"26-0210","target":"Nippon Medical School Musashi Kosugi","actor":"NetRunner","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Japan","sortDate":"2026-02-10","date":"10 February 2026","href":"/files/26-0210-netrunner-demanded-100-million-from-nippon-medical-school-hospital"},{"id":"26-0209","target":"BridgePay / Bryan Texas Utilities","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2026-02-09","date":"9 February 2026","href":"/files/26-0209-bridgepay-ransomware-disrupted-payments-for-70-000-bryan-texas-utilities"},{"id":"26-0208","target":"Coinbase","actor":"Insider — contractor","vector":"Improper access","sector":"Finance","dwell":null,"sev":2,"status":"Closed","sortDate":"2026-02-08","date":"8 February 2026","href":"/files/26-0208-coinbase-support-contractor-improperly-accessed-data-for-30-customers"},{"id":"26-0207","target":"US data broker market","actor":"Unattributed","vector":"Regulatory","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2026-02-07","date":"7 February 2026","href":"/files/26-0207-thirteen-letters-about-selling-americans-data-abroad"},{"id":"26-0206","target":"European Commission","actor":"Unattributed","vector":"Ivanti EPMM","sector":"Public sector","dwell":1,"sev":2,"status":"Closed","sortDate":"2026-02-06","date":"6 February 2026","href":"/files/26-0206-european-commission-device-platform-compromised-via-ivanti-flaw"},{"id":"26-0205","target":"Account recovery infrastructure","actor":"Multiple","vector":"Number portability abuse","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2026-02-05","date":"5 February 2026","href":"/files/26-0205-account-recovery-infrastructure-the-phone-number-became-national"},{"id":"26-0204","target":"Harrods","actor":"Scattered Spider","vector":"Not disclosed","sector":"Retail","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-02-04","date":"4 February 2026","href":"/files/26-0204-harrods-targeted-in-the-same-scattered-spider-wave-as-m-s-and-co-op"},{"id":"26-0203","target":"PayPal Working Capital","actor":"Unattributed","vector":"Account compromise","sector":"Finance","dwell":164,"sev":3,"status":"Contained","sortDate":"2026-02-03","date":"3 February 2026","href":"/files/26-0203-unauthorised-activity-hit-paypal-working-capital-accounts-over-six"},{"id":"26-0202","target":"Panera Bread","actor":"ShinyHunters","vector":"System compromise","sector":"Retail","dwell":null,"sev":2,"status":"Contained","sortDate":"2026-02-02","date":"2 February 2026","href":"/files/26-0202-panera-bread-breach-exposed-5-1-million-loyalty-accounts"},{"id":"26-0201","target":"Chanel","actor":"Unattributed","vector":"Third-party platform","sector":"Retail","dwell":null,"sev":3,"status":"Contained","sortDate":"2026-02-01","date":"1 February 2026","href":"/files/26-0201-chanel-named-among-organisations-hit-in-third-party-data-campaign"},{"id":"26-0131","target":"Municipal emergency systems","actor":"Multiple","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":3,"status":"Open","sortDate":"2026-01-31","date":"31 January 2026","href":"/files/26-0131-emergency-dispatch-survived-both-municipal-ransomware-incidents-this"},{"id":"26-0130","target":"Government, defence and aid bodies","actor":"Pawn Storm","vector":"Office zero-day","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"Ukraine","sortDate":"2026-01-30","date":"30 January 2026","href":"/files/26-0130-government-defence-and-aid-bodies-pawn-storm-opened-2026-with-an-office"},{"id":"26-0128","target":"NetScaler appliances","actor":"Multiple","vector":"Memory disclosure","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-01-28","date":"28 January 2026","href":"/files/26-0128-citrixbleed-style-netscaler-flaw-cve-2026-8451-abused-within-hours"},{"id":"26-0127","target":"Credit union technology provider","actor":"Unattributed","vector":"Ransomware","sector":"Finance","dwell":null,"sev":4,"status":"Closed","sortDate":"2026-01-27","date":"27 January 2026","href":"/files/26-0127-credit-union-technology-provider-sixty-institutions-one-technology"},{"id":"26-0126","target":"New Britain, Connecticut","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2026-01-26","date":"26 January 2026","href":"/files/26-0126-new-britain-city-networks-disrupted-for-more-than-two-days-by-ransomware"},{"id":"26-0124","target":"Digital-only financial services","actor":"Unattributed","vector":"Continuity gap","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2026-01-24","date":"24 January 2026","href":"/files/26-0124-digital-only-banking-removed-the-fallback-that-made-outages-survivable"},{"id":"26-0123","target":"Vietnam Airlines","actor":"Unattributed","vector":"Third-party platform","sector":"Logistics","dwell":null,"sev":3,"status":"Open","jurisdiction":"Vietnam","sortDate":"2026-01-23","date":"23 January 2026","href":"/files/26-0123-vietnam-airlines-data-leaked-alongside-qantas-records"},{"id":"26-0122","target":"Canada Computers","actor":"Unattributed","vector":"Payment page compromise","sector":"Retail","dwell":25,"sev":3,"status":"Closed","sortDate":"2026-01-22","date":"22 January 2026","href":"/files/26-0122-canada-computers-guest-checkout-captured-payment-card-data-for-a-month"},{"id":"26-0121","target":"Automotive manufacturers","actor":"Multiple","vector":"Various","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","sortDate":"2026-01-21","date":"21 January 2026","href":"/files/26-0121-attacks-on-automotive-and-smart-mobility-organisations-more-than-doubled"},{"id":"26-0120","target":"Mobile subscribers","actor":"Multiple","vector":"SIM swap","sector":"Telecom","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2026-01-20","date":"20 January 2026","href":"/files/26-0120-mobile-subscribers-fbi-recorded-almost-26-million-in-sim-swap-losses"},{"id":"26-0119","target":"Jaguar Land Rover","actor":"Unattributed","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2026-01-19","date":"19 January 2026","href":"/files/26-0119-jaguar-land-rover-intrusion-halted-production-and-cost-1-9-billion"},{"id":"26-0113","target":"PowerSchool","actor":"Unattributed","vector":"Portal without MFA","sector":"Education","dwell":null,"sev":5,"status":"Closed","sortDate":"2026-01-13","date":"13 January 2026","href":"/files/26-0113-powerschool-breach-reached-62-million-student-records-across-18-000"},{"id":"26-0112","target":"Chime","actor":"Team 313","vector":"Service disruption","sector":"Finance","dwell":null,"sev":3,"status":"Closed","sortDate":"2026-01-12","date":"12 January 2026","href":"/files/26-0112-team-313-outage-left-20-000-chime-users-unable-to-access-accounts"},{"id":"26-0111","target":"Consumers in broker datasets","actor":"None — commercial","vector":"Data aggregation","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2026-01-11","date":"11 January 2026","href":"/files/26-0111-breached-broker-datasets-leave-consumers-with-no-account-to-close"},{"id":"26-0110","target":"Consumer connected devices","actor":"Multiple","vector":"Unpatched firmware","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-01-10","date":"10 January 2026","href":"/files/26-0110-billions-of-consumer-routers-and-cameras-receive-no-updates-after-a-few"},{"id":"26-0109","target":"Open-source ecosystem","actor":"Unattributed","vector":"Funding structure","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2026-01-09","date":"9 January 2026","href":"/files/26-0109-open-source-ecosystem-who-pays-for-the-code-everything-runs-on"},{"id":"26-0107","target":"Aviation and aerospace sector","actor":"Multiple","vector":"Various","sector":"Logistics","dwell":null,"sev":4,"status":"Open","sortDate":"2026-01-07","date":"7 January 2026","href":"/files/26-0107-ten-significant-attacks-on-aviation-in-a-year-and-counting"},{"id":"26-0106","target":"Encrypted traffic in transit","actor":"Multiple nation-states","vector":"Bulk collection","sector":"Multiple","dwell":null,"sev":5,"status":"Open","sortDate":"2026-01-06","date":"6 January 2026","href":"/files/26-0106-encrypted-traffic-in-transit-five-national-agencies-confirm-harvest-now"},{"id":"26-0105","target":"Wireless carriers","actor":"Unattributed","vector":"Regulatory","sector":"Telecom","dwell":null,"sev":3,"status":"Open","sortDate":"2026-01-05","date":"5 January 2026","href":"/files/26-0105-wireless-carriers-the-regulator-told-carriers-to-make-it-harder"},{"id":"26-0104","target":"Healthcare technology estate","actor":"Multiple","vector":"Unpatched dependencies","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2026-01-04","date":"4 January 2026","href":"/files/26-0104-healthcare-technology-estate-the-sector-least-able-to-absorb-this"},{"id":"26-0102","target":"Supplier security obligations","actor":"Unattributed","vector":"Litigation","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2026-01-02","date":"2 January 2026","href":"/files/26-0102-commercial-counterparties-increasingly-litigate-supplier-security"},{"id":"25-1231b","target":"Breach measurement","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-12-31","date":"31 December 2025","href":"/files/25-1231b-three-mandatory-breach-registers-now-set-the-limits-of-what-this"},{"id":"25-1231","target":"Extortion negotiation","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-31","date":"31 December 2025","href":"/files/25-1231-a-fragmented-extortion-ecosystem-changes-what-paying-a-ransom-buys"},{"id":"25-1230b","target":"Australian organisations","actor":"Multiple and none","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"Australia","sortDate":"2025-12-30","date":"30 December 2025","href":"/files/25-1230b-australian-organisations-716-of-australias-1-205-breach-notifications"},{"id":"25-1230","target":"Ransomware measurement","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-30","date":"30 December 2025","href":"/files/25-1230-ransomware-measurement-two-trackers-counted-2025-leak-site-victims"},{"id":"25-1229b","target":"Australian organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"Australia","sortDate":"2025-12-29","date":"29 December 2025","href":"/files/25-1229b-australian-organisations-australia-recorded-1-205-notifiable-data"},{"id":"25-1229","target":"Polish power grid","actor":"Unattributed","vector":"Not established","sector":"Utilities","dwell":null,"sev":4,"status":"Open","jurisdiction":"Poland","sortDate":"2025-12-29","date":"29 December 2025","href":"/files/25-1229-attack-on-polish-power-grid-targeted-it-systems-and-industrial-devices"},{"id":"25-1228b","target":"ManageMyHealth","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Open","jurisdiction":"New Zealand","sortDate":"2025-12-28","date":"28 December 2025","href":"/files/25-1228b-managemyhealth-breach-exfiltrated-medical-documents-for-120-000-patients"},{"id":"25-1228","target":"Breached organisations","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-28","date":"28 December 2025","href":"/files/25-1228-breached-organisations-close-to-1-900-data-privacy-class-actions-filed"},{"id":"25-1227b","target":"Breach measurement","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"Australia","sortDate":"2025-12-27","date":"27 December 2025","href":"/files/25-1227b-australias-eight-years-of-breach-statistics-show-what-a-register"},{"id":"25-1227","target":"Affected individuals","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-27","date":"27 December 2025","href":"/files/25-1227-compensation-to-affected-individuals-appears-twice-in-587-files"},{"id":"25-1226b","target":"Containment measurement","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-27","date":"27 December 2025","href":"/files/25-1226b-half-of-2025-extortion-involved-no-encryption-so-containment-metrics"},{"id":"25-1226","target":"Ransomware ecosystem","actor":"Multiple","vector":"Ransomware-as-a-service","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-26","date":"26 December 2025","href":"/files/25-1226-active-ransomware-groups-reached-a-record-124-in-2025"},{"id":"25-1225b","target":"This database","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-26","date":"26 December 2025","href":"/files/25-1225b-incident-response-data-shows-this-database-records-failures-not"},{"id":"25-1225","target":"This database","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-25","date":"25 December 2025","href":"/files/25-1225-an-accounting-of-what-this-database-is-not"},{"id":"25-1224b","target":"Detection capability","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":9,"sev":3,"status":"Open","sortDate":"2025-12-24","date":"24 December 2025","href":"/files/25-1224b-detection-capability-fifty-two-per-cent-found-it-themselves"},{"id":"25-1224","target":"AI agent deployments","actor":"Multiple","vector":"Prompt injection","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-24","date":"24 December 2025","href":"/files/25-1224-ai-agent-deployments-promptware-research-traces-a-shift-to-multi-stage"},{"id":"25-1223b","target":"Dwell time measurement","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-23","date":"23 December 2025","href":"/files/25-1223b-two-incident-response-practices-reported-dwell-times-of-14-days-and-two"},{"id":"25-1223","target":"Regulatory coverage","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-23","date":"23 December 2025","href":"/files/25-1223-2025-regulatory-reforms-leave-gaps-no-instrument-in-this-corpus"},{"id":"25-1222b","target":"Healthcare sector","actor":"Multiple","vector":"Various","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-22","date":"22 December 2025","href":"/files/25-1222b-the-healthcare-year-as-this-database-recorded-it"},{"id":"25-1222","target":"Ransomware ecosystem","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-22","date":"22 December 2025","href":"/files/25-1222-ransomware-ecosystem-a-record-year-for-enforcement-and-a-record-year"},{"id":"25-1221","target":"Corpus findings","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-21","date":"21 December 2025","href":"/files/25-1221-corpus-findings-what-the-structural-findings-look-like-from-outside"},{"id":"25-1220c","target":"UK public services","actor":"Multiple","vector":"Various","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-12-21","date":"21 December 2025","href":"/files/25-1220c-the-uk-public-sector-year"},{"id":"25-1220b","target":"Healthcare sector","actor":"Multiple","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-20","date":"20 December 2025","href":"/files/25-1220b-four-properties-combine-in-healthcare-that-combine-nowhere-else"},{"id":"25-1220","target":"Breached organisations","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-20","date":"20 December 2025","href":"/files/25-1220-breached-organisations-a-record-year-for-settlements-again"},{"id":"25-1219b","target":"Supplier concentration","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-20","date":"20 December 2025","href":"/files/25-1219b-seventeen-million-patients-depended-on-one-supplier-most-had-never-heard"},{"id":"25-1219","target":"Breach harm evidence","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-19","date":"19 December 2025","href":"/files/25-1219-nobody-can-connect-a-breach-to-a-fraud"},{"id":"25-1218c","target":"Incident record formation","actor":"Not applicable","vector":"Not applicable","sector":"Healthcare","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-12-19","date":"19 December 2025","href":"/files/25-1218c-incident-record-formation-it-reached-the-record-through-a-stock-exchange"},{"id":"25-1218b","target":"Ransomware measurement","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-18","date":"18 December 2025","href":"/files/25-1218b-ransomware-measurement-what-publicly-disclosed-leaves-out"},{"id":"25-1218","target":"National populations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-18","date":"18 December 2025","href":"/files/25-1218-national-populations-when-one-breach-covers-most-of-a-country"},{"id":"25-1217b","target":"Ransomware victims","actor":"Multiple","vector":"Data extortion","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-17","date":"17 December 2025","href":"/files/25-1217b-ransomware-encryption-rate-fell-to-50-in-2025-from-70"},{"id":"25-1217","target":"Latin American government bodies","actor":"Multiple","vector":"Various","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-12-17","date":"17 December 2025","href":"/files/25-1217-latin-american-government-bodies-government-data-taken-in-bulk"},{"id":"25-1216b","target":"Ransomware defence","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-16","date":"16 December 2025","href":"/files/25-1216b-47-of-ransomware-attacks-were-halted-before-encryption-in-2025-vendor"},{"id":"25-1216","target":"Enterprise software estates","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-16","date":"16 December 2025","href":"/files/25-1216-enterprise-software-estates-newly-disclosed-vulnerabilities-weaponised"},{"id":"25-1215b","target":"US healthcare providers","actor":"Multiple","vector":"Ransomware-as-a-service","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-12-15","date":"15 December 2025","href":"/files/25-1215b-five-operations-accounted-for-most-attacks-on-us-healthcare-in-2025"},{"id":"25-1215","target":"Cross-border suppliers","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-12-15","date":"15 December 2025","href":"/files/25-1215-cross-border-suppliers-uk-bill-and-eu-nis2-diverge-on-scope-supervision"},{"id":"25-1214b","target":"DXS International","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-18","date":"18 December 2025","href":"/files/25-1214b-dxs-international-dxs-international-incident-hit-clinical-software-used"},{"id":"25-1214","target":"Global breach measurement","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-14","date":"14 December 2025","href":"/files/25-1214-global-breach-measurement-the-global-total-and-why-it-is-not-one-thing"},{"id":"25-1213","target":"Southeast Asian organisations","actor":"Chinese state-linked actors","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","jurisdiction":"Taiwan","sortDate":"2025-12-13","date":"13 December 2025","href":"/files/25-1213-chinese-espionage-campaigns-targeted-southeast-asia-across-four-sectors"},{"id":"25-1212","target":"French Interior Ministry","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"France","sortDate":"2025-12-12","date":"12 December 2025","href":"/files/25-1212-french-interior-ministry-the-email-servers-of-an-interior-ministry"},{"id":"25-1211b","target":"Medical organisations","actor":"Multiple","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-11","date":"11 December 2025","href":"/files/25-1211b-medical-organisations-absorbed-22-of-disclosed-ransomware-attacks"},{"id":"25-1211","target":"Security workforce","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-11","date":"11 December 2025","href":"/files/25-1211-budget-cuts-overtook-talent-scarcity-as-the-top-cause-of-security"},{"id":"25-1210b","target":"Ransomware measurement","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-10","date":"10 December 2025","href":"/files/25-1210b-a-fourth-2025-ransomware-total-puts-publicly-disclosed-attacks-at-1-174"},{"id":"25-1210","target":"Digital asset platforms","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-10","date":"10 December 2025","href":"/files/25-1210-digital-asset-platforms-crypto-losses-reached-3-4-billion-across-more"},{"id":"25-1209","target":"Security workforce","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-09","date":"9 December 2025","href":"/files/25-1209-cybersecurity-workforce-gap-reached-a-record-4-8-million-unfilled-roles"},{"id":"25-1208","target":"Princeton; Harvard","actor":"Unattributed","vector":"Voice phishing","sector":"Education","dwell":1,"sev":4,"status":"Closed","sortDate":"2025-12-08","date":"8 December 2025","href":"/files/25-1208-princeton-and-harvard-breached-by-phone-based-phishing-against-alumni"},{"id":"25-1207","target":"SaaS authorisations","actor":"Multiple","vector":"Durable credentials","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-07","date":"7 December 2025","href":"/files/25-1207-saas-authorisations-an-oauth-grant-persists-until-somebody-removes-it"},{"id":"25-1206","target":"Asia-Pacific organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-06","date":"6 December 2025","href":"/files/25-1206-five-countries-accounted-for-62-of-tracked-incidents-across-asia-pacific"},{"id":"25-1205","target":"Scattered Spider cluster","actor":"Scattered Spider","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-12-05","date":"5 December 2025","href":"/files/25-1205-seventh-scattered-spider-arrest-made-as-the-campaign-continued"},{"id":"25-1204","target":"Industrial sector","actor":"Multiple","vector":"Various","sector":"Manufacturing","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-04","date":"4 December 2025","href":"/files/25-1204-manufacturing-absorbed-56-of-ransomware-activity-across-1-929-industrial"},{"id":"25-1203","target":"Asia and South Pacific","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-12-03","date":"3 December 2025","href":"/files/25-1203-data-breaches-made-up-39-9-of-incidents-across-asia-and-the-south"},{"id":"25-1202","target":"Asia and South Pacific","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-12-02","date":"2 December 2025","href":"/files/25-1202-asia-and-south-pacific-interpol-found-cybercrime-is-30-of-recorded-crime"},{"id":"25-1201","target":"Global breach landscape","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-12-01","date":"1 December 