However, it failed to state how the attackers got in or confirm how many users were affected. The 631GB database — which also included phone numbers, home addresses, and behavioral profiles — was left wide open on the internet, unprotected by a password or any other form of authentication control. Unless otherwise prohibited by law, anytime you determine that a breach of security safeguards poses a real risk of significant harm to an individual, you must notify the individual(s) concerned. The notification must be conspicuous and must be given directly to the individual, except in certain circumstances described in the regulations where indirect notification is permitted. The law requires you to keep breach records of all breaches of security safeguards for two years. The law requires that an organization has to keep and maintain a record of every breach of security safeguards involving personal information under its control.
A Compromised Devops Laptop Caused The $63b Binance Breach
The forensic picture, with long dwell time and no monetization of the data, pointed to espionage rather than fraud, which changed how the health sector thought about threat actors. Three patterns run through the most recent entries on this list, and they change how you should read the older ones. The first is that attackers have shifted from breaking into companies to logging into them. Stolen credentials, missing multi-factor authentication, help desk social engineering, and abuse of OAuth tokens account for most of the largest recent events, including Snowflake, PowerSchool, Salesloft Drift, Qantas, Coupang, ADT, and Aura.
DeXpose gives enterprises, government agencies, and law enforcement the intelligence and automation to detect external threats and dark web exposure, investigate cybercrime, and act before damage is done. Industry data puts the average detection and containment time at around 241 days, meaning breaches are often live for months before they’re discovered. The strangely-worded letter sent out to customers suggested that “a person who searched for a particular package or misused a package lookup tool” could have uncovered personal information relating to customers, such as phone numbers.
Fbi And Atf Surveillance Systems Were Breached, Sparking Two “major Cyber Incidents”
Please contact us at with detailed information about your funding situation, research project, and how your work aligns with our mission of advancing consumer privacy protections. Attackers broke into Equifax’s systems between May and July 2017 by taking advantage of an unpatched Apache Struts vulnerability to hack into the credit reference agency’s dispute resolution portal. Patches for the exploited vulnerability had been available since March 2017, months before the attack.
- Our software enables visibility and control of personal data, even in complex environments, making PKWARE a global leader in data discovery, security, and compliance.
- Orange SA, formerly France Télécom, is a French multinational telecommunications corporation and a major global player in mobile, fixed-line, internet, and IPTV services.
- In September 2025, the luxury retailer confirmed a data breach after cybercriminals gained unauthorized access to customer-related data.
- While we work to minimize issues like hallucination or incorrect inferences through careful system design and validation steps, we acknowledge that complete elimination of these problems isn’t currently possible.
Cause of the breach was a sophisticated cyberattack that exploited vulnerabilities in GrubHub’s systems. Cause of the breach was a cyberattack that exploited vulnerabilities in PowerSchool’s https://asia-vibe.com systems. The Mars Hydro data breach in February 2025 is a significant event highlighting the vulnerabilities within the Internet of Things (IoT) landscape. The threat actor claims to have compromised approximately 6 million records, potentially affecting over 140,000 Oracle Cloud tenants, indicating a very broad impact.
An issue with its cache saw Twitter admit it was “possible” that some users’ email addresses, phone numbers, and the final four digits of their credit card numbers could have been accessed. While healthcare organizations continued to face significant breach activity and hacking remained the dominant attack method, the combined business sectors actually experienced the most incidents overall. The quarter saw several massive breaches, including Blue Shield of California’s 4.7 million-record incident, while ongoing notifications from breaches dating back to 2023 remind us that breach impacts extend well beyond initial disclosure dates.
June 2025 has been another tough month on the cybersecurity front, with millions of people learning that their personal information may have been exposed in major data breaches. Patients, customers, and employees alike are finding themselves caught in the fallout of ransomware attacks and data theft that hit healthcare systems, tech platforms, and even global retailers. From McLaren Health Care and Kettering Health to Zoomcar and Ahold Delhaize, the impact has been widespread, touching everyday lives in ways that go far beyond technology. These stories remind us that behind every breach are real people whose trust and privacy are on the line. Union County, Ohio, is a county government body in the United States, responsible for providing a wide range of public services and managing sensitive resident and employee data. In September 2025, the local government confirmed that it had suffered a major data breach following a ransomware attack.
