Major Incidents or Breaches

• TriZetto Provider Solutions, part of Cognizant, suffered a data breach exposing sensitive health information of 3.4 million patients.
• The FBI is investigating a breach affecting systems used to manage surveillance and wiretap warrants, with the scope and impact under assessment.
• Transport for London experienced a data breach impacting 10 million users.
• Iranian APT actors have compromised networks of US organizations, including an airport, a bank, and a software company, with activity observed since February.
• Cyberattackers reportedly gained access to Mexican government agencies and citizens’ data using AI tools and detailed playbook prompts.
• A Ghanaian national pleaded guilty to participating in a $100 million fraud ring leveraging business email compromise and romance scams.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Wikipedia experienced a security incident involving a self-propagating JavaScript worm that vandalized pages and modified user scripts across multiple Wikimedia wikis.
• The FBI arrested a suspect linked to the theft of over $46 million in cryptocurrency from the U.S. Marshals Service. The individual is the son of a U.S. government contractor.
• LeakBase, a stolen credential marketplace active since 2021 with 142,000 users, was shut down by law enforcement and suspects were arrested.
• Spanish and Ukrainian law enforcement dismantled an online gambling ring that exploited war-displaced Ukrainian women, laundering nearly €4.75 million.
• Phobos ransomware administrator Evgenii Ptitsyn, a Russian national, pleaded guilty to wire fraud conspiracy in the US after extradition from South Korea.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• LexisNexis has confirmed a data breach after hackers leaked files containing approximately 400,000 personal information records. Attackers claim to have stolen 2GB of data.
• The University of Mississippi Medical Center (UMMC) resumed operations after a ransomware attack that disrupted access to electronic medical records and IT systems for nine days.
• LeakBase, one of the largest online cybercrime forums for trading stolen data and cybercrime tools, was seized by the FBI and Europol. Data of 142,000 members was reportedly obtained.
• Customers of restaurants using the HungerRush POS platform received mass extortion emails from a threat actor threatening to leak restaurant and customer data.
• A significant increase in hacktivist DDoS attacks was recorded, with 149 attacks affecting 110 organisations in 16 countries, following coordinated military action in the Middle East.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• AkzoNobel, a multinational paint company, confirmed a cyberattack that breached the network of one of its U.S. sites.
• LexisNexis Legal & Professional confirmed a data breach involving unauthorized access to customer and business information, with stolen files leaked by attackers.
• Cloud Imperium Games (developer of Star Citizen) disclosed a breach in January affecting systems containing user personal data.
• The University of Hawaii Cancer Center reported a ransomware attack in August 2025 that compromised personal and health data of nearly 1.2 million individuals.
• Amazon confirmed that drone strikes damaged three AWS data centers in the United Arab Emirates and one in Bahrain, resulting in significant outages.
• Facebook experienced a worldwide outage, rendering accounts inaccessible for a period.
• Interpol, with support from private threat hunters, dismantled an African cybercrime syndicate, resulting in 574 arrests and the recovery of over $3 million.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Madison Square Garden confirmed a data breach resulting from the 2025 Oracle E-Business Suite hacking campaign, with the incident only publicly disclosed months after the initial attack.
• Wynn Resorts, a major US-based casino and hotel operator, was listed among the top attack and breach victims in the recent Check Point threat intelligence report.
• A 22-year-old Alabama man pleaded guilty to hacking and extorting hundreds of women by hijacking their social media accounts, including those of minors.
• A Florida woman was sentenced to 22 months in prison for orchestrating a large-scale Microsoft license fraud operation, trafficking thousands of stolen Certificate of Authenticity (COA) labels.
• A phishing campaign is leveraging a fake Google Account security page and a Progressive Web App (PWA) to steal credentials, multi-factor authentication codes, and cryptocurrency wallet addresses, as well as proxying attacker traffic.
• A fake FileZilla website is distributing a tampered installer that communicates with attacker-controlled servers via encrypted DNS traffic, evading traditional network monitoring.
• A phishing campaign is distributing malicious “purchase order” attachments that link to credential-harvesting web pages.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hackers conducted a cyberattack against the Mexican government, leveraging AI-generated code to write exploits, create custom tools, and automate the exfiltration of over 150GB of sensitive data.

Newly Discovered Vulnerabilities

• Researchers disclosed a high-severity vulnerability, “ClawJacked,” in the OpenClaw AI agent. The flaw allowed malicious websites to bruteforce access to data on a user’s local machine by hijacking locally running OpenClaw instances.

Notable Threat Actor Activity

Major Incidents or Breaches

• Canadian Tire suffered a data breach impacting 38 million accounts. Exposed data includes names, addresses, email addresses, phone numbers, and encrypted passwords.
• South Korea’s National Tax Service inadvertently exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in a press release, resulting in the theft of 6.4 billion won ($4.8M) in cryptocurrency.
• The “QuickLens - Search Screen with Google Lens” Chrome extension was compromised and removed from the Chrome Web Store after being used to distribute malware and steal cryptocurrency from thousands of users.
• Thousands of public Google Cloud API keys were found exposed, with researchers demonstrating these could be abused to authenticate to Gemini endpoints and access private data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Over 900 Sangoma FreePBX instances remain compromised with web shells following exploitation of a command injection vulnerability in the endpoint manager’s interface, ongoing since December 2025.
• ManoMano, an online marketplace, suffered a data breach allegedly impacting 38 million individuals, with stolen data including names, email addresses, phone numbers, and other personal information.
• The U.S. Department of Justice seized $61 million in Tether cryptocurrency linked to “pig butchering” crypto scams.
• Data broker breaches have contributed to nearly $21 billion in identity-theft losses, according to a new report.
• A Ukrainian national pleaded guilty to operating OnlyFake, an AI-powered fake ID website that generated and sold over 10,000 fraudulent identification documents globally.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
• French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
• Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
• A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
• Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
• Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Google, Mandiant, and partners disrupted a global espionage campaign by suspected China-nexus threat actor UNC2814, which breached at least 53 organizations across 42 countries, including telecom firms and government agencies. The campaign leveraged SaaS API calls to conceal malicious traffic.
• UFP Technologies, a US-based medical device manufacturer, disclosed a cyberattack involving data theft and file-encrypting ransomware.
• CarGurus suffered a data breach impacting over 12 million users, with hackers claiming theft of personally identifiable information and internal corporate data.
• Wynn Resorts confirmed a data breach in which the ShinyHunters group exfiltrated employee data.
• Marquis Software Solutions filed a lawsuit against SonicWall, alleging gross negligence and misrepresentation after a backup breach led to a ransomware attack.

Newly Discovered Vulnerabilities