2025","href":"/files/25-1201-44-of-2025-breaches-involved-ransomware-and-30-a-third-party-failure"},{"id":"25-1130","target":"Coupang","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-30","date":"30 November 2025","href":"/files/25-1130-coupang-breach-affected-33-7-million-customer-accounts"},{"id":"25-1129","target":"Upbit","actor":"Lazarus Group","vector":"Not established","sector":"Finance","dwell":null,"sev":4,"status":"Open","jurisdiction":"South Korea","sortDate":"2025-11-29","date":"29 November 2025","href":"/files/25-1129-lazarus-group-took-30-4-million-from-upbit-south-korean-authorities-say"},{"id":"25-1128b","target":"Multiple sectors","actor":"Qilin","vector":"Ransomware-as-a-service","sector":"Multiple","dwell":null,"sev":4,"status":"Open","jurisdiction":"Canada","sortDate":"2025-11-28","date":"28 November 2025","href":"/files/25-1128b-six-sectors-one-operation-one-year"},{"id":"25-1128","target":"Eurofiber","actor":"Unattributed","vector":"Not established","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-28","date":"28 November 2025","href":"/files/25-1128-eurofiber-breach-exposed-documentation-of-european-network"},{"id":"25-1127c","target":"BioPharma Services Inc.","actor":"Qilin","vector":"Not established","sector":"Pharma","dwell":null,"sev":3,"status":"Open","jurisdiction":"Canada","sortDate":"2025-11-30","date":"30 November 2025","href":"/files/25-1127c-qilin-claims-breach-of-contract-research-organisation-biopharma-services"},{"id":"25-1127b","target":"London borough residents","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-11-29","date":"29 November 2025","href":"/files/25-1127b-telephone-systems-went-down-at-three-london-councils"},{"id":"25-1127","target":"Nevada state government","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2025-11-27","date":"27 November 2025","href":"/files/25-1127-nevada-published-a-1-5-million-incident-response-bill"},{"id":"25-1126c","target":"Kensington and Chelsea","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-27","date":"27 November 2025","href":"/files/25-1126c-kensington-and-chelsea-says-historical-data-was-copied-but-not-encrypted"},{"id":"25-1126b","target":"Securities firms","actor":"Regulator","vector":"Not applicable","sector":"Finance","dwell":null,"sev":2,"status":"Closed","sortDate":"2025-11-28","date":"28 November 2025","href":"/files/25-1126b-securities-firms-a-regulator-told-the-market"},{"id":"25-1126","target":"Puerto Rico government agencies","actor":"Unattributed","vector":"Compromised credentials","sector":"Public sector","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-11-26","date":"26 November 2025","href":"/files/25-1126-puerto-rico-government-agencies-several-agencies-one-contractor"},{"id":"25-1125b","target":"Three London boroughs","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-11-25","date":"25 November 2025","href":"/files/25-1125b-three-london-boroughs-at-once"},{"id":"25-1125","target":"Nevada state government","actor":"Unattributed","vector":"Trojanised software download","sector":"Public sector","dwell":102,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2025-11-25","date":"25 November 2025","href":"/files/25-1125-nevada-state-government-a-hundred-and-two-days-inside-a-state-government"},{"id":"25-1124b","target":"Client institutions","actor":"Unattributed","vector":"Not established","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-26","date":"26 November 2025","href":"/files/25-1124b-client-institutions-accounting-records-and-legal-agreements-trigger"},{"id":"25-1124","target":"UK supplier population","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-11-24","date":"24 November 2025","href":"/files/25-1124-managed-service-providers-data-centres-and-designated-critical-suppliers"},{"id":"25-1123","target":"African disclosure regimes","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-23","date":"23 November 2025","href":"/files/25-1123-african-data-protection-regimes-made-2025-incidents-harder-to-conceal"},{"id":"25-1122","target":"US consumers","actor":"Multiple","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-11-22","date":"22 November 2025","href":"/files/25-1122-us-consumers-us-imposter-scam-losses-passed-1-billion-in-a-single"},{"id":"25-1121b","target":"SaaS tenants","actor":"Unattributed","vector":"Integration compromise","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-21","date":"21 November 2025","href":"/files/25-1121b-saas-tenants-salesforce-found-unauthorised-access-to-customer-data-via"},{"id":"25-1121","target":"UK regulated entities","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-11-21","date":"21 November 2025","href":"/files/25-1121-uk-regulated-entities-draft-uk-bill-proposes-fines-up-to-17-million-or-4"},{"id":"25-1120","target":"Automotive sector","actor":"Multiple","vector":"Various","sector":"Manufacturing","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-20","date":"20 November 2025","href":"/files/25-1120-automotive-ransomware-more-than-doubled-and-the-cars-are-next"},{"id":"25-1119b","target":"DoorDash","actor":"Unattributed","vector":"Social engineering","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-19","date":"19 November 2025","href":"/files/25-1119b-doordash-affected-through-social-engineering-of-an-employee"},{"id":"25-1119","target":"UK regulated entities","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-11-19","date":"19 November 2025","href":"/files/25-1119-uk-regulated-entities-draft-uk-bill-proposes-24-hour-initial-breach"},{"id":"25-1118","target":"Browsing AI agents","actor":"Unattributed","vector":"Indirect prompt injection","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-18","date":"18 November 2025","href":"/files/25-1118-browsing-ai-agents-researchers-documented-indirect-prompt-injection"},{"id":"25-1117","target":"Regional risk measurement","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-17","date":"17 November 2025","href":"/files/25-1117-regional-risk-measurement-riskiest-region-is-a-sentence-about-sensors"},{"id":"25-1116","target":"Latin American organisations","actor":"Multiple","vector":"Ransomware","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-11-16","date":"16 November 2025","href":"/files/25-1116-three-countries-account-for-most-latin-american-ransomware-victims"},{"id":"25-1115","target":"Latin American organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-11-15","date":"15 November 2025","href":"/files/25-1115-latin-american-organisations-faced-2-640-attacks-per-week-in-2025"},{"id":"25-1114","target":"Logistics sector","actor":"Multiple","vector":"Various","sector":"Logistics","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-14","date":"14 November 2025","href":"/files/25-1114-logistics-sector-a-tenfold-rise-in-attacks-on-the-sector-that-moves"},{"id":"25-1113","target":"UK regulated entities","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-11-13","date":"13 November 2025","href":"/files/25-1113-uk-regulated-entities-uk-publishes-draft-cyber-security-and-resilience"},{"id":"25-1112c","target":"Small organisations","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-11-12","date":"12 November 2025","href":"/files/25-1112c-the-provider-is-how-small-firms-enter-the-record"},{"id":"25-1112b","target":"SitusAMC","actor":"Unattributed","vector":"Not established","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-24","date":"24 November 2025","href":"/files/25-1112b-situsamc-attack-exposed-client-records-including-jpmorgan-agreements"},{"id":"25-1112","target":"Telecom subscribers","actor":"Salt Typhoon","vector":"Lawful-intercept infrastructure","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-12","date":"12 November 2025","href":"/files/25-1112-telecom-subscribers-a-million-users-metadata-is-not-a-lesser-breach"},{"id":"25-1111b","target":"South Korean asset managers","actor":"Qilin","vector":"MSP compromise","sector":"Finance","dwell":null,"sev":4,"status":"Open","jurisdiction":"South Korea","sortDate":"2025-11-11","date":"11 November 2025","href":"/files/25-1111b-qilin-branded-south-korean-asset-manager-victims-as-korean-leaks"},{"id":"25-1111","target":"SIAD Group","actor":"Everest","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":3,"status":"Open","geo":{"place":"Bergamo","country":"Italy","lon":9.67,"lat":45.7},"jurisdiction":"Italy","sortDate":"2025-11-11","date":"11 November 2025","href":"/files/25-1111-siad-group-a-hundred-and-fifty-nine-gigabytes-claimed"},{"id":"25-1110b","target":"South Korean asset managers","actor":"Qilin","vector":"MSP compromise","sector":"Finance","dwell":null,"sev":5,"status":"Open","jurisdiction":"South Korea","sortDate":"2025-11-10","date":"10 November 2025","href":"/files/25-1110b-south-korean-asset-managers-one-provider-twenty-asset-managers"},{"id":"25-1110","target":"Oracle EBS customers, multiple","actor":"Cl0p","vector":"CVE-2025-61882","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2025-11-10","date":"10 November 2025","href":"/files/25-1110-cl0p-oracle-ebs-victim-list-spans-schneider-electric-logitech"},{"id":"25-1109","target":"Telecommunications sector","actor":"Qilin","vector":"Ransomware-as-a-service","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-09","date":"9 November 2025","href":"/files/25-1109-telecommunications-sector-qilin-led-telecom-ransomware-activity-in-2025"},{"id":"25-1108","target":"Ransomware ecosystem","actor":"Qilin","vector":"Ransomware-as-a-service","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-08","date":"8 November 2025","href":"/files/25-1108-ransomware-ecosystem-qilin-named-victims-rose-420-to-lead-all-operations"},{"id":"25-1107b","target":"Edge appliance estates","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-09","date":"9 November 2025","href":"/files/25-1107b-two-ways-an-edge-device-fails-and-only-one-is-forgivable"},{"id":"25-1107","target":"Public-sector disclosure practice","actor":"Not applicable","vector":"Not applicable","sector":"Public sector","dwell":null,"sev":2,"status":"Open","jurisdiction":"United States","sortDate":"2025-11-07","date":"7 November 2025","href":"/files/25-1107-nevada-published-after-action-reports-almost-no-other-public-body-does"},{"id":"25-1106b","target":"Congressional Budget Office","actor":"Unattributed","vector":"Unpatched edge device","sector":"Public sector","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-07","date":"7 November 2025","href":"/files/25-1106b-congressional-budget-office-compromise-linked-to-unpatched-cisco-asa"},{"id":"25-1106","target":"City of Saint Paul","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-11-06","date":"6 November 2025","href":"/files/25-1106-city-of-saint-paul-saint-paul-still-recovering-long-after-the-attack"},{"id":"25-1105","target":"Prosper Marketplace","actor":"Unattributed","vector":"Not established","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2025-11-05","date":"5 November 2025","href":"/files/25-1105-prosper-marketplace-breach-affected-more-than-10-million-customers"},{"id":"25-1104","target":"US consumers","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-11-04","date":"4 November 2025","href":"/files/25-1104-us-consumers-us-identity-fraud-losses-put-at-27-3-billion-for-2025"},{"id":"25-1103","target":"Security vendors","actor":"State-sponsored","vector":"Supply chain positioning","sector":"Cloud","dwell":null,"sev":5,"status":"Open","sortDate":"2025-11-03","date":"3 November 2025","href":"/files/25-1103-two-security-vendors-in-two-months-by-state-actors"},{"id":"25-1102","target":"Security labour market","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-11-02","date":"2 November 2025","href":"/files/25-1102-dissenting-research-argues-the-security-workforce-shortage-is-overstated"},{"id":"25-1101","target":"Asahi Group Holdings","actor":"Qilin","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-11-01","date":"1 November 2025","href":"/files/25-1101-asahi-suspended-manufacturing-and-logistics-systems-after-qilin-attack"},{"id":"25-1031","target":"Settlement class members","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-31","date":"31 October 2025","href":"/files/25-1031-breach-settlements-pay-up-to-2-000-on-documented-losses-only"},{"id":"25-1030","target":"UK automotive sector","actor":"Multiple","vector":"Various","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2025-10-30","date":"30 October 2025","href":"/files/25-1030-uk-automotive-sector-uk-car-production-fell-27-after-the-jaguar-land"},{"id":"25-1029","target":"Tenant clients and personnel","actor":"ShinyHunters","vector":"Targeted phishing","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-29","date":"29 October 2025","href":"/files/25-1029-tenant-clients-and-personnel-shinyhunters-used-stolen-crm-data-to-phish"},{"id":"25-1028","target":"University of Pennsylvania","actor":"Unattributed","vector":"Not established","sector":"Education","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-10-28","date":"28 October 2025","href":"/files/25-1028-university-of-pennsylvania-alumni-and-development-systems-accessed"},{"id":"25-1027","target":"Marquis client institutions","actor":"Akira","vector":"Unpatched edge device","sector":"Finance","dwell":74,"sev":3,"status":"Closed","sortDate":"2025-10-27","date":"27 October 2025","href":"/files/25-1027-marquis-client-institutions-discovered-the-same-day-told-the-clients-ten"},{"id":"25-1026","target":"Princeton University","actor":"Unattributed","vector":"Voice phishing","sector":"Education","dwell":1,"sev":3,"status":"Closed","sortDate":"2025-10-26","date":"26 October 2025","href":"/files/25-1026-princeton-detected-and-ejected-attackers-within-a-day"},{"id":"25-1025","target":"Higher education sector","actor":"Multiple","vector":"Various","sector":"Education","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-25","date":"25 October 2025","href":"/files/25-1025-higher-education-sector-universities-hold-records-decades-after-any"},{"id":"25-1024","target":"University advancement offices","actor":"Multiple","vector":"Voice phishing","sector":"Education","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-24","date":"24 October 2025","href":"/files/25-1024-the-fundraising-office-is-the-softest-part-of-a-university"},{"id":"25-1023","target":"UK water suppliers","actor":"Multiple","vector":"Various","sector":"Utilities","dwell":null,"sev":3,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-10-23","date":"23 October 2025","href":"/files/25-1023-fifteen-reports-from-the-water-companies-in-twenty-two-months"},{"id":"25-1022","target":"Multiple sectors","actor":"Multiple","vector":"Voice phishing","sector":"Multiple","dwell":null,"sev":5,"status":"Open","sortDate":"2025-10-22","date":"22 October 2025","href":"/files/25-1022-multiple-sectors-retail-insurance-aviation-and-universities-all-fell"},{"id":"25-1021","target":"Middle East organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-21","date":"21 October 2025","href":"/files/25-1021-extortion-drove-more-than-half-of-middle-east-cyberattacks-in-2025"},{"id":"25-1020","target":"University donors","actor":"Unattributed","vector":"Voice phishing","sector":"Education","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-20","date":"20 October 2025","href":"/files/25-1020-university-donors-will-the-donors-be-told"},{"id":"25-1019","target":"Nigerian organisations","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":3,"status":"Open","jurisdiction":"Nigeria","sortDate":"2025-10-19","date":"19 October 2025","href":"/files/25-1019-nigerian-organisations-nigeria-reported-23-2-million-attempted"},{"id":"25-1018","target":"M-TIBA","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","jurisdiction":"Kenya","sortDate":"2025-10-18","date":"18 October 2025","href":"/files/25-1018-m-tiba-they-put-the-health-records-on-telegram"},{"id":"25-1017","target":"Envoy Air","actor":"Cl0p","vector":"CVE-2025-61882","sector":"Logistics","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2025-10-17","date":"17 October 2025","href":"/files/25-1017-envoy-air-confirms-it-was-caught-in-the-cl0p-oracle-ebs-campaign"},{"id":"25-1016","target":"The Washington Post","actor":"Cl0p","vector":"CVE-2025-61882","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-16","date":"16 October 2025","href":"/files/25-1016-washington-post-named-among-oracle-ebs-extortion-victims"},{"id":"25-1015b","target":"Pharmaceutical sector","actor":"Multiple","vector":"Various","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-15","date":"15 October 2025","href":"/files/25-1015b-the-pharmaceutical-year-and-what-the-corpus-cannot-see-in-it"},{"id":"25-1015","target":"F5","actor":"Nation-state","vector":"Long-term compromise","sector":"Cloud","dwell":null,"sev":5,"status":"Contained","sortDate":"2025-10-15","date":"15 October 2025","href":"/files/25-1015-f5-f5-says-nation-state-actor-held-long-term-access-and-took-big-ip"},{"id":"25-1014b","target":"Pharmaceutical sector","actor":"Regulator","vector":"Not applicable","sector":"Pharma","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-14","date":"14 October 2025","href":"/files/25-1014b-pharmaceutical-rules-govern-data-integrity-but-barely-touch-network"},{"id":"25-1014","target":"BreachForums","actor":"Multiple","vector":"Marketplace","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-10-14","date":"14 October 2025","href":"/files/25-1014-us-and-french-authorities-seize-breachforums-servers-and-archives"},{"id":"25-1013b","target":"Goldman Sachs clients","actor":"Unattributed","vector":"Third party","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-13","date":"13 October 2025","href":"/files/25-1013b-goldman-sachs-clients-a-bank-said-its-clients-data-may-have-been-exposed"},{"id":"25-1013","target":"US consumers","actor":"Multiple","vector":"Identity theft","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-10-13","date":"13 October 2025","href":"/files/25-1013-us-consumers-ftc-identity-theft-reports-passed-the-2024-total"},{"id":"25-1012","target":"Harvard University","actor":"Cl0p","vector":"CVE-2025-61882","sector":"Education","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-10-12","date":"12 October 2025","href":"/files/25-1012-harvard-university-a-universitys-finance-system-1-3-terabytes-and-a-leak"},{"id":"25-1011b","target":"Self-service estates","actor":"Multiple","vector":"Delegated authority abuse","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-11","date":"11 October 2025","href":"/files/25-1011b-self-service-moved-the-identity-boundary-onto-the-employee"},{"id":"25-1011","target":"Askul Corporation","actor":"RansomHouse","vector":"Not established","sector":"Logistics","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-10-21","date":"21 October 2025","href":"/files/25-1011-askul-corporation-seven-hundred-and-forty-thousand-records-and-the-shops"},{"id":"25-1010b","target":"Affected employees","actor":"Not applicable","vector":"Not applicable","sector":"Education","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-10","date":"10 October 2025","href":"/files/25-1010b-affected-employees-a-redirected-salary-leaves-unsettled-who-carries"},{"id":"25-1010","target":"Healthcare sector records","actor":"Multiple","vector":"Various","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-10","date":"10 October 2025","href":"/files/25-1010-healthcare-sector-records-two-hundred-and-seventy-five-million-patient"},{"id":"25-1009b","target":"US university employees","actor":"Unattributed","vector":"HR self-service abuse","sector":"Education","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-10-09","date":"9 October 2025","href":"/files/25-1009b-compromised-accounts-used-to-alter-us-university-payroll-deposits"},{"id":"25-1009","target":"Agent deployments","actor":"Multiple","vector":"Tool poisoning","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-09","date":"9 October 2025","href":"/files/25-1009-giving-the-agent-tools-is-giving-the-attacker-tools"},{"id":"25-1008","target":"Jaguar Land Rover","actor":"Scattered Lapsus$ Hunters","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Coventry","country":"United Kingdom","lon":-1.51,"lat":52.41},"sortDate":"2025-10-08","date":"8 October 2025","href":"/files/25-1008-jaguar-land-rover-restarted-full-production-five-weeks-after-the-halt"},{"id":"25-1007","target":"Oracle enterprise estates","actor":"Cl0p","vector":"Mass exploitation","sector":"Multiple","dwell":null,"sev":5,"status":"Open","jurisdiction":"South Korea","sortDate":"2025-10-07","date":"7 October 2025","href":"/files/25-1007-oracle-enterprise-estates-one-enterprise-application-victims-on-four"},{"id":"25-1006","target":"CRM tenants","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-06","date":"6 October 2025","href":"/files/25-1006-crm-tenants-a-crm-holds-the-commercial-position-of-every-account-in-one"},{"id":"25-1005b","target":"Small organisations","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-05","date":"5 October 2025","href":"/files/25-1005b-the-only-time-this-database-saw-the-small-end"},{"id":"25-1005","target":"Chess.com","actor":"Unattributed","vector":"Third-party file transfer","sector":"Cloud","dwell":13,"sev":2,"status":"Closed","sortDate":"2025-09-20","date":"20 September 2025","href":"/files/25-1005-chess-com-breach-affected-4-541-people-via-third-party-file-transfer"},{"id":"25-1004c","target":"Jaguar Land Rover","actor":"Scattered Lapsus$ Hunters","vector":"Downstream of 25-0902","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-04","date":"4 October 2025","href":"/files/25-1004c-jaguar-land-rover-cut-hundreds-of-roles-after-the-attack"},{"id":"25-1004b","target":"Customer