The information was being sold as part of a collected dump also including the likes of MyFitnessPal (more on that below), MyHeritage (92 million), ShareThis, Armor Games, and dating app CoffeeMeetsBagel. Experian subsidiary Court Ventures fell victim in 2013 when a Vietnamese man tricked it into giving him access to a database containing 200 million personal records by posing as a private investigator from Singapore. In March 2014, he pleaded guilty to multiple charges including identity fraud in the US District Court for the District of New Hampshire. The DoJ stated at the time that Ngo had made a total of $2 million from selling personal data. In today’s data-driven world, data breaches can affect hundreds of millions or even billions of people at a time.
After studying English Literature and Creative Writing, they worked on local newspapers and online publications, including Outlander Magazine. From small startups to huge corporations, these breaches are impacting everyone and understanding the full scope of the problem is the first step to preventing your business from falling victim. Users know their data rights better than ever, and even the smallest data breach in 2025 makes headlines immediately. Additionally, though we collect the contents of breach notification letters where possible, we do not host these letters locally–and source URLs may no longer be active. This project was funded in large part thanks to The Rose Foundation for Communities and the Environment Consumer Products Fund.
The cause was a supply-chain attack involving the breach of a third-party e-commerce service provider used by Harrods. Names, portal addresses, email addresses, phone numbers, dates of birth, Social Security numbers, and driver’s license numbers. When a single breach generates notifications in multiple states, we cluster those filings together and report them as one event. This is not a unique headcount, as the same person affected by multiple breaches is counted multiple times.
Report A Privacy Breach At Your Organization
Approximately 70,000 residents of HCF Management-operated facilities were affected. The breach impacted residents across multiple facilities, including HCF Corry Manor, HCF Warren Manor, HCF Shawnee Manor, and HCF Edinboro Manor. Approximately 62 million student records were compromised, indicating a massive breach affecting a significant portion of the student population. Over 600,000 records were exposed, and approximately 6.5GB of data was exfiltrated, showing a significant compromise of Orange Group’s information. The breach involved the exfiltration of 700 documents in the first wave and 350 gigabytes of data in the second wave, impacting internal operations and potentially compromising sensitive information. The breach resulted from a former business partner using outdated software and vulnerabilities in a third-party vendor’s cloud system.
The U.S. government connected the hacking group behind the breach to an arm of Iranian intelligence. The breach ended up having a material impact on Stryker’s first-quarter earnings. When the company didn’t pay the hackers’ ransom, the hackers broke in again and defaced the login screens for Canvas, used by students to access their exam and coursework material.
Weibo denied that its systems had been breached, arguing the phone numbers had been assembled by brute forcing its contact lookup feature in 2019 and then matched to public profile data. China’s Ministry of Industry and Information Technology summoned Weibo executives over the incident. Whichever explanation is correct, the practical result was one of the largest exposures of Chinese social media users’ identity and contact details. ShinyHunters listed 1.3 terabytes of Ticketmaster data for 500,000 dollars in May 2024, claiming records on 560 million customers.
On social platforms, breaches often stem from misconfigured privacy settings, third-party apps harvesting more data than users realize they authorized, or platforms themselves experiencing a security failure that exposes user profiles. Because so much of this data is used for advertising and behavioral tracking, a single online privacy breach can quietly compound; exposed data gets scraped, resold, or combined with other leaked datasets long after the original incident. This is different from a data leak, which is when sensitive data is unknowingly exposed to the public/members of the public, such as the Texas Department for Insurance leak mentioned above.
According to the Cost of a Data Breach 2026 report, it takes an average of 247 days to identify and contain an active breach across all industries. Deploying the right security solutions can help organizations detect and respond to these breaches faster. Hackers breached the network by using an employee’s password that they found on the dark web.