support estates","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-04","date":"4 October 2025","href":"/files/25-1004b-customer-support-was-the-route-into-four-separate-2025-incidents"},{"id":"25-1004","target":"Ransomware ecosystem","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-04","date":"4 October 2025","href":"/files/25-1004-ransomware-ecosystem-ten-groups-accounted-for-71-of-leak-site-postings"},{"id":"25-1003c","target":"JLR supply chain","actor":"Not applicable","vector":"Not applicable","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","sortDate":"2025-10-03","date":"3 October 2025","href":"/files/25-1003c-jlr-supply-chain-officials-weighed-furlough-and-buying-jlr-parts"},{"id":"25-1003b","target":"Discord","actor":"Unattributed","vector":"Third-party support provider","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2025-10-03","date":"3 October 2025","href":"/files/25-1003b-discord-breach-reached-billing-details-via-third-party-support-provider"},{"id":"25-1003","target":"Logitech","actor":"Cl0p","vector":"Zero-day exploitation","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-11-17","date":"17 November 2025","href":"/files/25-1003-logitech-the-oracle-campaign-named-another-one"},{"id":"25-1002b","target":"JLR supply chain","actor":"Not applicable","vector":"Not applicable","sector":"Manufacturing","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-10-02","date":"2 October 2025","href":"/files/25-1002b-somebody-surveyed-the-supply-chain"},{"id":"25-1002","target":"Muji","actor":"RansomHouse","vector":"Supplier incident","sector":"Retail","dwell":null,"sev":3,"status":"Closed","geo":{"place":"Tokyo","country":"Japan","lon":139.69,"lat":35.69},"sortDate":"2025-10-21","date":"21 October 2025","href":"/files/25-1002-muji-a-retailer-that-was-never-attacked-stopped-selling"},{"id":"25-1001b","target":"Unnamed JLR supplier","actor":"Scattered Lapsus$ Hunters","vector":"Downstream of 25-0902","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-10-01","date":"1 October 2025","href":"/files/25-1001b-unnamed-jlr-supplier-a-jlr-supplier-laid-off-half-its-workforce-during"},{"id":"25-1001","target":"Under Armour","actor":"Everest","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Open","geo":{"place":"Baltimore, Maryland","country":"United States","lon":-76.61,"lat":39.29},"sortDate":"2025-11-20","date":"20 November 2025","href":"/files/25-1001-under-armour-three-hundred-and-forty-three-gigabytes-claimed-in-november"},{"id":"25-0930b","target":"JLR small suppliers","actor":"Scattered Lapsus$ Hunters","vector":"Downstream of 25-0902","sector":"Manufacturing","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-09-30","date":"30 September 2025","href":"/files/25-0930b-jlr-small-suppliers-told-mps-they-had-a-week-before-running-out-of-money"},{"id":"25-0930","target":"Oracle EBS deployments","actor":"Cl0p","vector":"CVE-2025-61882","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-09-30","date":"30 September 2025","href":"/files/25-0930-oracle-ebs-deployments-one-zero-day-twenty-nine-named-victims-no"},{"id":"25-0929b","target":"JLR supply chain","actor":"Scattered Lapsus$ Hunters","vector":"Downstream of 25-0902","sector":"Manufacturing","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-09-29","date":"29 September 2025","href":"/files/25-0929b-jlr-supply-chain-a-quarter-of-jaguar-land-rover-suppliers-paused"},{"id":"25-0929","target":"Harrods","actor":"Unattributed","vector":"Supplier compromise","sector":"Retail","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-09-29","date":"29 September 2025","href":"/files/25-0929-harrods-attacked-in-april-breached-in-september-through-somebody-else"},{"id":"25-0928","target":"Jaguar Land Rover supply chain","actor":"Scattered Lapsus$ Hunters","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2025-09-28","date":"28 September 2025","href":"/files/25-0928-jaguar-land-rover-supply-chain-uk-government-guarantee-unlocked-1-5"},{"id":"25-0927","target":"Children as data subjects","actor":"Multiple","vector":"Various","sector":"Education","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-27","date":"27 September 2025","href":"/files/25-0927-children-as-data-subjects-every-remediation-mechanism-in-this-corpus"},{"id":"25-0926","target":"Kido International","actor":"Unattributed","vector":"Not established","sector":"Education","dwell":null,"sev":5,"status":"Open","sortDate":"2025-09-26","date":"26 September 2025","href":"/files/25-0926-kido-international-attackers-published-nursery-childrens-details"},{"id":"25-0925","target":"Cross-border incident classification","actor":"Unattributed","vector":"Governance","sector":"Logistics","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-09-25","date":"25 September 2025","href":"/files/25-0925-cross-border-incident-enisa-confirmed-european-airport-disruption"},{"id":"25-0924b","target":"Incident record formation","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-09-24","date":"24 September 2025","href":"/files/25-0924b-incident-record-formation-boyd-gaming-reached-the-public-record-through"},{"id":"25-0924","target":"Incident disclosure practice","actor":"Not applicable","vector":"Not applicable","sector":"Public sector","dwell":null,"sev":2,"status":"Open","jurisdiction":"United States","sortDate":"2025-09-24","date":"24 September 2025","href":"/files/25-0924-incident-disclosure-practice-six-files-exist-because-nevada-published"},{"id":"25-0923c","target":"Pharmaceutical research","actor":"Multiple","vector":"Ransomware","sector":"Pharma","dwell":null,"sev":3,"status":"Open","sortDate":"2025-09-23","date":"23 September 2025","href":"/files/25-0923c-pharmaceutical-research-stopping-research-is-a-harm-with-no-victim"},{"id":"25-0923b","target":"Boyd Gaming Corporation","actor":"Unattributed","vector":"Not established","sector":"Hospitality","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2025-09-23","date":"23 September 2025","href":"/files/25-0923b-boyd-gaming-corporation-the-employees-disclosed-to-the-regulator"},{"id":"25-0923","target":"SaaS platform tenants","actor":"ShinyHunters","vector":"Consent phishing","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-23","date":"23 September 2025","href":"/files/25-0923-saas-platform-tenants-one-technique-one-platform-several-hundred"},{"id":"25-0922b","target":"Life sciences sector","actor":"Multiple","vector":"Various","sector":"Pharma","dwell":null,"sev":2,"status":"Open","sortDate":"2025-09-22","date":"22 September 2025","href":"/files/25-0922b-life-sciences-sector-two-biopharma-breaches-were-called-a-trend-without"},{"id":"25-0922","target":"Nevada state government","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":102,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2025-09-22","date":"22 September 2025","href":"/files/25-0922-nevada-systems-stayed-offline-for-28-days-across-dmv-welfare-and-payroll"},{"id":"25-0921b","target":"Integrity failures","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-21","date":"21 September 2025","href":"/files/25-0921b-the-integrity-failure-nobody-in-this-corpus-has-recorded"},{"id":"25-0921","target":"Nevada state government","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":102,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2025-09-21","date":"21 September 2025","href":"/files/25-0921-nevada-state-government-they-refused-and-recovered-ninety-per-cent"},{"id":"25-0920b","target":"Pharmaceutical manufacturing","actor":"Multiple","vector":"Various","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-20","date":"20 September 2025","href":"/files/25-0920b-pharmaceutical-manufacturing-the-regulator-warned-about-the-factory-not"},{"id":"25-0919","target":"Collins Aerospace MUSE","actor":"Unattributed","vector":"Ransomware","sector":"Logistics","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-09-19","date":"19 September 2025","href":"/files/25-0919-collins-aerospace-ransomware-disrupted-heathrow-brussels-and-berlin"},{"id":"25-0918","target":"US public sector","actor":"Multiple","vector":"Various","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-09-18","date":"18 September 2025","href":"/files/25-0918-us-public-sector-us-government-ransomware-incidents-rose-65-in-the-first"},{"id":"25-0917","target":"SonicWall cloud backup service","actor":"State-sponsored","vector":"Service compromise","sector":"Cloud","dwell":null,"sev":5,"status":"Contained","sortDate":"2025-09-17","date":"17 September 2025","href":"/files/25-0917-sonicwall-cloud-backup-service-every-customers-firewall-configuration"},{"id":"25-0916","target":"Legal sector clients","actor":"Multiple","vector":"Various","sector":"Legal","dwell":null,"sev":3,"status":"Open","sortDate":"2025-09-16","date":"16 September 2025","href":"/files/25-0916-legal-sector-clients-the-client-is-not-the-data-subject-so-nobody-has"},{"id":"25-0915b","target":"Pharmaceutical research","actor":"Multiple","vector":"Various","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-15","date":"15 September 2025","href":"/files/25-0915b-pharmaceutical-research-attackers-targeted-drug-formulations-alongside"},{"id":"25-0914b","target":"Contract research organisations","actor":"Multiple","vector":"Various","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-14","date":"14 September 2025","href":"/files/25-0914b-contract-research-organisations-the-organisation-that-runs-everybodys"},{"id":"25-0913b","target":"Clinical trial participants","actor":"Multiple","vector":"Various","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-13","date":"13 September 2025","href":"/files/25-0913b-what-clinical-trial-data-is-exactly"},{"id":"25-0912b","target":"Novo Nordisk","actor":"Unattributed","vector":"Not established","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-12","date":"12 September 2025","href":"/files/25-0912b-novo-nordisk-clinical-trial-participants-told-to-remain-vigilant"},{"id":"25-0912","target":"Asian internet users","actor":"Multiple","vector":"Credential compromise","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-09-12","date":"12 September 2025","href":"/files/25-0912-asian-internet-users-india-accounted-for-49-of-compromised-accounts"},{"id":"25-0910","target":"Legal sector","actor":"Multiple","vector":"Various","sector":"Legal","dwell":null,"sev":3,"status":"Open","sortDate":"2025-09-10","date":"10 September 2025","href":"/files/25-0910-legal-sector-five-million-dollars-a-breach-and-fewer-firms-are-insured"},{"id":"25-0909","target":"SFR","actor":"Unattributed","vector":"Not established","sector":"Telecom","dwell":null,"sev":3,"status":"Closed","jurisdiction":"France","sortDate":"2025-09-09","date":"9 September 2025","href":"/files/25-0909-sfr-sfr-discloses-breach-involving-banking-details-weeks-after-bouygues"},{"id":"25-0908b","target":"Plex","actor":"Unattributed","vector":"Not established","sector":"Cloud","dwell":null,"sev":2,"status":"Closed","sortDate":"2025-09-08","date":"8 September 2025","href":"/files/25-0908b-plex-says-attacker-accessed-email-addresses-and-hashed-passwords"},{"id":"25-0908","target":"Ransomware ecosystem","actor":"LockBit","vector":"Ransomware-as-a-service","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-08","date":"8 September 2025","href":"/files/25-0908-ransomware-ecosystem-lockbit-resurfaced-eighteen-months-after-operation"},{"id":"25-0905","target":"Ransomware ecosystem","actor":"Scattered Lapsus$ Hunters","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-05","date":"5 September 2025","href":"/files/25-0905-ransomware-ecosystem-scattered-lapsus-hunters-formed-by-combining"},{"id":"25-0904","target":"Incident measurement","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-09-04","date":"4 September 2025","href":"/files/25-0904-incident-measurement-what-a-claim-becomes-when-it-is-finally-tested"},{"id":"25-0903","target":"File transfer estates","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-03","date":"3 September 2025","href":"/files/25-0903-managed-file-transfer-appears-four-times-in-the-2025-corpus"},{"id":"25-0902","target":"Jaguar Land Rover","actor":"Scattered Lapsus$ Hunters","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Coventry","country":"United Kingdom","lon":-1.51,"lat":52.41},"sortDate":"2025-09-02","date":"2 September 2025","href":"/files/25-0902-jaguar-land-rover-paused-global-production-for-three-weeks-booking-196"},{"id":"25-0901","target":"SaaS integration model","actor":"Unattributed","vector":"Shared responsibility gap","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-09-01","date":"1 September 2025","href":"/files/25-0901-saas-integration-model-a-token-crossing-three-vendors-belonged"},{"id":"25-0830","target":"Multiple sectors","actor":"ShinyHunters","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-30","date":"30 August 2025","href":"/files/25-0830-multiple-sectors-nine-shinyhunters-victims-notified-separately-with-no"},{"id":"25-0829","target":"Motility Software Solutions","actor":"Unattributed","vector":"Not established","sector":"Cloud","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-08-29","date":"29 August 2025","href":"/files/25-0829-motility-software-settles-breach-class-action-for-4-9-million"},{"id":"25-0828","target":"Breach remediation","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-08-28","date":"28 August 2025","href":"/files/25-0828-credit-monitoring-is-supplied-by-bureaux-that-are-themselves-breached"},{"id":"25-0827","target":"Global infrastructure operators","actor":"Salt Typhoon","vector":"Various","sector":"Telecom","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2025-08-27","date":"27 August 2025","href":"/files/25-0827-global-infrastructure-operators-fbi-says-salt-typhoon-reached-200"},{"id":"25-0826","target":"Cloudflare case records","actor":"UNC6395","vector":"OAuth token theft","sector":"Cloud","dwell":null,"sev":4,"status":"Closed","geo":{"place":"San Francisco, California","country":"United States","lon":-122.42,"lat":37.77},"sortDate":"2025-08-26","date":"26 August 2025","href":"/files/25-0826-cloudflare-says-104-api-tokens-were-exposed-via-pasted-support-cases"},{"id":"25-0824","target":"State of Nevada","actor":"Unattributed","vector":"Ransomware","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2025-08-24","date":"24 August 2025","href":"/files/25-0824-sixty-state-agencies-at-once"},{"id":"25-0821","target":"African consumers","actor":"Multiple","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-08-21","date":"21 August 2025","href":"/files/25-0821-scam-cases-reported-up-3-000-across-key-african-countries"},{"id":"25-0820","target":"Incident response practice","actor":"UNC6395","vector":"Delayed exploitation","sector":"Cloud","dwell":150,"sev":4,"status":"Closed","sortDate":"2025-08-20","date":"20 August 2025","href":"/files/25-0820-incident-response-practice-salesloft-intrusion-began-in-march-and-stayed"},{"id":"25-0819b","target":"Inotiv","actor":"Unattributed","vector":"Not established","sector":"Pharma","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-19","date":"19 August 2025","href":"/files/25-0819b-inotiv-says-august-attack-exposed-employee-and-partner-data"},{"id":"25-0819","target":"Municipal governments","actor":"Multiple","vector":"Various","sector":"Public sector","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-19","date":"19 August 2025","href":"/files/25-0819-municipalities-hold-records-residents-never-chose-to-provide"},{"id":"25-0818","target":"Salesloft Drift integration","actor":"UNC6395","vector":"OAuth token theft","sector":"Cloud","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-08-18","date":"18 August 2025","href":"/files/25-0818-salesloft-drift-integration-one-integration-seven-hundred-customer"},{"id":"25-0817","target":"Production database","actor":"No adversary","vector":"Autonomous agent action","sector":"Cloud","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-08-17","date":"17 August 2025","href":"/files/25-0817-production-database-it-deleted-the-database-invented-the-records"},{"id":"25-0815b","target":"Workday","actor":"ShinyHunters","vector":"Social engineering","sector":"Cloud","dwell":null,"sev":2,"status":"Closed","sortDate":"2025-08-17","date":"17 August 2025","href":"/files/25-0815b-workday-says-core-platform-and-customer-tenants-were-not-affected"},{"id":"25-0815","target":"City of Saint Paul","actor":"Unattributed","vector":"Data extortion","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-08-15","date":"15 August 2025","href":"/files/25-0815-saint-paul-refused-to-pay-and-43gb-of-city-data-was-published"},{"id":"25-0814","target":"Marquis Software","actor":"Akira","vector":"Unpatched edge device","sector":"Finance","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-08-14","date":"14 August 2025","href":"/files/25-0814-marquis-software-compromise-reached-customers-of-at-least-74-banks"},{"id":"25-0813","target":"Enterprise SSO accounts","actor":"ShinyHunters","vector":"MFA enrolment","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-13","date":"13 August 2025","href":"/files/25-0813-enterprise-sso-accounts-attackers-registered-their-own-mfa-device-after"},{"id":"25-0812","target":"Scattered Spider member","actor":"Convicted individual","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2025-08-12","date":"12 August 2025","href":"/files/25-0812-scattered-spider-member-ten-years-and-thirteen-million-dollars-that-will"},{"id":"25-0811","target":"Ransomware proceeds","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2025-08-11","date":"11 August 2025","href":"/files/25-0811-ransomware-proceeds-two-point-eight-million-recovered-against-billions"},{"id":"25-0810","target":"Google","actor":"ShinyHunters","vector":"Third-party platform","sector":"Cloud","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-08-10","date":"10 August 2025","href":"/files/25-0810-google-two-and-a-half-million-records-at-a-company-that-sells-security"},{"id":"25-0808b","target":"Attribution practice","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-08-08","date":"8 August 2025","href":"/files/25-0808b-attribution-practice-the-same-2025-activity-is-tracked-under-at-least"},{"id":"25-0808","target":"Retail sector","actor":"Multiple","vector":"Various","sector":"Retail","dwell":null,"sev":3,"status":"Open","sortDate":"2025-08-08","date":"8 August 2025","href":"/files/25-0808-retail-recorded-837-incidents-and-419-confirmed-breaches-in-a-quarter"},{"id":"25-0807b","target":"HR platforms","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-07","date":"7 August 2025","href":"/files/25-0807b-hr-platforms-assemble-the-data-an-employee-cannot-refuse-to-hand-over"},{"id":"25-0807","target":"Pakistan Petroleum Limited","actor":"Unattributed","vector":"Ransomware","sector":"Energy","dwell":null,"sev":2,"status":"Closed","geo":{"place":"Karachi","country":"Pakistan","lon":67.01,"lat":24.86},"jurisdiction":"Pakistan","sortDate":"2025-08-07","date":"7 August 2025","href":"/files/25-0807-pakistan-petroleum-isolated-it-services-after-ransomware-intrusion"},{"id":"25-0806b","target":"Workday","actor":"ShinyHunters","vector":"Voice and SMS phishing","sector":"Cloud","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-08-15","date":"15 August 2025","href":"/files/25-0806b-attackers-posing-as-hr-and-it-staff-phoned-workday-employees"},{"id":"25-0806","target":"Enterprise SaaS tenants","actor":"ShinyHunters","vector":"Consent phishing","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-06","date":"6 August 2025","href":"/files/25-0806-enterprise-saas-tenants-operators-posing-as-it-staff-had-employees"},{"id":"25-0805","target":"Security appliance estates","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-08-05","date":"5 August 2025","href":"/files/25-0805-every-device-on-this-list-was-sold-as-a-security-product"},{"id":"25-0804","target":"Bouygues Telecom","actor":"Unattributed","vector":"Not established","sector":"Telecom","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-08-04","date":"4 August 2025","href":"/files/25-0804-bouygues-telecom-attack-reached-data-for-6-4-million-customers"},{"id":"25-0802b","target":"Australian health providers","actor":"Multiple","vector":"Various","sector":"Healthcare","dwell":null,"sev":3,"status":"Open","jurisdiction":"Australia","sortDate":"2025-08-02","date":"2 August 2025","href":"/files/25-0802b-health-providers-top-the-australian-table-too"},{"id":"25-0802","target":"City of Saint Paul","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-08-02","date":"2 August 2025","href":"/files/25-0802-city-of-saint-paul-saint-paul-shut-its-whole-network-to-evict"},{"id":"25-0801","target":"Healthcare back-office vendor","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-08-01","date":"1 August 2025","href":"/files/25-0801-healthcare-back-office-vendor-the-biggest-health-breach-of-the-year"},{"id":"25-0731b","target":"Australian organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"Australia","sortDate":"2025-07-31","date":"31 July 2025","href":"/files/25-0731b-australian-incidents-affected-just-over-10-000-individuals-each"},{"id":"25-0731","target":"Gulf energy and government","actor":"Iranian state-linked sets","vector":"Various","sector":"Energy","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-31","date":"31 July 2025","href":"/files/25-0731-gulf-energy-and-government-sustained-campaigns-against-energy-aerospace"},{"id":"25-0730","target":"City of Saint Paul","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2025-07-30","date":"30 July 2025","href":"/files/25-0730-city-of-saint-paul-minnesota-deployed-national-guard-cyber-personnel"},{"id":"25-0729","target":"Utility sector","actor":"Multiple","vector":"Various","sector":"Utilities","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-29","date":"29 July 2025","href":"/files/25-0729-the-utility-estate-nobody-can-take-offline-to-fix"},{"id":"25-0728","target":"Financial sector","actor":"Multiple","vector":"Ransomware","sector":"Finance","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-28","date":"28 July 2025","href":"/files/25-0728-financial-sector-a-seventy-five-million-dollar-payment-and-what-it-tells"},{"id":"25-0727","target":"TransUnion","actor":"ShinyHunters","vector":"Third-party platform","sector":"Finance","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-07-27","date":"27 July 2025","href":"/files/25-0727-transunion-reports-4-4-million-affected-after-salesforce-database"},{"id":"25-0726","target":"City of Saint Paul","actor":"Unattributed","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2025-07-26","date":"26 July 2025","href":"/files/25-0726-a-city-stopped-taking-payments"},{"id":"25-0725b","target":"Hospitality platforms","actor":"Multiple","vector":"Various","sector":"Hospitality","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-25","date":"25 July 2025","href":"/files/25-0725b-what-the-hospitality-files-establish-that-25-0725-assumed"},{"id":"25-0725","target":"Multiple sectors","actor":"Salt Typhoon","vector":"Various","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-25","date":"25 July 2025","href":"/files/25-0725-multiple-sectors-nobody-is-collecting-hotel-records-for-the-hotel"},{"id":"25-0724","target":"UK retail campaign","actor":"Scattered Spider","vector":"Social engineering","sector":"Retail","dwell":null,"sev":3,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-07-24","date":"24 July 2025","href":"/files/25-0724-uk-retail-campaign-four-arrested-over-m-s-co-op-and-harrods-intrusions"},{"id":"25-0723","target":"On-premises SharePoint estates","actor":"Multiple","vector":"Stolen key material","sector":"Cloud","dwell":null,"sev":5,"status":"Open","sortDate":"2025-07-23","date":"23 July 2025","href":"/files/25-0723-on-premises-sharepoint-estates-toolshell-stole-sharepoint-machine-keys"},{"id":"25-0722","target":"Healthcare sector","actor":"Multiple","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-22","date":"22 July 2025","href":"/files/25-0722-interlock-and-rhysida-worked-healthcare-without-the-older-claimed-limits"},{"id":"25-0721","target":"AI agent deployments","actor":"Multiple","vector":"Prompt injection","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-21","date":"21 July 2025","href":"/files/25-0721-ninety-four-per-cent-of-tested-agents-could-be-hijacked-by-what-they"},{"id":"25-0720","target":"Telecom subscribers","actor":"Multiple","vector":"Various","sector":"Telecom","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-20","date":"20 July 2025","href":"/files/25-0720-telecom-operators-hold-payment-and-identity-data-without-financial"},{"id":"25-0719","target":"On-premises SharePoint estates","actor":"Multiple","vector":"Zero-day exploit chain","sector":"Cloud","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-07-19","date":"19 July 2025","href":"/files/25-0719-on-premises-sharepoint-estates-toolshell-sharepoint-chain-confirmed"},{"id":"25-0718","target":"Telecommunications sector","actor":"Multiple","vector":"Various","sector":"Telecom","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-07-18","date":"18 July 2025","href":"/files/25-0718-telecommunications-sector-americas-recorded-the-most-telecom-incidents"},{"id":"25-0717","target":"Allianz Life","actor":"ShinyHunters","vector":"Social engineering","sector":"Insurance","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Minneapolis, Minnesota","country":"United States","lon":-93.27,"lat":44.98},"sortDate":"2025-07-17","date":"17 July 2025","href":"/files/25-0717-allianz-life-reports-1-497-036-affected-after-crm-social-engineering"},{"id":"25-0716","target":"Telecommunications sector","actor":"Multiple","vector":"Data theft","sector":"Telecom","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-16","date":"16 July 2025","href":"/files/25-0716-telecommunications-sector-research-identified-444-telecom-incidents"},{"id":"25-0715","target":"US hospitals","actor":"Multiple","vector":"Various","sector":"Healthcare","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-07-15","date":"15 July 2025","href":"/files/25-0715-us-hospitals-one-hospital-in-three-says-it-affected-patient-care"},{"id":"25-0714","target":"Telecommunications sector","actor":"Multiple","vector":"Ransomware","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2025-07-14","date":"14 July 2025","href":"/files/25-0714-telecommunications-sector-ransomware-against-telecoms-rose-fourfold"},{"id":"25-0713","target":"Gulf financial institutions","actor":"Multiple","vector":"Ransomware","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-13","date":"13 July 2025","href":"/files/25-0713-gulf-financial-institutions-reported-ransomware-disruptions-through-2025"},{"id":"25-0711","target":"Regional risk measurement","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"United Arab Emirates","sortDate":"2025-07-11","date":"11 July 2025","href":"/files/25-0711-ninth-globally-second-regionally-11-7-per-cent"},{"id":"25-0710","target":"LVMH brands","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-07-10","date":"10 July 2025","href":"/files/25-0710-three-lvmh-brands-disclosed-separate-breaches-between-may-and-july"},{"id":"25-0709","target":"Gulf organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-09","date":"9 July 2025","href":"/files/25-0709-more-than-90-gulf-data-dumps-appeared-on-forums-in-six-months"},{"id":"25-0708","target":"Availability incidents","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-08","date":"8 July 2025","href":"/files/25-0708-insurance-is-the-only-party-measuring-availability"},{"id":"25-0704","target":"Workforce data","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-07-04","date":"4 July 2025","href":"/files/25-0704-breach-notification-law-was-written-for-consumers-not-the-workforce"},{"id":"25-0703","target":"Outcomes One","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-07-03","date":"3 July 2025","href":"/files/25-0703-outcomes-one-settlement-pays-257-500-people-about-6-60-each"},{"id":"25-0702","target":"Multiple sectors","actor":"Scattered Spider","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":5,"status":"Open","sortDate":"2025-07-02","date":"2 July 2025","href":"/files/25-0702-one-scattered-spider-campaign-moved-through-four-sectors-in-eight-months"},{"id":"25-0701","target":"Qantas","actor":"Unattributed","vector":"Social engineering","sector":"Aviation","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-07-01","date":"1 July 2025","href":"/files/25-0701-qantas-through-the-call-centre-into-the-platform-out-with-5-7-million"},{"id":"25-0630","target":"US healthcare sector","actor":"Multiple","vector":"Various","sector":"Healthcare","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-06-30","date":"30 June 2025","href":"/files/25-0630-us-healthcare-reported-343-breaches-covering-57-million-records-in-six"},{"id":"25-0629","target":"Water infrastructure contractor","actor":"Ralord","vector":"Not established","sector":"Utilities","dwell":null,"sev":3,"status":"Open","jurisdiction":"Saudi Arabia","sortDate":"2025-06-29","date":"29 June 2025","href":"/files/25-0629-the-company-that-builds-the-water-system"},{"id":"25-0628","target":"Airline operational systems","actor":"Scattered Spider","vector":"Social engineering","sector":"Aviation","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-06-28","date":"28 June 2025","href":"/files/25-0628-airline-operational-systems-westjet-and-hawaiian-said-flight-operations"},{"id":"25-0627","target":"North American and Australian carriers","actor":"Scattered Spider","vector":"Social engineering","sector":"Aviation","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-06-27","date":"27 June 2025","href":"/files/25-0627-north-american-and-australian-hawaiian-westjet-and-qantas-all-reported"},{"id":"25-0626","target":"Credential leak reporting","actor":"None — measurement","vector":"Verification dispute","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-26","date":"26 June 2025","href":"/files/25-0626-analysts-dispute-the-16-billion-credential-figure-as-largely-recycled"},{"id":"25-0625","target":"Enterprise authentication estates","actor":"Scattered Spider","vector":"Legacy authentication","sector":"Aviation","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-25","date":"25 June 2025","href":"/files/25-0625-enterprise-authentication-estates-the-authentication-that-was-left"},{"id":"25-0624","target":"NetScaler appliances","actor":"Multiple","vector":"Memory disclosure","sector":"Cloud","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-06-24","date":"24 June 2025","href":"/files/25-0624-citrixbleed-2-netscaler-flaw-cve-2025-5777-widely-exploited-from-june"},{"id":"25-0623","target":"Viasat","actor":"Salt Typhoon","vector":"Remote management abuse","sector":"Telecom","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-23","date":"23 June 2025","href":"/files/25-0623-salt-typhoon-reached-viasat-via-remote-management-links-reporting-says"},{"id":"25-0622","target":"US insurers","actor":"Scattered Spider","vector":"Social engineering","sector":"Insurance","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2025-06-22","date":"22 June 2025","href":"/files/25-0622-three-insurers-in-one-campaign-two-of-them-in-one-state"},{"id":"25-0621","target":"US consumers","actor":"Multiple","vector":"Identity theft","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-06-21","date":"21 June 2025","href":"/files/25-0621-us-consumers-adults-aged-30-to-39-filed-32-of-us-identity-theft-reports"},{"id":"25-0620","target":"Exposed credential aggregates","actor":"Exposure","vector":"Misconfiguration","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-06-20","date":"20 June 2025","href":"/files/25-0620-exposed-credential-aggregates-sixteen-billion-credentials-in-thirty"},{"id":"25-0619","target":"Japanese organisations","actor":"Unattributed","vector":"Hacktivism","sector":"Multiple","dwell":null,"sev":2,"status":"Open","jurisdiction":"Japan","sortDate":"2025-06-19","date":"19 June 2025","href":"/files/25-0619-japanese-organisations-japan-recorded-71-hacktivist-incidents"},{"id":"25-0618","target":"Aflac","actor":"Scattered Spider","vector":"Social engineering","sector":"Insurance","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-06-18","date":"18 June 2025","href":"/files/25-0618-aflac-confirms-13-9-million-affected-in-the-largest-healthcare-breach"},{"id":"25-0617","target":"Nobitex","actor":"Unattributed","vector":"Not established","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-17","date":"17 June 2025","href":"/files/25-0617-nobitex-breach-reported-as-connected-to-regional-conflict-not-profit"},{"id":"25-0616b","target":"Small organisations","actor":"Regulator","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-06-16","date":"16 June 2025","href":"/files/25-0616b-neither-dora-nor-the-uk-bill-reaches-the-small-firms-taking-43"},{"id":"25-0616","target":"Financial sector","actor":"Multiple","vector":"Various","sector":"Finance","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-16","date":"16 June 2025","href":"/files/25-0616-financial-sector-the-most-expensive-sector-to-be-breached-in"},{"id":"25-0615b","target":"UK businesses and charities","actor":"Multiple","vector":"Phishing","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United Kingdom","sortDate":"2025-06-15","date":"15 June 2025","href":"/files/25-0615b-half-of-businesses-a-third-of-charities"},{"id":"25-0615","target":"Ahold Delhaize USA","actor":"Scattered Spider","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-15","date":"15 June 2025","href":"/files/25-0615-ahold-delhaize-usa-targeted-as-parent-of-giant-and-food-lion"},{"id":"25-0614b","target":"Nonprofit sector","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-14","date":"14 June 2025","href":"/files/25-0614b-78-of-nonprofits-say-their-cyber-resilience-is-insufficient"},{"id":"25-0613b","target":"This database","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-13","date":"13 June 2025","href":"/files/25-0613b-this-database-is-a-survey-of-large-organisations"},{"id":"25-0613","target":"Chain IQ Group AG","actor":"Unattributed","vector":"Not established","sector":"Finance","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-06-13","date":"13 June 2025","href":"/files/25-0613-chain-iq-breach-exposed-130-000-employee-records-across-19-clients"},{"id":"25-0612b","target":"Small businesses","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-12","date":"12 June 2025","href":"/files/25-0612b-55-of-small-businesses-say-a-50-000-loss-would-shut-them-down"},{"id":"25-0612","target":"Texas Department of Transportation","actor":"Unattributed","vector":"Compromised credentials","sector":"Public sector","dwell":null,"sev":3,"status":"Closed","geo":{"place":"Austin, Texas","country":"United States","lon":-97.74,"lat":30.27},"jurisdiction":"United States","sortDate":"2025-06-12","date":"12 June 2025","href":"/files/25-0612-compromised-account-downloaded-300-000-texas-crash-reports"},{"id":"25-0611b","target":"Small and medium businesses","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-11","date":"11 June 2025","href":"/files/25-0611b-19-of-small-and-medium-businesses-face-bankruptcy-after-a-cyberattack"},{"id":"25-0611","target":"US Army National Guard","actor":"Unattributed","vector":"Not established","sector":"Defence","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-06-11","date":"11 June 2025","href":"/files/25-0611-us-army-national-guard-network-diagrams-location-maps-and-the-people-who"},{"id":"25-0610b","target":"Small businesses","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-10","date":"10 June 2025","href":"/files/25-0610b-small-businesses-were-the-target-of-43-of-cyberattacks-in-2025"},{"id":"25-0607","target":"Security functions","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-07","date":"7 June 2025","href":"/files/25-0607-security-teams-adopted-ai-tooling-and-the-workforce-shortfall-still-grew"},{"id":"25-0606","target":"United Natural Foods","actor":"Unattributed","vector":"Not established","sector":"Logistics","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Providence, Rhode Island","country":"United States","lon":-71.41,"lat":41.82},"sortDate":"2025-06-06","date":"6 June 2025","href":"/files/25-0606-united-natural-foods-outage-disrupted-ordering-for-thousands-of-grocers"},{"id":"25-0605","target":"Episource","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Gardena, California","country":"United States","lon":-118.31,"lat":33.89},"sortDate":"2025-06-05","date":"5 June 2025","href":"/files/25-0605-episource-ransomware-exposed-data-on-5-4-million-people"},{"id":"25-0604b","target":"Management plane estates","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":5,"status":"Open","sortDate":"2025-06-04","date":"4 June 2025","href":"/files/25-0604b-remote-management-for-the-sixth-time"},{"id":"25-0603b","target":"Managed service model","actor":"Multiple","vector":"Various","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-03","date":"3 June 2025","href":"/files/25-0603b-managed-service-model-outsourcing-it-is-sound-advice-and-the-route"},{"id":"25-0603","target":"Cartier","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":2,"status":"Closed","sortDate":"2025-06-03","date":"3 June 2025","href":"/files/25-0603-cartier-names-emails-and-countries-of-residence-which-is-the-whole"},{"id":"25-0602b","target":"MSP customer estates","actor":"DragonForce","vector":"RMM platform abuse","sector":"Cloud","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-06-02","date":"2 June 2025","href":"/files/25-0602b-they-looked-at-the-customer-list-before-deciding-anything"},{"id":"25-0602","target":"Senegalese petroleum company","actor":"Unattributed","vector":"Business email compromise","sector":"Energy","dwell":null,"sev":4,"status":"Open","sortDate":"2025-06-02","date":"2 June 2025","href":"/files/25-0602-senegalese-petroleum-firm-hit-by-executive-impersonation-wire-fraud"},{"id":"25-0601b","target":"Managed service provider","actor":"DragonForce","vector":"Unpatched RMM platform","sector":"Cloud","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-06-01","date":"1 June 2025","href":"/files/25-0601b-managed-service-provider-they-used-the-tool-the-provider-used-to-manage"},{"id":"25-0601","target":"Insurance sector","actor":"ShinyHunters","vector":"Social engineering","sector":"Insurance","dwell":null,"sev":3,"status":"Open","sortDate":"2025-06-01","date":"1 June 2025","href":"/files/25-0601-insurance-combines-wide-intermediary-access-with-unsupervised-platforms"},{"id":"25-0530","target":"Coinbase customers","actor":"Unattributed","vector":"Insider recruitment","sector":"Finance","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-30","date":"30 May 2025","href":"/files/25-0530-coinbase-put-reimbursement-at-180-million-to-400-million-for-69-500"},{"id":"25-0529","target":"Farmers Insurance","actor":"ShinyHunters","vector":"Third-party platform","sector":"Insurance","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-05-29","date":"29 May 2025","href":"/files/25-0529-farmers-insurance-compromise-affected-more-than-1-1-million-customers"},{"id":"25-0528","target":"Southeast Asian energy provider","actor":"NightSpire","vector":"Ransomware","sector":"Energy","dwell":null,"sev":3,"status":"Open","sortDate":"2025-05-28","date":"28 May 2025","href":"/files/25-0528-a-southeast-asian-energy-provider-and-a-group-nobody-had-heard-of"},{"id":"25-0527","target":"Not applicable","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-05-27","date":"27 May 2025","href":"/files/25-0527-two-leaked-ransomware-operations-disagree-on-pricing-geography-and-scale"},{"id":"25-0526","target":"Victoria’s Secret","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Closed","geo":{"place":"Reynoldsburg, Ohio","country":"United States","lon":-82.81,"lat":39.95},"sortDate":"2025-05-26","date":"26 May 2025","href":"/files/25-0526-victorias-secret-shut-corporate-systems-and-postponed-its-earnings"},{"id":"25-0525","target":"Not applicable","actor":"LockBit","vector":"Not applicable","sector":"Criminal","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-25","date":"25 May 2025","href":"/files/25-0525-the-leaked-lockbit-tier-shows-ransomware-as-a-service-has-an-entry-level"},{"id":"25-0524","target":"African cybercrime networks","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-24","date":"24 May 2025","href":"/files/25-0524-african-cybercrime-networks-five-hundred-and-seventy-four-arrests-three"},{"id":"25-0523","target":"Cetus Protocol","actor":"Unattributed","vector":"Contract logic manipulation","sector":"Finance","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-23","date":"23 May 2025","href":"/files/25-0523-attackers-drained-cetus-protocol-liquidity-using-spoof-tokens"},{"id":"25-0522","target":"US utility","actor":"Volt Typhoon","vector":"Not established","sector":"Utilities","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-05-22","date":"22 May 2025","href":"/files/25-0522-a-utility-that-was-pre-positioned-in-briefed-the-people-who-would-have"},{"id":"25-0521","target":"PowerSchool","actor":"Convicted individual","vector":"Compromised credentials","sector":"Education","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-21","date":"21 May 2025","href":"/files/25-0521-matthew-lane-sentenced-to-four-years-over-the-powerschool-breach"},{"id":"25-0520","target":"Kettering Health","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Kettering, Ohio","country":"United States","lon":-84.17,"lat":39.69},"sortDate":"2025-05-20","date":"20 May 2025","href":"/files/25-0520-kettering-health-shut-600-applications-after-attack-affecting-1-7"},{"id":"25-0519","target":"Multiple, unidentified","actor":"LockBit affiliates","vector":"Extortion pricing","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-05-19","date":"19 May 2025","href":"/files/25-0519-multiple-unidentified-twenty-five-thousand-dollars-and-more-than-half"},{"id":"25-0518","target":"IT personnel","actor":"Unattributed","vector":"Search engine poisoning","sector":"Public sector","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-05-18","date":"18 May 2025","href":"/files/25-0518-it-personnel-nevada-intrusion-began-with-a-poisoned-search-result"},{"id":"25-0517","target":"Multiple, global","actor":"LockBit affiliates","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-05-17","date":"17 May 2025","href":"/files/25-0517-multiple-global-lockbits-own-victim-records-put-chinese-organisations"},{"id":"25-0516","target":"Nevada state government","actor":"Unattributed","vector":"Trojanised software download","sector":"Public sector","dwell":102,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2025-05-16","date":"16 May 2025","href":"/files/25-0516-nevada-intrusion-started-when-an-employee-downloaded-a-spoofed-admin"},{"id":"25-0515","target":"Health IT vendor","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-15","date":"15 May 2025","href":"/files/25-0515-health-it-vendor-ransomware-exposed-data-on-442-000-patients"},{"id":"25-0514","target":"Coinbase","actor":"Unattributed","vector":"Insider recruitment","sector":"Finance","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-05-14","date":"14 May 2025","href":"/files/25-0514-coinbase-says-attackers-bribed-overseas-support-agents-for-customer-data"},{"id":"25-0513","target":"African organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-05-13","date":"13 May 2025","href":"/files/25-0513-african-organisations-interpol-warns-of-sharp-rise-in-cybercrime-across"},{"id":"25-0512","target":"Retail sector","actor":"Scattered Spider","vector":"Social engineering","sector":"Retail","dwell":null,"sev":4,"status":"Open","sortDate":"2025-05-12","date":"12 May 2025","href":"/files/25-0512-scattered-spider-worked-uk-retail-from-april-then-moved-to-us-retail"},{"id":"25-0511","target":"Not applicable","actor":"LockBit","vector":"Extortion","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-11","date":"11 May 2025","href":"/files/25-0511-lockbit-panel-recorded-2-3-million-of-receipts-operators-taking-a-fifth"},{"id":"25-0510","target":"Not applicable","actor":"LockBit","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-05-10","date":"10 May 2025","href":"/files/25-0510-almost-none-of-lockbits-per-target-bitcoin-addresses-ever-received"},{"id":"25-0509","target":"Fraud measurement","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-05-09","date":"9 May 2025","href":"/files/25-0509-ftc-recorded-12-5-billion-in-fraud-losses-industry-puts-it-two-to-three"},{"id":"25-0508","target":"LockBit","actor":"Unattributed","vector":"Panel compromise","sector":"Criminal","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-05-08","date":"8 May 2025","href":"/files/25-0508-lockbit-affiliate-panel-breached-defaced-and-its-database-published"},{"id":"25-0507","target":"School districts","actor":"Unattributed","vector":"Data re-extortion","sector":"Education","dwell":null,"sev":5,"status":"Open","sortDate":"2025-05-07","date":"7 May 2025","href":"/files/25-0507-school-districts-they-paid-and-got-a-video-of-the-deletion"},{"id":"25-0506","target":"Middle East organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-05-06","date":"6 May 2025","href":"/files/25-0506-israel-accounted-for-33-of-middle-east-targeting-in-2025"},{"id":"25-0505","target":"North American steel producer","actor":"Unattributed","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2025-05-05","date":"5 May 2025","href":"/files/25-0505-north-american-steel-producer-a-steel-producer-stopped-its-own-furnaces"},{"id":"25-0503","target":"Agent authorisation models","actor":"Multiple","vector":"Prompt injection","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-05-03","date":"3 May 2025","href":"/files/25-0503-the-agent-is-authorised-as-you-and-nobody-asked-whether-it-should-be"},{"id":"25-0502","target":"Incident record formation","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-05-02","date":"2 May 2025","href":"/files/25-0502-why-the-incident-record-is-mostly-american"},{"id":"25-0501","target":"Co-operative Group","actor":"Scattered Spider","vector":"Social engineering","sector":"Retail","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Manchester","country":"United Kingdom","lon":-2.24,"lat":53.48},"sortDate":"2025-05-01","date":"1 May 2025","href":"/files/25-0501-co-operative-group-co-op-confirms-data-of-all-6-5-million-members"},{"id":"25-0430","target":"Co-op","actor":"Scattered Spider","vector":"Help-desk social engineering","sector":"Retail","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-04-30","date":"30 April 2025","href":"/files/25-0430-co-op-co-op-put-its-revenue-loss-from-the-april-intrusion-at-206-million"},{"id":"25-0428","target":"Security leadership","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-04-28","date":"28 April 2025","href":"/files/25-0428-security-leadership-organisations-report-difficulty-filling-ciso-roles"},{"id":"25-0426","target":"Multiple sectors","actor":"Multiple","vector":"Third party","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-04-26","date":"26 April 2025","href":"/files/25-0426-multiple-sectors-breaches-involving-a-third-party-rose-sharply-in-2025"},{"id":"25-0424","target":"SAP NetWeaver estates","actor":"Unattributed","vector":"Unauthorised file upload","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-04-24","date":"24 April 2025","href":"/files/25-0424-attackers-uploaded-webshells-to-internet-facing-sap-netweaver-systems"},{"id":"25-0423","target":"Asia-Pacific organisations","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-04-23","date":"23 April 2025","href":"/files/25-0423-system-intrusions-behind-80-of-asia-pacific-breaches-up-from-38"},{"id":"25-0422","target":"Dutch public facility","actor":"Russian state-linked actors","vector":"Not established","sector":"Utilities","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Netherlands","sortDate":"2025-04-22","date":"22 April 2025","href":"/files/25-0422-dutch-public-facility-disclosed-in-2025-attempted-the-year-before"},{"id":"25-0421b","target":"Incident response caseload","actor":"Multiple","vector":"Valid credentials","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-04-21","date":"21 April 2025","href":"/files/25-0421b-incident-response-caseload-compromised-credentials-led-the-root-causes"},{"id":"25-0415","target":"Medical device manufacturer","actor":"Unattributed","vector":"Ransomware suspected","sector":"Manufacturing","dwell":null,"sev":2,"status":"Closed","sortDate":"2025-04-15","date":"15 April 2025","href":"/files/25-0415-when-the-delayed-shipment-is-a-medical-device"},{"id":"25-0412","target":"DaVita","actor":"Interlock","vector":"Ransomware","sector":"Healthcare","dwell":19,"sev":4,"status":"Closed","geo":{"place":"Denver, Colorado","country":"United States","lon":-104.99,"lat":39.74},"sortDate":"2025-04-12","date":"12 April 2025","href":"/files/25-0412-interlock-held-davita-for-19-days-and-took-records-on-2-7-million-people"},{"id":"25-0411","target":"File-transfer estate","actor":"Cl0p","vector":"Edge product exploitation","sector":"Multiple","dwell":null,"sev":5,"status":"Open","sortDate":"2025-04-11","date":"11 April 2025","href":"/files/25-0411-the-fourth-file-transfer-product-in-five-years"},{"id":"25-0410","target":"Laboratory Services Cooperative","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-04-10","date":"10 April 2025","href":"/files/25-0410-laboratory-services-cooperative-settles-for-6-1-million-over-1-6-million"},{"id":"25-0409","target":"Blue Shield of California","actor":"Unattributed","vector":"Not established","sector":"Insurance","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2025-04-09","date":"9 April 2025","href":"/files/25-0409-blue-shield-of-california-breach-affected-around-4-7-million-people"},{"id":"25-0408","target":"German Association for East European Studies","actor":"Unattributed","vector":"Not established","sector":"Education","dwell":null,"sev":3,"status":"Open","jurisdiction":"Germany","sortDate":"2025-04-08","date":"8 April 2025","href":"/files/25-0408-german-security-office-investigated-breach-of-east-european-studies"},{"id":"25-0403","target":"Hertz","actor":"Cl0p","vector":"Supplier product exploitation","sector":"Travel","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Estero, Florida","country":"United States","lon":-81.81,"lat":26.44},"sortDate":"2025-04-03","date":"3 April 2025","href":"/files/25-0403-hertz-confirms-customer-and-employee-data-taken-through-cleo-flaw"},{"id":"25-0402","target":"Ransomware ecosystem","actor":"Multiple","vector":"Ransomware-as-a-service","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-04-02","date":"2 April 2025","href":"/files/25-0402-ransomware-ecosystem-akira-play-and-ransomhub-absorbed-the-disrupted"},{"id":"25-0331","target":"Mobile-first markets","actor":"Multiple","vector":"Various","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-03-31","date":"31 March 2025","href":"/files/25-0331-fraud-in-mobile-first-markets-defeats-controls-designed-for-desktops"},{"id":"25-0325","target":"Understaffed organisations","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-03-25","date":"25 March 2025","href":"/files/25-0325-understaffed-breaches-cost-1-76-million-more"},{"id":"25-0320","target":"Mexican banks","actor":"Multiple","vector":"Account takeover","sector":"Finance","dwell":null,"sev":3,"status":"Open","jurisdiction":"Mexico","sortDate":"2025-03-20","date":"20 March 2025","href":"/files/25-0320-account-takeover-quadrupled-at-mexican-banks"},{"id":"25-0317","target":"Latin American consumers","actor":"Multiple","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-03-17","date":"17 March 2025","href":"/files/25-0317-scams-against-individuals-rose-sharply-across-latin-america-in-2025"},{"id":"25-0314","target":"Not applicable","actor":"Medusa","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-03-14","date":"14 March 2025","href":"/files/25-0314-medusa-appeared-nowhere-in-this-corpuss-first-520-files"},{"id":"25-0312","target":"Critical infrastructure","actor":"Medusa","vector":"Various","sector":"Multiple","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-03-12","date":"12 March 2025","href":"/files/25-0312-fbi-cisa-and-ms-isac-put-medusa-past-300-critical-infrastructure-victims"},{"id":"25-0311","target":"SaaS consent models","actor":"Multiple","vector":"Consent phishing","sector":"Cloud","dwell":null,"sev":3,"status":"Open","sortDate":"2025-03-11","date":"11 March 2025","href":"/files/25-0311-saas-consent-models-the-consent-screen-asks-a-question-nobody-can-answer"},{"id":"25-0308","target":"Yale New Haven Health System","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-03-08","date":"8 March 2025","href":"/files/25-0308-yale-new-haven-health-system-five-and-a-half-million-patients-from-one"},{"id":"25-0304","target":"US telecommunications carriers","actor":"Salt Typhoon","vector":"Lawful-intercept infrastructure","sector":"Telecom","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2025-03-04","date":"4 March 2025","href":"/files/25-0304-us-telecommunications-carriers-salt-typhoon-reached-us-carriers-through"},{"id":"25-0228","target":"US community water systems","actor":"Not applicable","vector":"Not applicable","sector":"Water","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-02-28","date":"28 February 2025","href":"/files/25-0228-us-community-water-systems-southern-water-is-the-only-2025-water-file"},{"id":"25-0227","target":"Not applicable","actor":"Black Basta","vector":"Extortion","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-02-27","date":"27 February 2025","href":"/files/25-0227-blockchain-analysis-put-black-basta-receipts-above-107-million"},{"id":"25-0226","target":"Not applicable","actor":"Black Basta","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":2,"status":"Open","sortDate":"2025-02-26","date":"26 February 2025","href":"/files/25-0226-the-black-basta-archive-is-the-best-primary-source-here-and-a-sample"},{"id":"25-0225","target":"Not applicable","actor":"Black Basta","vector":"Not applicable","sector":"Criminal","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-02-25","date":"25 February 2025","href":"/files/25-0225-black-basta-chats-show-shift-complaints-and-a-business-data-subscription"},{"id":"25-0224","target":"Language model systems","actor":"Multiple","vector":"Prompt injection","sector":"Cloud","dwell":null,"sev":4,"status":"Open","sortDate":"2025-02-24","date":"24 February 2025","href":"/files/25-0224-a-language-model-cannot-distinguish-code-from-content"},{"id":"25-0223","target":"Not applicable","actor":"Black Basta","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-02-23","date":"23 February 2025","href":"/files/25-0223-for-one-group-for-one-year-the-claim-can-be-checked"},{"id":"25-0222","target":"Not applicable","actor":"Black Basta","vector":"Not applicable","sector":"Criminal","dwell":null,"sev":2,"status":"Open","sortDate":"2025-02-22","date":"22 February 2025","href":"/files/25-0222-a-researcher-named-him-this-desk-will-not"},{"id":"25-0221","target":"Bybit","actor":"TraderTraitor / Lazarus","vector":"Not established","sector":"Finance","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2025-02-21","date":"21 February 2025","href":"/files/25-0221-bybit-lost-1-447-billion-in-the-largest-cryptocurrency-theft-recorded"},{"id":"25-0220","target":"Enterprise staff","actor":"Black Basta and successors","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2025-02-20","date":"20 February 2025","href":"/files/25-0220-enterprise-staff-black-bastas-email-bombing-and-teams-impersonation"},{"id":"25-0219","target":"Security practitioners","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2025-02-19","date":"19 February 2025","href":"/files/25-0219-47-of-risk-and-security-professionals-reported-burnout-in-2025"},{"id":"25-0218","target":"Black Basta","actor":"Internal","vector":"Disclosure","sector":"Criminal","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-02-18","date":"18 February 2025","href":"/files/25-0218-black-basta-stopped-posting-victims-with-no-seizure-and-no-arrests"},{"id":"25-0217","target":"Cleo customers","actor":"Cl0p","vector":"Edge product exploitation","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-02-17","date":"17 February 2025","href":"/files/25-0217-cleo-customers-a-hundred-and-eighty-two-names-posted-in-one-go"},{"id":"25-0216","target":"Southern Water","actor":"Black Basta","vector":"Not established","sector":"Water","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Worthing","country":"United Kingdom","lon":-0.37,"lat":50.81},"sortDate":"2025-02-16","date":"16 February 2025","href":"/files/25-0216-southern-water-disclosed-4-5-million-of-costs-from-the-black-basta"},{"id":"25-0215","target":"Multiple, unidentified","actor":"Black Basta","vector":"Extortion pricing","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-02-15","date":"15 February 2025","href":"/files/25-0215-multiple-unidentified-leaked-chats-show-black-basta-priced-demands-off"},{"id":"25-0214","target":"Western Alliance Bank","actor":"Unattributed","vector":"Zero-day exploitation","sector":"Finance","dwell":null,"sev":3,"status":"Closed","sortDate":"2025-02-14","date":"14 February 2025","href":"/files/25-0214-western-alliance-bank-the-file-transfer-product-is-the-banks-weakest"},{"id":"25-0213","target":"Telecommunications firms","actor":"Salt Typhoon","vector":"Not established","sector":"Telecom","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2025-02-13","date":"13 February 2025","href":"/files/25-0213-telecommunications-firms-salt-typhoon-compromised-five-telecoms-firms"},{"id":"25-0212","target":"Enterprise edge estate","actor":"Black Basta","vector":"Vulnerability exploitation","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-02-12","date":"12 February 2025","href":"/files/25-0212-enterprise-edge-estate-leaked-black-basta-chats-referenced-62-cves-53"},{"id":"25-0211","target":"Black Basta","actor":"ExploitWhispers","vector":"Insider disclosure","sector":"Criminal","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-02-11","date":"11 February 2025","href":"/files/25-0211-exploitwhispers-published-200-000-internal-black-basta-chat-messages"},{"id":"25-0210","target":"PIH Health","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-02-10","date":"10 February 2025","href":"/files/25-0210-pih-health-nearly-three-million-disclosed-the-following-year"},{"id":"25-0208","target":"US consumers","actor":"Multiple","vector":"Social engineering","sector":"Multiple","dwell":null,"sev":3,"status":"Open","jurisdiction":"United States","sortDate":"2025-02-08","date":"8 February 2025","href":"/files/25-0208-us-consumers-more-than-a-quarter-of-americans-reported-being-scammed"},{"id":"25-0127b","target":"Frederick Health","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","sortDate":"2025-01-29","date":"29 January 2025","href":"/files/25-0127b-frederick-health-attack-forced-ambulance-diversion-and-delayed-care"},{"id":"25-0127","target":"Frederick Health Medical Group","actor":"Unattributed","vector":"Ransomware","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Frederick, Maryland","country":"United States","lon":-77.41,"lat":39.41},"sortDate":"2025-01-27","date":"27 January 2025","href":"/files/25-0127-frederick-health-ransomware-took-data-on-more-than-934-000-patients"},{"id":"25-0123b","target":"Otelier","actor":"Unattributed","vector":"Not established","sector":"Hospitality","dwell":null,"sev":4,"status":"Open","sortDate":"2025-01-23","date":"23 January 2025","href":"/files/25-0123b-otelier-breach-compromised-data-tied-to-marriott-hilton-and-hyatt"},{"id":"25-0117","target":"EU financial entities","actor":"Regulator","vector":"Not applicable","sector":"Finance","dwell":null,"sev":2,"status":"Open","sortDate":"2025-01-17","date":"17 January 2025","href":"/files/25-0117-eu-financial-entities-the-rule-that-made-a-bank-answerable-for-its"},{"id":"25-0109","target":"Ivanti Connect Secure estates","actor":"Multiple","vector":"Zero-day exploitation","sector":"Cloud","dwell":null,"sev":4,"status":"Closed","sortDate":"2025-01-09","date":"9 January 2025","href":"/files/25-0109-ivanti-connect-secure-flaw-cve-2025-0282-exploited-from-january-2025"},{"id":"25-0105","target":"PowerSchool","actor":"Unaffiliated individual","vector":"Compromised credentials","sector":"Education","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Folsom, California","country":"United States","lon":-121.17,"lat":38.68},"sortDate":"2025-01-05","date":"5 January 2025","href":"/files/25-0105-powerschool-one-credential-and-the-records-of-a-continents"},{"id":"24-1231","target":"Not applicable","actor":"Multiple","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2024-12-31","date":"31 December 2024","href":"/files/24-1231-four-2024-incidents-did-their-damage-by-stopping-things-not-taking-them"},{"id":"24-1219","target":"Ascension","actor":"Black Basta","vector":"Malicious file download","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"St. Louis, Missouri","country":"United States","lon":-90.2,"lat":38.63},"sortDate":"2024-12-19","date":"19 December 2024","href":"/files/24-1219-ascension-disclosed-its-data-figure-seven-months-after-the-outage"},{"id":"24-1213","target":"RIBridges","actor":"Brain Cipher","vector":"Contractor VPN credentials","sector":"Government","dwell":150,"sev":5,"status":"Closed","jurisdiction":"United States","geo":{"place":"Providence, Rhode Island","country":"United States","lon":-71.4128,"lat":41.824},"sortDate":"2024-12-13","date":"13 December 2024","href":"/files/24-1213-ribridges-rhode-island-benefits-breach-reached-650-000-people-59"},{"id":"24-1205","target":"Blue Yonder","actor":"Termite","vector":"Extortion","sector":"Retail","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-12-05","date":"5 December 2024","href":"/files/24-1205-termite-claims-blue-yonder-data-and-says-it-will-reuse-the-email-lists"},{"id":"24-1203","target":"US telecommunications carriers","actor":"Salt Typhoon","vector":"Not applicable","sector":"Telecom","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2024-12-03","date":"3 December 2024","href":"/files/24-1203-us-telecommunications-carriers-the-government-told-everyone-to-encrypt"},{"id":"24-1129","target":"Krispy Kreme","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2024-11-29","date":"29 November 2024","href":"/files/24-1129-krispy-kreme-breach-hit-161-676-people-most-of-them-its-own-staff"},{"id":"24-1126","target":"Firefox and Windows users","actor":"RomCom","vector":"CVE-2024-9680 chained with CVE-2024-49039","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Not established","sortDate":"2024-11-26","date":"26 November 2024","href":"/files/24-1126-romcom-chained-firefox-and-windows-zero-days-into-a-zero-click-backdoor"},{"id":"24-1125","target":"Blue Yonder customers","actor":"Termite","vector":"Not applicable","sector":"Retail","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2024-11-25","date":"25 November 2024","href":"/files/24-1125-starbucks-and-morrisons-fell-back-to-manual-processes-after-blue-yonder"},{"id":"24-1121","target":"Blue Yonder","actor":"Termite","vector":"Not established","sector":"Retail","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Scottsdale, Arizona","country":"United States","lon":-111.93,"lat":33.49},"jurisdiction":"United States","sortDate":"2024-11-21","date":"21 November 2024","href":"/files/24-1121-blue-yonder-the-software-that-tells-the-supermarket-what-to-order"},{"id":"24-1120","target":"Finastra","actor":"Unattributed","vector":"Not established","sector":"Financial services","dwell":8,"sev":4,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2024-11-20","date":"20 November 2024","href":"/files/24-1120-finastra-breach-of-a-support-file-platform-reached-888-627-people"},{"id":"24-1104","target":"Nokia","actor":"IntelBroker","vector":"Third-party contractor server","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Finland","geo":{"place":"Espoo","country":"Finland","lon":24.6559,"lat":60.2055},"sortDate":"2024-11-04","date":"4 November 2024","href":"/files/24-1104-nokia-source-code-leaked-from-a-contractors-server-with-default-logins"},{"id":"24-1031","target":"Sophos perimeter devices","actor":"China-based groups, per the vendor","vector":"Edge-device vulnerabilities","sector":"Technology","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"Abingdon","country":"United Kingdom","lon":-1.2879,"lat":51.6714},"sortDate":"2024-10-31","date":"31 October 2024","href":"/files/24-1031-sophos-published-five-years-of-attacks-on-its-own-firewalls-and-its-use"},{"id":"24-1030","target":"Not applicable","actor":"UNC5537","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":3,"status":"Open","sortDate":"2024-10-30","date":"30 October 2024","href":"/files/24-1030-two-arrests-and-no-names-here-yet"},{"id":"24-1029","target":"East Asian internet provider","actor":"Unattributed","vector":"UDP flood, Mirai-variant botnet","sector":"Telecom","dwell":null,"sev":3,"status":"Closed","sortDate":"2024-10-29","date":"29 October 2024","href":"/files/24-1029-east-asian-internet-provider-cloudflare-absorbed-its-largest-recorded"},{"id":"24-1028","target":"RedLine and META users","actor":"Regulator","vector":"Infostealer malware","sector":"Multiple","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Netherlands","sortDate":"2024-10-28","date":"28 October 2024","href":"/files/24-1028-operation-magnus-dismantled-redline-and-meta-and-seized-the-customer"},{"id":"24-1026","target":"Free SAS","actor":"Unattributed","vector":"Not established","sector":"Telecom","dwell":null,"sev":5,"status":"Closed","jurisdiction":"France","geo":{"place":"Paris","country":"France","lon":2.3522,"lat":48.8566},"sortDate":"2024-10-26","date":"26 October 2024","href":"/files/24-1026-french-isp-free-lost-19-2-million-records-including-5-11-million-ibans"},{"id":"24-1025","target":"Hot Topic","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2024-10-25","date":"25 October 2024","href":"/files/24-1025-hot-topic-records-for-57-million-customers-offered-on-a-criminal-forum"},{"id":"24-1024","target":"City of Columbus","actor":"Rhysida","vector":"Not applicable","sector":"Public sector","dwell":null,"sev":3,"status":"Closed","geo":{"place":"Columbus, Ohio","country":"United States","lon":-82.99,"lat":39.96},"sortDate":"2024-10-24","date":"24 October 2024","href":"/files/24-1024-the-city-dropped-it-and-the-record-stands-corrected"},{"id":"24-1023","target":"Landmark Admin","actor":"Unattributed","vector":"Not established","sector":"Insurance","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-10-23","date":"23 October 2024","href":"/files/24-1023-landmark-admin-breach-reached-806-519-people-across-insurers"},{"id":"24-1015","target":"National Public Data","actor":"USDoD","vector":"Not applicable","sector":"Data broker","dwell":null,"sev":4,"status":"Closed","sortDate":"2024-10-15","date":"15 October 2024","href":"/files/24-1015-national-public-data-the-company-dissolved-and-the-records-did-not"},{"id":"24-1010","target":"Star Health and Allied Insurance","actor":"Not established","vector":"Not applicable","sector":"Insurance","dwell":null,"sev":3,"status":"Open","geo":{"place":"Chennai","country":"India","lon":80.27,"lat":13.08},"sortDate":"2024-10-10","date":"10 October 2024","href":"/files/24-1010-security-firm-assessed-star-health-executive-involvement-material"},{"id":"24-1009","target":"Internet Archive","actor":"Unattributed","vector":"Not established","sector":"Non-profit","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","geo":{"place":"San Francisco","country":"United States","lon":-122.4194,"lat":37.7749},"sortDate":"2024-10-09","date":"9 October 2024","href":"/files/24-1009-internet-archive-breach-exposed-31-million-users-amid-a-separate-ddos"},{"id":"24-1008","target":"Casio","actor":"Unattributed","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Japan","geo":{"place":"Tokyo","country":"Japan","lon":139.6917,"lat":35.6895},"sortDate":"2024-10-08","date":"8 October 2024","href":"/files/24-1008-casio-ransomware-exposed-partner-and-employee-data-but-not-card-details"},{"id":"24-1006","target":"Lawful-intercept systems","actor":"Salt Typhoon","vector":"Not established","sector":"Telecom","dwell":null,"sev":5,"status":"Open","sortDate":"2024-10-06","date":"6 October 2024","href":"/files/24-1006-lawful-intercept-systems-the-interception-the-law-required"},{"id":"24-1004","target":"US telecommunications carriers","actor":"Salt Typhoon","vector":"Not established","sector":"Telecom","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2024-10-04","date":"4 October 2024","href":"/files/24-1004-us-telecommunications-carriers-inside-the-carriers-and-nobody-could-say"},{"id":"24-1001","target":"National Public Data","actor":"USDoD","vector":"Not established","sector":"Data broker","dwell":null,"sev":4,"status":"Closed","sortDate":"2024-10-01","date":"1 October 2024","href":"/files/24-1001-national-public-data-notified-1-3-million-after-a-claim-of-2-9-billion"},{"id":"24-0920","target":"Star Health and Allied Insurance","actor":"Not established","vector":"Not established","sector":"Insurance","dwell":null,"sev":5,"status":"Open","geo":{"place":"Chennai","country":"India","lon":80.27,"lat":13.08},"jurisdiction":"India","sortDate":"2024-09-20","date":"20 September 2024","href":"/files/24-0920-star-health-lost-customer-diagnoses-and-test-results-to-messaging-bots"},{"id":"24-0911","target":"Unnamed Southeast Asian government body","actor":"Clusters Alpha, Bravo, Charlie","vector":"Not established","sector":"Government","dwell":null,"sev":4,"status":"Open","jurisdiction":"Not established","sortDate":"2024-09-10","date":"10 September 2024","href":"/files/24-0911-unnamed-southeast-asian-government-sophos-found-three-chinese-state"},{"id":"24-0910","target":"Transport for London","actor":"Scattered Spider","vector":"Not applicable","sector":"Public sector","dwell":null,"sev":3,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.13,"lat":51.51},"jurisdiction":"United Kingdom","sortDate":"2024-09-10","date":"10 September 2024","href":"/files/24-0910-transport-for-london-convicted-and-therefore-named"},{"id":"24-0905","target":"Transport for London","actor":"Scattered Spider","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.13,"lat":51.51},"jurisdiction":"United Kingdom","sortDate":"2024-09-05","date":"5 September 2024","href":"/files/24-0905-transport-for-london-tfl-required-every-employee-to-attend-in-person"},{"id":"24-0901","target":"Transport for London","actor":"Scattered Spider","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.13,"lat":51.51},"jurisdiction":"United Kingdom","sortDate":"2024-09-01","date":"1 September 2024","href":"/files/24-0901-transport-for-london-penetrated-over-three-days-in-august-2024"},{"id":"24-0829","target":"City of Columbus","actor":"Rhysida","vector":"Not applicable","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Columbus, Ohio","country":"United States","lon":-82.99,"lat":39.96},"sortDate":"2024-08-29","date":"29 August 2024","href":"/files/24-0829-he-opened-the-files-and-the-city-sued-him"},{"id":"24-0821","target":"Halliburton","actor":"RansomHub","vector":"Not established","sector":"Energy services","dwell":null,"sev":3,"status":"Closed","geo":{"place":"Houston, Texas","country":"United States","lon":-95.37,"lat":29.76},"jurisdiction":"United States","sortDate":"2024-08-21","date":"21 August 2024","href":"/files/24-0821-the-sec-asked-halliburton-to-explain-its-own-disclosure"},{"id":"24-0813","target":"City of Columbus","actor":"Rhysida","vector":"Not applicable","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Columbus, Ohio","country":"United States","lon":-82.99,"lat":39.96},"sortDate":"2024-08-13","date":"13 August 2024","href":"/files/24-0813-city-of-columbus-columbus-mayor-said-stolen-data-was-unusable"},{"id":"24-0812","target":"National Public Data","actor":"USDoD","vector":"Not established","sector":"Data broker","dwell":null,"sev":4,"status":"Closed","sortDate":"2024-08-12","date":"12 August 2024","href":"/files/24-0812-researcher-found-duplicates-and-dead-people-in-the-national-public-data"},{"id":"24-0808","target":"Sellafield Ltd","actor":"Not applicable","vector":"Not applicable","sector":"Energy","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"Seascale, Cumbria","country":"United Kingdom","lon":-3.4956,"lat":54.4194},"sortDate":"2024-08-08","date":"8 August 2024","href":"/files/24-0808-sellafield-pleaded-guilty-to-nuclear-site-it-security-failings"},{"id":"24-0806","target":"National Public Data","actor":"USDoD","vector":"Not established","sector":"Data broker","dwell":null,"sev":4,"status":"Closed","sortDate":"2024-08-06","date":"6 August 2024","href":"/files/24-0806-national-public-data-two-point-nine-billion-records-from-a-company"},{"id":"24-0725","target":"Not applicable","actor":"Not applicable","vector":"Not applicable","sector":"Multiple","dwell":null,"sev":4,"status":"Open","sortDate":"2024-07-25","date":"25 July 2024","href":"/files/24-0725-a-security-agent-needs-the-privileged-reach-that-makes-it-dangerous"},{"id":"24-0722","target":"CrowdStrike Falcon customers","actor":"Not applicable","vector":"Faulty vendor update","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-22","date":"22 July 2024","href":"/files/24-0722-insurers-put-crowdstrike-outage-cost-to-us-fortune-500-at-5-4-billion"},{"id":"24-0720","target":"CrowdStrike Falcon customers","actor":"Not applicable","vector":"Faulty vendor update","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","sortDate":"2024-07-20","date":"20 July 2024","href":"/files/24-0720-the-crowdstrike-fix-could-not-reach-machines-that-would-not-boot"},{"id":"24-0719","target":"CrowdStrike Falcon customers","actor":"Not applicable","vector":"Faulty vendor update","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","sortDate":"2024-07-19","date":"19 July 2024","href":"/files/24-0719-crowdstrike-content-update-crashed-windows-systems-worldwide"},{"id":"24-0718","target":"City of Columbus","actor":"Rhysida","vector":"Not established","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Columbus, Ohio","country":"United States","lon":-82.99,"lat":39.96},"sortDate":"2024-07-18","date":"18 July 2024","href":"/files/24-0718-six-and-a-half-terabytes-claimed-from-a-city"},{"id":"24-0716","target":"Advance Auto Parts","actor":"UNC5537","vector":"Third-party cloud platform access","sector":"Retail","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-16","date":"16 July 2024","href":"/files/24-0716-advance-auto-parts-notified-2-316-591-people-after-snowflake-theft"},{"id":"24-0714","target":"Rite Aid","actor":"RansomHub","vector":"Not established","sector":"Retail","dwell":1,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-14","date":"14 July 2024","href":"/files/24-0714-rite-aid-said-2-2-million-affected-ransomhub-claimed-45-million"},{"id":"24-0713","target":"Disney","actor":"NullBulge","vector":"Not established","sector":"Media","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-13","date":"13 July 2024","href":"/files/24-0713-disney-slack-archive-published-claimed-at-1-1-terabytes"},{"id":"24-0712","target":"AT&T","actor":"UNC5537","vector":"Valid credentials, no MFA","sector":"Telecom","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Dallas, Texas","country":"United States","lon":-96.8,"lat":32.78},"sortDate":"2024-07-12","date":"12 July 2024","href":"/files/24-0712-at-t-at-t-says-call-and-text-records-for-nearly-all-mobile-customers"},{"id":"24-0711","target":"CDK Global","actor":"BlackSuit","vector":"Extortion","sector":"Automotive","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Austin, Texas","country":"United States","lon":-97.74,"lat":30.27},"sortDate":"2024-07-11","date":"11 July 2024","href":"/files/24-0711-cdk-global-a-billion-dollars-borne-by-people-who-were-not-attacked"},{"id":"24-0710","target":"Squarespace domain customers","actor":"Unattributed","vector":"Account takeover after migration","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-10","date":"10 July 2024","href":"/files/24-0710-squarespace-migration-dropped-two-factor-crypto-domains-hijacked"},{"id":"24-0703","target":"Twilio Authy","actor":"Unattributed","vector":"Unauthenticated API enumeration","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-03","date":"3 July 2024","href":"/files/24-0703-twilio-confirmed-33-million-authy-phone-numbers-through-an-open-endpoint"},{"id":"24-0702","target":"Fintech customers","actor":"LockBit","vector":"Not applicable","sector":"Finance","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-07-02","date":"2 July 2024","href":"/files/24-0702-fintech-customers-wise-and-affirm-customers-exposed-by-a-breach"},{"id":"24-0626","target":"Evolve Bank & Trust","actor":"LockBit","vector":"Malicious link","sector":"Finance","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Memphis, Tennessee","country":"United States","lon":-90.05,"lat":35.15},"jurisdiction":"United States","sortDate":"2024-06-26","date":"26 June 2024","href":"/files/24-0626-evolve-bank-trust-seven-point-six-million-from-a-bank-most-of-them-had"},{"id":"24-0625","target":"Neiman Marcus","actor":"UNC5537","vector":"Third-party cloud database access","sector":"Retail","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2024-06-25","date":"25 June 2024","href":"/files/24-0625-neiman-marcus-confirmed-breach-of-a-cloud-database-platform"},{"id":"24-0624","target":"Synnovis","actor":"Qilin","vector":"Extortion","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.09,"lat":51.5},"jurisdiction":"United Kingdom","sortDate":"2024-06-24","date":"24 June 2024","href":"/files/24-0624-qilin-published-synnovis-data-after-the-nhs-declined-to-pay"},{"id":"24-0623","target":"Evolve Bank & Trust","actor":"LockBit","vector":"Not established","sector":"Finance","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Memphis, Tennessee","country":"United States","lon":-90.05,"lat":35.15},"jurisdiction":"United States","sortDate":"2024-06-23","date":"23 June 2024","href":"/files/24-0623-lockbit-claimed-33tb-from-the-federal-reserve-the-data-was-evolve-banks"},{"id":"24-0620","target":"Change Healthcare","actor":"ALPHV","vector":"Valid credentials, no MFA","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Nashville, Tennessee","country":"United States","lon":-86.78,"lat":36.16},"sortDate":"2024-06-20","date":"20 June 2024","href":"/files/24-0620-change-healthcare-affected-person-count-took-eleven-months-to-settle"},{"id":"24-0618","target":"CDK Global","actor":"BlackSuit","vector":"Not established","sector":"Automotive","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Austin, Texas","country":"United States","lon":-97.74,"lat":30.27},"jurisdiction":"United States","sortDate":"2024-06-18","date":"18 June 2024","href":"/files/24-0618-cdk-global-cdk-global-outage-stopped-american-car-dealerships-for-two"},{"id":"24-0610","target":"Synnovis","actor":"Qilin","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.09,"lat":51.5},"jurisdiction":"United Kingdom","sortDate":"2024-06-10","date":"10 June 2024","href":"/files/24-0610-london-hospitals-moved-to-universal-o-blood-after-the-synnovis-attack"},{"id":"24-0604","target":"Synnovis","actor":"Qilin","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.09,"lat":51.5},"sortDate":"2024-06-04","date":"4 June 2024","href":"/files/24-0604-hospital-investigation-found-the-synnovis-attack-contributed"},{"id":"24-0603","target":"Synnovis","actor":"Qilin","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"London","country":"United Kingdom","lon":-0.09,"lat":51.5},"jurisdiction":"United Kingdom","sortDate":"2024-06-03","date":"3 June 2024","href":"/files/24-0603-qilin-encryption-of-synnovis-cancelled-10-000-appointments-and-1-700"},{"id":"24-0602","target":"Snowflake customer environments","actor":"UNC5537","vector":"Stolen credentials, no MFA","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2024-06-02","date":"2 June 2024","href":"/files/24-0602-snowflake-campaign-reached-165-customer-environments-without-mfa"},{"id":"24-0531","target":"Ticketmaster","actor":"UNC5537","vector":"Valid credentials, no MFA","sector":"Entertainment","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Beverly Hills, California","country":"United States","lon":-118.4,"lat":34.07},"sortDate":"2024-05-31","date":"31 May 2024","href":"/files/24-0531-ticketmaster-five-hundred-and-sixty-million-claimed"},{"id":"24-0530","target":"Snowflake tenants","actor":"UNC5537","vector":"Valid credentials, no MFA","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","sortDate":"2024-05-30","date":"30 May 2024","href":"/files/24-0530-attackers-logged-into-snowflake-customer-environments-with-working"},{"id":"24-0527","target":"Christie’s","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":1,"sev":3,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2024-05-27","date":"27 May 2024","href":"/files/24-0527-christies-breach-exposed-client-id-document-numbers-over-two-days-in-may"},{"id":"24-0514","target":"Santander","actor":"Unattributed","vector":"Third-party database access","sector":"Financial services","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Spain","geo":{"place":"Madrid","country":"Spain","lon":-3.7038,"lat":40.4168},"sortDate":"2024-05-14","date":"14 May 2024","href":"/files/24-0514-santander-customer-data-listed-for-sale-after-third-party-access"},{"id":"24-0510","target":"Dell","actor":"Unattributed","vector":"Partner portal enumeration","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-05-10","date":"10 May 2024","href":"/files/24-0510-dell-partner-portal-api-gave-up-49-million-records-to-fake-resellers"},{"id":"24-0509","target":"Ascension","actor":"Black Basta","vector":"Malicious file download","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"St. Louis, Missouri","country":"United States","lon":-90.2,"lat":38.63},"sortDate":"2024-05-09","date":"9 May 2024","href":"/files/24-0509-ascension-traced-its-intrusion-to-an-employee-downloading-a-malicious"},{"id":"24-0508","target":"Ascension","actor":"Black Basta","vector":"Malicious file download","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"St. Louis, Missouri","country":"United States","lon":-90.2,"lat":38.63},"sortDate":"2024-05-08","date":"8 May 2024","href":"/files/24-0508-ascension-a-hundred-and-forty-hospitals-and-the-records-went-to-paper"},{"id":"24-0505","target":"City of Wichita","actor":"Unattributed","vector":"Not established","sector":"Government","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","geo":{"place":"Wichita, Kansas","country":"United States","lon":-97.3301,"lat":37.6872},"sortDate":"2024-05-05","date":"5 May 2024","href":"/files/24-0505-wichita-shut-down-city-systems-after-5-may-ransomware-attack"},{"id":"24-0425","target":"Kaiser Permanente","actor":"Not applicable","vector":"Tracking technology, by design","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","geo":{"place":"Oakland, California","country":"United States","lon":-122.2712,"lat":37.8044},"sortDate":"2024-04-25","date":"25 April 2024","href":"/files/24-0425-kaiser-permanente-trackers-sent-13-4-million-members-data-to-advertisers"},{"id":"24-0417","target":"Frontier Communications","actor":"RansomHub","vector":"Not established","sector":"Telecom","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-04-17","date":"17 April 2024","href":"/files/24-0417-frontier-communications-notified-750-000-people-after-ransomhub-attack"},{"id":"24-0413","target":"MediSecure","actor":"Not established","vector":"Not established","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","geo":{"place":"South Melbourne, Victoria","country":"Australia","lon":144.96,"lat":-37.83},"jurisdiction":"Australia","sortDate":"2024-04-13","date":"13 April 2024","href":"/files/24-0413-medisecure-twelve-point-nine-million-records-and-no-money-to-write"},{"id":"24-0405","target":"Change Healthcare","actor":"RansomHub","vector":"Re-extortion","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Nashville, Tennessee","country":"United States","lon":-86.78,"lat":36.16},"sortDate":"2024-04-05","date":"5 April 2024","href":"/files/24-0405-change-healthcare-they-paid-the-operator-and-the-affiliate-still-had"},{"id":"24-0329","target":"Omni Hotels & Resorts","actor":"Daixin Team","vector":"Not established","sector":"Hospitality","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-03-29","date":"29 March 2024","href":"/files/24-0329-daixin-claimed-omni-hotels-guest-records-going-back-to-2017"},{"id":"24-0322","target":"Panera Bread","actor":"Unattributed","vector":"Not established","sector":"Retail","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2024-03-22","date":"22 March 2024","href":"/files/24-0322-panera-bread-ransomware-took-tills-and-ordering-down-for-a-week"},{"id":"24-0317","target":"Fujitsu","actor":"Unattributed","vector":"Not established","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Japan","geo":{"place":"Tokyo","country":"Japan","lon":139.6917,"lat":35.6895},"sortDate":"2024-03-17","date":"17 March 2024","href":"/files/24-0317-fujitsu-found-malware-that-copied-files-and-was-not-ransomware"},{"id":"24-0314","target":"Giant Tiger","actor":"Unattributed","vector":"Third-party vendor compromise","sector":"Retail","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Canada","geo":{"place":"Ottawa","country":"Canada","lon":-75.6972,"lat":45.4215},"sortDate":"2024-03-14","date":"14 March 2024","href":"/files/24-0314-giant-tiger-vendor-breach-put-2-8-million-customer-records-online"},{"id":"24-0313","target":"France Travail","actor":"Unattributed","vector":"Not established","sector":"Government","dwell":28,"sev":5,"status":"Closed","jurisdiction":"France","geo":{"place":"Paris","country":"France","lon":2.3522,"lat":48.8566},"sortDate":"2024-03-13","date":"13 March 2024","href":"/files/24-0313-france-travail-breach-exposed-43-million-people-across-twenty-years"},{"id":"24-0306","target":"American Express","actor":"Unattributed","vector":"Third-party processor compromise","sector":"Financial services","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2024-03-06","date":"6 March 2024","href":"/files/24-0306-american-express-card-numbers-exposed-through-a-merchant-processor"},{"id":"24-0301","target":"Change Healthcare","actor":"ALPHV","vector":"Extortion","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","geo":{"place":"Nashville, Tennessee","country":"United States","lon":-86.78,"lat":36.16},"sortDate":"2024-03-01","date":"1 March 2024","href":"/files/24-0301-change-healthcare-twenty-two-million-dollars-paid"},{"id":"24-0221b","target":"Cencora","actor":"Dark Angels","vector":"Not established","sector":"Pharmaceutical distribution","dwell":null,"sev":4,"status":"Closed","geo":{"place":"Conshohocken, Pennsylvania","country":"United States","lon":-75.3,"lat":40.08},"jurisdiction":"United States","sortDate":"2024-02-21","date":"21 February 2024","href":"/files/24-0221b-cencora-the-largest-ransom-on-record-and-a-filing-that-mentions-no"},{"id":"24-0221","target":"Change Healthcare","actor":"ALPHV","vector":"Valid credentials, no MFA","sector":"Healthcare","dwell":9,"sev":5,"status":"Closed","geo":{"place":"Nashville, Tennessee","country":"United States","lon":-86.78,"lat":36.16},"sortDate":"2024-02-21","date":"21 February 2024","href":"/files/24-0221-the-change-healthcare-theft-and-the-ransomware-were-a-week-apart"},{"id":"24-0212","target":"Change Healthcare","actor":"ALPHV","vector":"Valid credentials, no MFA","sector":"Healthcare","dwell":9,"sev":5,"status":"Closed","geo":{"place":"Nashville, Tennessee","country":"United States","lon":-86.78,"lat":36.16},"sortDate":"2024-02-12","date":"12 February 2024","href":"/files/24-0212-change-healthcare-intruders-used-a-citrix-portal-with-no-second-factor"},{"id":"24-0123","target":"Trello","actor":"Unattributed","vector":"Unauthenticated API enumeration","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2024-01-23","date":"23 January 2024","href":"/files/24-0123-trello-profile-data-for-15-million-users-scraped-through-a-public-api"},{"id":"24-0112","target":"Microsoft","actor":"Midnight Blizzard","vector":"Password spray","sector":"Cloud","dwell":45,"sev":4,"status":"Closed","geo":{"place":"Redmond, Washington","country":"United States","lon":-122.12,"lat":47.67},"jurisdiction":"United States","sortDate":"2024-01-12","date":"12 January 2024","href":"/files/24-0112-microsoft-says-password-spray-on-a-legacy-test-account-reached"},{"id":"24-0110","target":"Ivanti Connect Secure operators","actor":"Multiple","vector":"Vulnerability chaining","sector":"Cloud","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2024-01-10","date":"10 January 2024","href":"/files/24-0110-ivanti-connect-secure-auth-bypass-and-command-injection-chained"},{"id":"23-1224","target":"Integris Health","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":26,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-12-24","date":"24 December 2023","href":"/files/23-1224-integris-health-patients-were-emailed-directly-and-offered-a-50-deletion"},{"id":"23-1220","target":"MongoDB","actor":"Unattributed","vector":"Phishing","sector":"Technology","dwell":71,"sev":2,"status":"Closed","sortDate":"2023-12-20","date":"20 December 2023","href":"/files/23-1220-mongodb-says-phishing-reached-support-systems-but-not-customer-clusters"},{"id":"23-1219","target":"Insomniac Games","actor":"Rhysida","vector":"Not established","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-12-19","date":"19 December 2023","href":"/files/23-1219-rhysida-published-1-3-million-insomniac-files-including-employee"},{"id":"23-1218","target":"Comcast Xfinity","actor":"Unattributed","vector":"Memory disclosure","sector":"Telecom","dwell":3,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-12-18","date":"18 December 2023","href":"/files/23-1218-comcast-says-citrix-bleed-reached-xfinity-data-on-35-8-million-customers"},{"id":"23-1212","target":"Kyivstar","actor":"Sandworm","vector":"Not established","sector":"Telecom","dwell":214,"sev":5,"status":"Closed","jurisdiction":"Ukraine","sortDate":"2023-12-12","date":"12 December 2023","href":"/files/23-1212-ukraine-says-sandworm-sat-in-kyivstar-for-months-before-destroying-it"},{"id":"23-1204","target":"23andMe","actor":"Unattributed","vector":"Credential stuffing","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-12-04","date":"4 December 2023","href":"/files/23-1204-23andme-says-14-000-accounts-were-stuffed-reaching-6-9-million-profiles"},{"id":"23-1125","target":"Municipal Water Authority of Aliquippa","actor":"CyberAv3ngers","vector":"Default credentials","sector":"Water","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","geo":{"place":"Aliquippa","country":"United States","lon":-80.2417,"lat":40.6123},"sortDate":"2023-11-25","date":"25 November 2023","href":"/files/23-1125-municipal-water-authority-a-pennsylvania-water-authority-lost-a-booster"},{"id":"23-1123","target":"Ardent Health Services","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-11-23","date":"23 November 2023","href":"/files/23-1123-ardent-health-took-30-hospitals-offline-after-thanksgiving-ransomware"},{"id":"23-1119","target":"Fidelity National Financial","actor":"Unattributed","vector":"Credential compromise","sector":"Finance","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-11-19","date":"19 November 2023","href":"/files/23-1119-fidelity-national-financial-blocked-its-own-systems-and-house-sales"},{"id":"23-1117","target":"Welltok","actor":"Cl0p","vector":"SQL injection","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-11-17","date":"17 November 2023","href":"/files/23-1117-welltok-notified-8-5-million-people-over-moveit-then-the-number-nearly"},{"id":"23-1110","target":"Boeing","actor":"LockBit","vector":"CVE-2023-4966 — Citrix Bleed","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-11-10","date":"10 November 2023","href":"/files/23-1110-lockbit-published-43gb-from-boeing-revealing-the-citrix-bleed-entry"},{"id":"23-1108","target":"ICBC Financial Services","actor":"LockBit","vector":"Ransomware","sector":"Finance","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","geo":{"place":"New York","country":"United States","lon":-74.006,"lat":40.7128},"sortDate":"2023-11-08","date":"8 November 2023","href":"/files/23-1108-icbcs-us-unit-could-not-clear-treasury-trades-after-lockbit-attack"},{"id":"23-1031","target":"Mr Cooper","actor":"Unattributed","vector":"Not established","sector":"Financial services","dwell":3,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-10-31","date":"31 October 2023","href":"/files/23-1031-mr-cooper-breach-exposed-14-7-million-current-and-former-customers"},{"id":"23-1030","target":"SolarWinds","actor":"Regulator","vector":"Not applicable","sector":"Technology","dwell":null,"sev":2,"status":"Open","jurisdiction":"United States","sortDate":"2023-10-30","date":"30 October 2023","href":"/files/23-1030-sec-charged-solarwinds-and-named-its-security-officer-personally"},{"id":"23-1028","target":"British Library","actor":"Rhysida","vector":"Partner terminal server, no MFA","sector":"Non-profit","dwell":3,"sev":5,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2023-10-28","date":"28 October 2023","href":"/files/23-1028-british-library-published-its-own-breach-report-naming-a-partner-server"},{"id":"23-1020","target":"Okta","actor":"Unattributed","vector":"Stolen credentials","sector":"Technology","dwell":19,"sev":4,"status":"Closed","sortDate":"2023-10-20","date":"20 October 2023","href":"/files/23-1020-okta-support-system-breach-exposed-har-files-belonging-to-134-customers"},{"id":"23-1016","target":"Cisco IOS XE devices","actor":"Unattributed","vector":"Unauthenticated privilege escalation","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","sortDate":"2023-10-16","date":"16 October 2023","href":"/files/23-1016-a-cvss-10-0-flaw-let-anyone-create-an-admin-account-on-cisco-ios-xe"},{"id":"23-1010b","target":"HTTP/2 implementations","actor":"Unattributed","vector":"CVE-2023-44487","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-10-10","date":"10 October 2023","href":"/files/23-1010b-http-2-rapid-reset-drove-ddos-peaks-of-398-million-requests-per-second"},{"id":"23-1010","target":"Citrix NetScaler appliances","actor":"LockBit affiliates","vector":"Memory disclosure","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-10-10","date":"10 October 2023","href":"/files/23-1010-lockbit-affiliates-used-citrix-bleed-to-reach-boeings-parts-distribution"},{"id":"23-0923","target":"Johnson Controls International","actor":"Dark Angels","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-09-23","date":"23 September 2023","href":"/files/23-0923-johnson-controls-put-its-ransomware-response-at-27-million-in-an-sec"},{"id":"23-0919","target":"International Criminal Court","actor":"Unattributed","vector":"Not established","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Netherlands","geo":{"place":"The Hague","country":"Netherlands","lon":4.3007,"lat":52.0705},"sortDate":"2023-09-19","date":"19 September 2023","href":"/files/23-0919-international-criminal-court-says-september-breach-was-espionage"},{"id":"23-0918","target":"Microsoft AI research","actor":"Exposure","vector":"Misconfiguration","sector":"Technology","dwell":null,"sev":3,"status":"Closed","sortDate":"2023-09-18","date":"18 September 2023","href":"/files/23-0918-a-single-storage-token-exposed-38tb-of-microsoft-ai-research-data"},{"id":"23-0913","target":"Retool","actor":"Unattributed","vector":"SMS phishing","sector":"Technology","dwell":null,"sev":4,"status":"Closed","sortDate":"2023-09-13","date":"13 September 2023","href":"/files/23-0913-a-synced-authenticator-turned-retools-second-factor-into-no-factor"},{"id":"23-0911","target":"MGM Resorts International","actor":"Scattered Spider","vector":"Social engineering","sector":"Hospitality","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","geo":{"place":"Las Vegas","country":"United States","lon":-115.1398,"lat":36.1699},"sortDate":"2023-09-11","date":"11 September 2023","href":"/files/23-0911-mgm-resorts-put-the-cost-of-its-september-attack-at-about-100-million"},{"id":"23-0907","target":"Caesars Entertainment","actor":"Scattered Spider","vector":"Social engineering — third-party help desk","sector":"Hospitality","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","geo":{"place":"Las Vegas","country":"United States","lon":-115.1398,"lat":36.1699},"sortDate":"2023-09-07","date":"7 September 2023","href":"/files/23-0907-caesars-paid-about-15-million-while-mgm-refused-in-the-same-week"},{"id":"23-0823","target":"Duolingo","actor":"Unattributed","vector":"API scraping","sector":"Technology","dwell":null,"sev":2,"status":"Closed","sortDate":"2023-08-23","date":"23 August 2023","href":"/files/23-0823-data-on-2-6-million-duolingo-accounts-was-scraped-through-an-open-api"},{"id":"23-0818b","target":"CloudNordic and AzeroCloud","actor":"Unattributed","vector":"Pre-existing infection, network merged","sector":"Technology","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Denmark","geo":{"place":"Copenhagen","country":"Denmark","lon":12.5683,"lat":55.6761},"sortDate":"2023-08-18","date":"18 August 2023","href":"/files/23-0818b-cloudnordic-lost-customer-data-after-backups-were-encrypted-alongside"},{"id":"23-0818","target":"Tesla","actor":"Insider — former employees","vector":"Authorised access, unauthorised disclosure","sector":"Manufacturing","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2023-08-18","date":"18 August 2023","href":"/files/23-0818-tesla-says-two-former-employees-leaked-personal-data-on-75-735-people"},{"id":"23-0814","target":"The Clorox Company","actor":"Unattributed","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","geo":{"place":"Oakland","country":"United States","lon":-122.2712,"lat":37.8044},"sortDate":"2023-08-14","date":"14 August 2023","href":"/files/23-0814-clorox-put-the-cost-of-its-august-cyberattack-at-49-million"},{"id":"23-0808b","target":"UK Electoral Commission","actor":"Unattributed","vector":"Impersonated account, known weaknesses","sector":"Government","dwell":425,"sev":4,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2023-08-08","date":"8 August 2023","href":"/files/23-0808b-uk-electoral-commission-disclosed-a-2021-intrusion-two-years-later"},{"id":"23-0808","target":"Police Service of Northern Ireland","actor":"Not applicable","vector":"Accidental disclosure","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"Belfast","country":"United Kingdom","lon":-5.9301,"lat":54.5973},"sortDate":"2023-08-08","date":"8 August 2023","href":"/files/23-0808-police-service-of-northern-ireland-psni-foi-response-named-all-9-483"},{"id":"23-0728","target":"Maximus","actor":"Cl0p","vector":"SQL injection","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-07-28","date":"28 July 2023","href":"/files/23-0728-maximus-says-the-moveit-flaw-reached-health-data-for-up-to-11-million"},{"id":"23-0724","target":"Norwegian government ministries","actor":"Unattributed","vector":"CVE-2023-35078 — zero-day","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Norway","geo":{"place":"Oslo","country":"Norway","lon":10.7522,"lat":59.9139},"sortDate":"2023-07-24","date":"24 July 2023","href":"/files/23-0724-ivanti-zero-day-breached-12-norwegian-ministries-four-kept-off"},{"id":"23-0715","target":"The Estée Lauder Companies","actor":"ALPHV, Cl0p","vector":"MOVEit (Cl0p); not established (ALPHV)","sector":"Retail","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-07-15","date":"15 July 2023","href":"/files/23-0715-alphv-and-cl0p-both-listed-estee-lauder-from-separate-intrusions"},{"id":"23-0712","target":"JumpCloud","actor":"UNC4899","vector":"Spear-phishing","sector":"Technology","dwell":13,"sev":4,"status":"Closed","sortDate":"2023-07-12","date":"12 July 2023","href":"/files/23-0712-jumpcloud-says-a-nation-state-phish-reached-fewer-than-five-customers"},{"id":"23-0711","target":"Exchange Online tenants","actor":"Storm-0558","vector":"Forged authentication tokens","sector":"Public sector","dwell":32,"sev":5,"status":"Closed","sortDate":"2023-07-11","date":"11 July 2023","href":"/files/23-0711-exchange-online-tenants-storm-0558-forged-tokens-with-a-stolen-microsoft"},{"id":"23-0710","target":"HCA Healthcare","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-07-10","date":"10 July 2023","href":"/files/23-0710-hca-healthcare-reported-11-27-million-patients-affected-by-email-storage"},{"id":"23-0625","target":"Suncor Energy","actor":"Unattributed","vector":"Not established","sector":"Energy","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Canada","geo":{"place":"Calgary","country":"Canada","lon":-114.0719,"lat":51.0447},"sortDate":"2023-06-25","date":"25 June 2023","href":"/files/23-0625-suncor-cyberattack-left-1-500-petro-canada-sites-unable-to-take-card"},{"id":"23-0619","target":"Reddit","actor":"ALPHV/BlackCat","vector":"Phishing","sector":"Technology","dwell":null,"sev":3,"status":"Closed","sortDate":"2023-06-19","date":"19 June 2023","href":"/files/23-0619-reddit-says-phishing-took-source-code-and-internal-documents-not-user"},{"id":"23-0616","target":"St Margaret’s Health","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","geo":{"place":"Spring Valley, Illinois","country":"United States","lon":-89.1998,"lat":41.3272},"sortDate":"2023-06-16","date":"16 June 2023","href":"/files/23-0616-st-margarets-health-closed-citing-a-2021-ransomware-attack-among"},{"id":"23-0614","target":"Xplain / Swiss Federal Administration","actor":"Play","vector":"Not established","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Switzerland","geo":{"place":"Bern","country":"Switzerland","lon":7.4474,"lat":46.9481},"sortDate":"2023-06-14","date":"14 June 2023","href":"/files/23-0614-xplain-swiss-federal-play-published-65-000-swiss-federal-documents-taken"},{"id":"23-0608","target":"Honda dealer platform","actor":"Not applicable","vector":"Broken authentication","sector":"Manufacturing","dwell":null,"sev":2,"status":"Closed","sortDate":"2023-06-08","date":"8 June 2023","href":"/files/23-0608-a-honda-password-reset-endpoint-accepted-any-email-address-without"},{"id":"23-0601b","target":"Oregon DMV and Louisiana OMV","actor":"Cl0p","vector":"SQL injection","sector":"Public sector","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-06-01","date":"1 June 2023","href":"/files/23-0601b-moveit-reached-oregon-and-louisiana-motor-vehicle-records-for-9-5"},{"id":"23-0601","target":"MOVEit Transfer customers","actor":"Cl0p","vector":"SQL injection","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-06-01","date":"1 June 2023","href":"/files/23-0601-cisa-and-fbi-say-cl0p-exploited-a-moveit-zero-day-to-steal-transfer"},{"id":"23-0524","target":"US critical infrastructure","actor":"Volt Typhoon","vector":"Living off the land","sector":"Public sector","dwell":null,"sev":5,"status":"Open","jurisdiction":"United States","sortDate":"2023-05-24","date":"24 May 2023","href":"/files/23-0524-us-critical-infrastructure-five-eyes-advisory-says-a-prc-actor-is-living"},{"id":"23-0518","target":"Barracuda ESG appliances","actor":"UNC4841","vector":"Zero-day exploitation","sector":"Multiple","dwell":210,"sev":5,"status":"Closed","sortDate":"2023-05-18","date":"18 May 2023","href":"/files/23-0518-barracuda-told-customers-to-replace-esg-appliances-rather-than-patch"},{"id":"23-0512c","target":"Discord","actor":"Unattributed","vector":"Third-party account compromise","sector":"Technology","dwell":null,"sev":2,"status":"Closed","sortDate":"2023-05-12","date":"12 May 2023","href":"/files/23-0512c-discord-says-a-support-vendors-agent-account-exposed-ticket-contents"},{"id":"23-0512b","target":"PharMerica","actor":"Money Message","vector":"Not established","sector":"Healthcare","dwell":2,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-05-12","date":"12 May 2023","href":"/files/23-0512b-pharmerica-notified-5-8-million-people-after-a-two-day-intrusion"},{"id":"23-0512","target":"Toyota Motor Corporation","actor":"Exposure","vector":"Misconfiguration","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Japan","sortDate":"2023-05-12","date":"12 May 2023","href":"/files/23-0512-toyota-says-vehicle-location-data-for-2-15-million-customers-was-exposed"},{"id":"23-0502","target":"Sysco Corporation","actor":"Unattributed","vector":"Not established","sector":"Food and agriculture","dwell":50,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-05-02","date":"2 May 2023","href":"/files/23-0502-sysco-told-the-sec-about-a-126-000-person-breach-a-day-before-telling"},{"id":"23-0420","target":"3CX","actor":"UNC4736","vector":"Trojanised X_TRADER installer","sector":"Technology","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2023-04-20","date":"20 April 2023","href":"/files/23-0420-3cx-mandiant-traced-the-3cx-compromise-to-a-trojanised-x-trader"},{"id":"23-0413","target":"PaperCut MF/NG operators","actor":"Cl0p, LockBit","vector":"CVE-2023-27350","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-04-13","date":"13 April 2023","href":"/files/23-0413-cl0p-and-lockbit-both-exploited-papercut-a-month-after-the-patch-shipped"},{"id":"23-0412","target":"NCR Aloha customers","actor":"ALPHV/BlackCat","vector":"Ransomware","sector":"Retail","dwell":null,"sev":4,"status":"Closed","sortDate":"2023-04-12","date":"12 April 2023","href":"/files/23-0412-ncr-aloha-customers-ransomware-at-one-ncr-data-centre-stopped"},{"id":"23-0407","target":"Micro-Star International","actor":"Money Message","vector":"Ransomware","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","sortDate":"2023-04-07","date":"7 April 2023","href":"/files/23-0407-micro-star-international-researchers-found-msi-firmware-signing-keys"},{"id":"23-0404","target":"Genesis Market","actor":"Not applicable","vector":"Not applicable","sector":"Not applicable","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2023-04-04","date":"4 April 2023","href":"/files/23-0404-operation-cookie-monster-seized-genesis-market-and-data-from-1-5-million"},{"id":"23-0402","target":"Western Digital","actor":"Unattributed","vector":"Not established","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-04-02","date":"2 April 2023","href":"/files/23-0402-western-digital-took-my-cloud-offline-for-eleven-days-after-network"},{"id":"23-0331","target":"Capita","actor":"Black Basta","vector":"Malicious file execution","sector":"Public sector","dwell":9,"sev":5,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2023-03-31","date":"31 March 2023","href":"/files/23-0331-capita-took-58-hours-to-quarantine-the-device-that-started-its-breach"},{"id":"23-0329","target":"3CX","actor":"UNC4736","vector":"Supply chain compromise","sector":"Technology","dwell":null,"sev":5,"status":"Closed","sortDate":"2023-03-29","date":"29 March 2023","href":"/files/23-0329-3cx-mandiant-says-one-supply-chain-compromise-caused-another-at-3cx"},{"id":"23-0324","target":"OpenAI","actor":"Not applicable","vector":"Software defect","sector":"Technology","dwell":null,"sev":2,"status":"Closed","sortDate":"2023-03-24","date":"24 March 2023","href":"/files/23-0324-openai-says-a-redis-client-bug-showed-users-other-peoples-chat-titles"},{"id":"23-0320","target":"Ferrari","actor":"Unattributed","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Italy","geo":{"place":"Maranello","country":"Italy","lon":10.8664,"lat":44.5308},"sortDate":"2023-03-20","date":"20 March 2023","href":"/files/23-0320-ferrari-refused-a-ransom-demand-and-notified-customers-directly"},{"id":"23-0317","target":"American Bar Association","actor":"Unattributed","vector":"Decommissioned system","sector":"Legal","dwell":11,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2023-03-17","date":"17 March 2023","href":"/files/23-0317-american-bar-association-a-decommissioned-aba-server-gave-up-credentials"},{"id":"23-0316","target":"Latitude Financial","actor":"Unattributed","vector":"Stolen credentials","sector":"Finance","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Australia","sortDate":"2023-03-16","date":"16 March 2023","href":"/files/23-0316-latitude-financial-breach-grew-from-328-000-records-to-14-million"},{"id":"23-0227","target":"LastPass","actor":"Unattributed","vector":"Keylogger on personal device","sector":"Technology","dwell":null,"sev":5,"status":"Closed","sortDate":"2023-02-27","date":"27 February 2023","href":"/files/23-0227-lastpass-says-a-keylogger-on-an-engineers-home-computer-reached-its"},{"id":"23-0223","target":"DISH Network","actor":"Unattributed","vector":"Ransomware","sector":"Telecom","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-02-23","date":"23 February 2023","href":"/files/23-0223-dish-network-customers-spent-days-unable-to-reach-a-company-that-could"},{"id":"23-0217","target":"US Marshals Service","actor":"Unattributed","vector":"Not established","sector":"Government","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-02-17","date":"17 February 2023","href":"/files/23-0217-us-marshals-service-ransomware-reached-investigation-records-in-a-major"},{"id":"23-0210","target":"Dole Food Company","actor":"Unattributed","vector":"Not established","sector":"Food and agriculture","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-02-10","date":"10 February 2023","href":"/files/23-0210-dole-halted-north-american-production-after-ransomware"},{"id":"23-0208","target":"VMware ESXi servers","actor":"Unattributed","vector":"Unpatched vulnerability","sector":"Multiple","dwell":null,"sev":4,"status":"Closed","sortDate":"2023-02-08","date":"8 February 2023","href":"/files/23-0208-vmware-esxi-servers-esxiargs-encrypted-thousands-of-hypervisors-through"},{"id":"23-0203","target":"GoAnywhere MFT customers","actor":"Cl0p","vector":"Command injection","sector":"Multiple","dwell":null,"sev":5,"status":"Closed","sortDate":"2023-02-03","date":"3 February 2023","href":"/files/23-0203-cl0p-exploited-a-goanywhere-mft-zero-day-four-months-before-moveit"},{"id":"23-0125","target":"Ukrainian organisations","actor":"Sandworm","vector":"Group Policy deployment","sector":"Public sector","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Ukraine","sortDate":"2023-01-25","date":"25 January 2023","href":"/files/23-0125-sandworm-pushed-a-wiper-to-ukrainian-targets-through-active-directory"},{"id":"23-0124","target":"Riot Games","actor":"Unattributed","vector":"Social engineering","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2023-01-24","date":"24 January 2023","href":"/files/23-0124-riot-games-refused-a-ransom-after-league-of-legends-source-code"},{"id":"23-0119","target":"T-Mobile US","actor":"Unattributed","vector":"API abuse","sector":"Telecom","dwell":41,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2023-01-19","date":"19 January 2023","href":"/files/23-0119-t-mobile-says-one-api-gave-up-data-on-37-million-accounts"},{"id":"23-0118","target":"Yum! Brands","actor":"Unattributed","vector":"Ransomware","sector":"Retail","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United Kingdom","sortDate":"2023-01-18","date":"18 January 2023","href":"/files/23-0118-yum-brands-closed-300-uk-restaurants-for-a-day-then-found-employee-data"},{"id":"23-0110","target":"Royal Mail","actor":"LockBit","vector":"Ransomware","sector":"Logistics","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"Langley","country":"United Kingdom","lon":-0.5418,"lat":51.5085},"sortDate":"2023-01-10","date":"10 January 2023","href":"/files/23-0110-royal-mail-could-not-send-a-parcel-abroad-for-six-weeks-after-lockbit"},{"id":"23-0104","target":"CircleCI","actor":"Unattributed","vector":"Session token theft","sector":"Technology","dwell":19,"sev":4,"status":"Closed","sortDate":"2023-01-04","date":"4 January 2023","href":"/files/23-0104-circleci-rotated-every-customer-secret-after-malware-stole-an-engineers"},{"id":"22-1222","target":"LastPass","actor":"Unattributed","vector":"Compromised engineer endpoint","sector":"Technology","dwell":null,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2022-12-22","date":"22 December 2022","href":"/files/22-1222-lastpass-encrypted-vault-backups-for-the-entire-customer-base"},{"id":"22-1220","target":"The Guardian","actor":"Unattributed","vector":"Phishing — as reported","sector":"Media","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2022-12-20","date":"20 December 2022","href":"/files/22-1220-guardian-ransomware-exposed-uk-staff-data-and-closed-its-london-office"},{"id":"22-1218","target":"Hospital for Sick Children","actor":"LockBit","vector":"Not established","sector":"Healthcare","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Canada","geo":{"place":"Toronto","country":"Canada","lon":-79.3832,"lat":43.6532},"sortDate":"2022-12-18","date":"18 December 2022","href":"/files/22-1218-hospital-for-sick-children-lockbit-apologised-to-sickkids-and-handed"},{"id":"22-1202","target":"Rackspace","actor":"Play","vector":"CVE-2022-41080 — zero-day","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-12-02","date":"2 December 2022","href":"/files/22-1202-rackspace-the-hosted-email-service-did-not-come-back"},{"id":"22-1111","target":"AirAsia Group","actor":"Daixin Team","vector":"Not established","sector":"Aviation","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Malaysia","geo":{"place":"Kuala Lumpur","country":"Malaysia","lon":101.6869,"lat":3.139},"sortDate":"2022-11-11","date":"11 November 2022","href":"/files/22-1111-daixin-took-data-on-5-million-airasia-passengers-and-every-employee"},{"id":"22-1104b","target":"Continental","actor":"LockBit","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Germany","geo":{"place":"Hanover","country":"Germany","lon":9.732,"lat":52.3759},"sortDate":"2022-11-04","date":"4 November 2022","href":"/files/22-1104b-lockbit-claimed-40tb-from-continental-three-months-after-the-company"},{"id":"22-1104","target":"Government of Vanuatu","actor":"Unattributed","vector":"Phishing — as reported","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Vanuatu","geo":{"place":"Port Vila","country":"Vanuatu","lon":168.3273,"lat":-17.7334},"sortDate":"2022-11-04","date":"4 November 2022","href":"/files/22-1104-vanuatu-government-systems-stayed-offline-for-weeks-as-officials-used"},{"id":"22-1101","target":"Dropbox","actor":"Unattributed","vector":"Phishing → OTP relay","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-11-01","date":"1 November 2022","href":"/files/22-1101-dropbox-says-phishing-reached-130-repositories-after-a-hardware-key-code"},{"id":"22-1024","target":"Medibank","actor":"Unattributed","vector":"Stolen credential","sector":"Healthcare","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Australia","geo":{"place":"Melbourne","country":"Australia","lon":144.9631,"lat":-37.8136},"sortDate":"2022-10-24","date":"24 October 2022","href":"/files/22-1024-medibank-they-refused-to-pay-and-the-attackers-published-the-abortions"},{"id":"22-1020","target":"Advocate Aurora Health","actor":"Not applicable","vector":"Tracking technology, by design","sector":"Healthcare","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","geo":{"place":"Milwaukee, Wisconsin","country":"United States","lon":-87.9065,"lat":43.0389},"sortDate":"2022-10-20","date":"20 October 2022","href":"/files/22-1020-advocate-aurora-told-3-million-patients-tracking-pixels-sent-data"},{"id":"22-1005","target":"Uber","actor":"Not applicable","vector":"Not applicable","sector":"Technology","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2022-10-05","date":"5 October 2022","href":"/files/22-1005-former-uber-security-chief-convicted-over-100-000-routed-through-the-bug"},{"id":"22-1002","target":"CommonSpirit Health","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":16,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2022-10-02","date":"2 October 2022","href":"/files/22-1002-commonspirit-health-ransomware-forced-paper-records-across-more-than-100"},{"id":"22-0930","target":"On-premises Exchange operators","actor":"Unattributed","vector":"CVE-2022-41040 → CVE-2022-41082","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-09-30","date":"30 September 2022","href":"/files/22-0930-on-premises-exchange-operators-proxynotshell-mitigation-described-one"},{"id":"22-0922","target":"Optus","actor":"Unattributed","vector":"Unauthenticated API","sector":"Telecommunications","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Australia","geo":{"place":"Sydney","country":"Australia","lon":151.2093,"lat":-33.8688},"sortDate":"2022-09-22","date":"22 September 2022","href":"/files/22-0922-optus-an-api-that-asked-for-nothing-and-9-8-million-customer-records"},{"id":"22-0915","target":"Uber","actor":"Lapsus$","vector":"MFA fatigue → social engineering","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-09-15","date":"15 September 2022","href":"/files/22-0915-uber-the-contractor-approved-the-eighteenth-prompt"},{"id":"22-0903","target":"Los Angeles Unified School District","actor":"Vice Society","vector":"Not established","sector":"Education","dwell":34,"sev":5,"status":"Closed","jurisdiction":"United States","geo":{"place":"Los Angeles","country":"United States","lon":-118.2437,"lat":34.0522},"sortDate":"2022-09-03","date":"3 September 2022","href":"/files/22-0903-los-angeles-schools-refused-to-pay-and-500gb-including-psychological"},{"id":"22-0826","target":"Government of Montenegro","actor":"Cuba ransomware (claimed)","vector":"Not established","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Montenegro","geo":{"place":"Podgorica","country":"Montenegro","lon":19.2594,"lat":42.4304},"sortDate":"2022-08-26","date":"26 August 2022","href":"/files/22-0826-government-of-montenegro-montenegro-blamed-russia-for-august-attack"},{"id":"22-0825","target":"LastPass","actor":"Unattributed","vector":"Compromised developer account","sector":"Technology","dwell":4,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-08-25","date":"25 August 2022","href":"/files/22-0825-lastpass-developer-breach-took-14-repositories-four-months-before"},{"id":"22-0815","target":"Signal","actor":"Unattributed","vector":"Third-party compromise — Twilio","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-08-15","date":"15 August 2022","href":"/files/22-0815-signal-says-twilio-breach-exposed-1-900-users-with-three-numbers"},{"id":"22-0808","target":"Twilio","actor":"0ktapus","vector":"SMS phishing → credential relay","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-08-08","date":"8 August 2022","href":"/files/22-0808-twilio-same-phish-same-week-two-companies-two-outcomes"},{"id":"22-0804","target":"Slack","actor":"Not applicable","vector":"Application defect","sector":"Technology","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2022-08-04","date":"4 August 2022","href":"/files/22-0804-slack-sent-hashed-passwords-to-workspace-members-for-five-years"},{"id":"22-0801","target":"Nomad bridge","actor":"Unattributed","vector":"Faulty upgrade — proof validation","sector":"Financial services","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-08-01","date":"1 August 2022","href":"/files/22-0801-nomad-bridge-lost-190-million-as-hundreds-of-addresses-copied-one"},{"id":"22-0721","target":"Twitter","actor":"Unattributed","vector":"Unauthenticated API lookup","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-07-21","date":"21 July 2022","href":"/files/22-0721-twitter-flaw-exposed-5-4-million-accounts-despite-privacy-settings"},{"id":"22-0720","target":"Neopets","actor":"Unattributed","vector":"Not established","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-07-20","date":"20 July 2022","href":"/files/22-0720-neopets-database-of-69-million-accounts-offered-for-four-bitcoin"},{"id":"22-0715","target":"Government of Albania","actor":"Homeland Justice","vector":"Not established","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Albania","geo":{"place":"Tirana","country":"Albania","lon":19.8187,"lat":41.3275},"sortDate":"2022-07-15","date":"15 July 2022","href":"/files/22-0715-government-of-albania-albania-severed-diplomatic-relations-with-iran"},{"id":"22-0705","target":"Marriott International","actor":"Unattributed","vector":"Social engineering","sector":"Hospitality","dwell":1,"sev":2,"status":"Closed","jurisdiction":"United States","sortDate":"2022-07-05","date":"5 July 2022","href":"/files/22-0705-marriott-says-social-engineering-of-one-employee-exposed-20gb-and-about"},{"id":"22-0630","target":"Shanghai National Police database","actor":"Unattributed","vector":"Unsecured internet-facing interface","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"China","geo":{"place":"Shanghai","country":"China","lon":121.4737,"lat":31.2304},"sortDate":"2022-06-30","date":"30 June 2022","href":"/files/22-0630-shanghai-police-database-covering-1-billion-residents-offered-for-10"},{"id":"22-0627","target":"Iranian steel producers","actor":"Predatory Sparrow","vector":"Industrial control system access","sector":"Manufacturing","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Iran","geo":{"place":"Ahvaz","country":"Iran","lon":48.6842,"lat":31.3183},"sortDate":"2022-06-27","date":"27 June 2022","href":"/files/22-0627-predatory-sparrow-published-cctv-of-molten-steel-spilled-at-an-iranian"},{"id":"22-0620","target":"Industrial control devices","actor":"Not applicable","vector":"Insecure by design","sector":"Manufacturing","dwell":null,"sev":4,"status":"Open","jurisdiction":"United States","sortDate":"2022-06-20","date":"20 June 2022","href":"/files/22-0620-forescout-catalogued-56-insecure-by-design-flaws-across-10-industrial"},{"id":"22-0617","target":"Flagstar Bank","actor":"Unattributed","vector":"Not established","sector":"Financial services","dwell":2,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-06-17","date":"17 June 2022","href":"/files/22-0617-flagstar-bank-told-1-547-169-customers-six-months-after-a-two-day"},{"id":"22-0527","target":"Windows users","actor":"Unattributed","vector":"CVE-2022-30190 — zero-day","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-05-27","date":"27 May 2022","href":"/files/22-0527-windows-users-follina-exploited-word-documents-with-no-macro-and-no"},{"id":"22-0525","target":"SpiceJet","actor":"Unattributed","vector":"Not established","sector":"Aviation","dwell":null,"sev":3,"status":"Closed","jurisdiction":"India","geo":{"place":"Gurugram","country":"India","lon":77.0266,"lat":28.4595},"sortDate":"2022-05-25","date":"25 May 2022","href":"/files/22-0525-spicejet-ransomware-attempt-stranded-passengers-and-halted-morning"},{"id":"22-0524","target":"Cisco","actor":"Yanluowang","vector":"Synced credentials → vishing → MFA push","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-05-24","date":"24 May 2022","href":"/files/22-0524-cisco-breach-began-with-corporate-credentials-synced-to-a-personal"},{"id":"22-0523","target":"Clearview AI","actor":"Not applicable","vector":"Web scraping, by design","sector":"Technology","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2022-05-23","date":"23 May 2022","href":"/files/22-0523-ico-fined-clearview-ai-7-5-million-over-20-billion-scraped-images-later"},{"id":"22-0508","target":"Government of Costa Rica","actor":"Conti","vector":"Not established","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Costa Rica","geo":{"place":"San José","country":"Costa Rica","lon":-84.0907,"lat":9.9281},"sortDate":"2022-05-08","date":"8 May 2022","href":"/files/22-0508-government-of-costa-rica-a-country-declared-a-national-emergency-over"},{"id":"22-0417","target":"Beanstalk Farms","actor":"Unattributed","vector":"Flash loan governance capture","sector":"Financial services","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-04-17","date":"17 April 2022","href":"/files/22-0417-beanstalk-farms-lost-182-million-to-a-flash-loan-governance-takeover"},{"id":"22-0412","target":"GitHub customers, incl. npm","actor":"Unattributed","vector":"Stolen OAuth tokens","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-04-12","date":"12 April 2022","href":"/files/22-0412-github-says-stolen-heroku-and-travis-ci-tokens-exposed-private"},{"id":"22-0404","target":"Block — Cash App Investing","actor":"Single operator","vector":"Insider — retained access","sector":"Financial services","dwell":null,"sev":3,"status":"Closed","jurisdiction":"United States","sortDate":"2022-04-04","date":"4 April 2022","href":"/files/22-0404-block-cash-app-investing-cash-app-investing-breach-traced-to-a-former"},{"id":"22-0328","target":"Shields Health Care Group","actor":"Unattributed","vector":"Not established","sector":"Healthcare","dwell":14,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-03-28","date":"28 March 2022","href":"/files/22-0328-shields-health-breach-reached-2-million-patients-after-an-alert"},{"id":"22-0324","target":"Lapsus$","actor":"Not applicable","vector":"Not applicable","sector":"Not applicable","dwell":null,"sev":2,"status":"Closed","jurisdiction":"United Kingdom","geo":{"place":"London","country":"United Kingdom","lon":-0.1278,"lat":51.5074},"sortDate":"2022-03-24","date":"24 March 2022","href":"/files/22-0324-city-of-london-police-arrested-seven-people-aged-16-to-21-over-lapsus"},{"id":"22-0323","target":"Ronin bridge","actor":"Lazarus Group","vector":"Validator key compromise","sector":"Financial services","dwell":6,"sev":5,"status":"Closed","jurisdiction":"United States","sortDate":"2022-03-23","date":"23 March 2022","href":"/files/22-0323-ronin-bridge-lost-620-million-and-nobody-noticed-for-six-days"},{"id":"22-0322","target":"Nvidia, Samsung, Microsoft","actor":"Lapsus$","vector":"Not established","sector":"Technology","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-03-22","date":"22 March 2022","href":"/files/22-0322-lapsus-took-source-code-from-nvidia-samsung-and-microsoft-without"},{"id":"22-0301","target":"Toyota Motor Corporation","actor":"Unattributed","vector":"Not established","sector":"Manufacturing","dwell":null,"sev":4,"status":"Closed","jurisdiction":"Japan","geo":{"place":"Toyota City","country":"Japan","lon":137.1561,"lat":35.0827},"sortDate":"2022-03-01","date":"1 March 2022","href":"/files/22-0301-one-plastic-parts-supplier-stopped-fourteen-toyota-plants"},{"id":"22-0227","target":"Not applicable","actor":"Conti","vector":"Not applicable","sector":"Not applicable","dwell":null,"sev":2,"status":"Closed","jurisdiction":"Ukraine","sortDate":"2022-02-27","date":"27 February 2022","href":"/files/22-0227-a-ransomware-group-took-a-side-and-its-own-chat-logs-were-published"},{"id":"22-0224","target":"Viasat KA-SAT users","actor":"Sandworm","vector":"Network management compromise","sector":"Telecommunications","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Ukraine","sortDate":"2022-02-24","date":"24 February 2022","href":"/files/22-0224-viasat-ka-sat-users-a-wiper-aimed-at-ukraine-took-5-800-german-wind"},{"id":"22-0220","target":"Expeditors International","actor":"Unattributed","vector":"Not established","sector":"Logistics","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-02-20","date":"20 February 2022","href":"/files/22-0220-expeditors-shut-down-global-operations-for-eight-days-after-cyberattack"},{"id":"22-0202","target":"Wormhole bridge","actor":"Unattributed","vector":"Signature verification flaw","sector":"Financial services","dwell":null,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-02-02","date":"2 February 2022","href":"/files/22-0202-wormhole-bridge-lost-320-million-covered-by-parent-company-jump-crypto"},{"id":"22-0120","target":"Okta","actor":"Lapsus$","vector":"Contractor remote access","sector":"Technology","dwell":5,"sev":4,"status":"Closed","jurisdiction":"United States","sortDate":"2022-01-20","date":"20 January 2022","href":"/files/22-0120-okta-the-identity-provider-was-reached-through-its-outsourced-support"},{"id":"22-0118","target":"International Committee of the Red Cross","actor":"Unattributed","vector":"Known CVE — unpatched","sector":"Non-profit","dwell":70,"sev":5,"status":"Closed","jurisdiction":"Switzerland","geo":{"place":"Geneva","country":"Switzerland","lon":6.1432,"lat":46.2044},"sortDate":"2022-01-18","date":"18 January 2022","href":"/files/22-0118-international-committee-of-the-red-the-register-of-people-trying-to-find"},{"id":"22-0117","target":"Crypto.com","actor":"Unattributed","vector":"Two-factor authentication bypass","sector":"Financial services","dwell":null,"sev":3,"status":"Closed","jurisdiction":"Singapore","geo":{"place":"Singapore","country":"Singapore","lon":103.8198,"lat":1.3521},"sortDate":"2022-01-17","date":"17 January 2022","href":"/files/22-0117-crypto-com-says-34-million-left-483-accounts-with-the-second-factor"},{"id":"22-0114","target":"Ukrainian government organisations","actor":"Unattributed","vector":"Not established","sector":"Government","dwell":null,"sev":5,"status":"Closed","jurisdiction":"Ukraine","geo":{"place":"Kyiv","country":"Ukraine","lon":30.5234,"lat":50.4501},"sortDate":"2022-01-14","date":"14 January 2022","href":"/files/22-0114-whispergate-wiper-hit-ukrainian-government-sites-six-weeks-before"}]}