Major Incidents or Breaches

• Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
• Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
• Eurail reported a breach in which hackers stole personal and reservation information of travellers.
• Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.
• Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.
• Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.
• Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Central Maine Healthcare experienced a data breach affecting over 145,000 individuals, exposing sensitive personal information.
• Belgian hospital AZ Monica was forced to shut down all servers, cancel procedures, and transfer critical patients due to a cyberattack.
• Betterment, a US digital investment advisor, confirmed a breach resulting in fake crypto-related emails being sent to customers.
• Target source code samples were leaked and confirmed as authentic by employees, prompting an accelerated lockdown of internal systems.
• JPMorgan disclosed that the law firm Fried Frank suffered a data security incident impacting high-profile clients.
• Spanish energy company Endesa was hacked, resulting in the theft of customer data, including contact, payment, and national identity information.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
• University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
• Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
• BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
• Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
• Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
• Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Instagram has denied reports of a data breach after claims surfaced that data from over 17 million accounts was leaked online. The company stated that a bug enabling mass password reset email requests was identified and fixed, but asserts that no user passwords or sensitive data were exposed via a breach.
• The University of Hawaii Cancer Center confirmed that hackers accessed patient data. The institution did not immediately notify affected individuals and has withheld details regarding the specific research project compromised and any ransom payments made to regain access.

Regulatory or Policy Developments

Major Incidents or Breaches

• The database of the BreachForums hacking forum was leaked online, exposing information on approximately 324,000 user accounts. The leak includes user names, email addresses, hashed passwords, and other user data.

Notable Threat Actor Activity

• The Iranian state-linked group MuddyWater has been attributed to a spear-phishing campaign targeting diplomatic, maritime, financial, and telecommunications entities in the Middle East. The campaign delivers a new Rust-based remote access trojan (RAT) dubbed “RustyWater.”
• Spanish authorities, supported by Europol, arrested 34 individuals alleged to be members of the Black Axe cybercrime syndicate. The group is accused of conducting cyber fraud and organized crime activities resulting in €5.9 million in illicit gains.

Regulatory or Policy Developments Affecting the Security Industry

Major Incidents or Breaches

• The Illinois Department of Human Services (IDHS) exposed personal and health data of nearly 700,000 residents due to incorrect privacy settings.
• Gulshan Management Services, a Texas gas station operator, reported a data breach affecting 377,000 individuals following a ransomware attack.
• An Illinois man has been charged with hacking nearly 600 Snapchat accounts via phishing to steal and sell private photos online.

Newly Discovered Vulnerabilities

• Trend Micro patched a critical remote code execution vulnerability (CVSS 9.8) in on-premise versions of Apex Central for Windows, which could allow attackers to execute arbitrary code with SYSTEM privileges. Three vulnerabilities were addressed, and proof-of-concept code has been released.
• VMware ESXi zero-day vulnerabilities have been exploited by threat actors, with evidence that exploits were developed up to a year prior to public disclosure. The flaws allow virtual machine escapes and were initially accessed via a compromised SonicWall VPN appliance.

Notable Threat Actor Activity

Major Incidents or Breaches

• WhatsApp accounts are being targeted by a phishing campaign attempting to trick users into linking malicious devices, potentially resulting in account compromise.
• A WhatsApp worm is distributing the Astaroth banking trojan in Brazil via auto-messaging to contacts, facilitating rapid malware propagation and credential theft.
• Fake AI-powered Chrome extensions, mimicking legitimate tools, have stolen data from approximately 900,000 users, harvesting ChatGPT and DeepSeek credentials.
• The Kimwolf botnet has rapidly infected over two million devices, primarily by compromising unofficial Android TV streaming boxes.
• Microsoft Exchange Online experienced an outage affecting mailbox access via IMAP4.
• Researchers demonstrated remote hacking risks in WHILL wheelchairs due to unauthenticated Bluetooth access, enabling unauthorized device movement.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Crimson Collective extortion group claims to have stolen data on over one million Brightspeed broadband customers. Brightspeed is investigating the alleged breach.
• Chrome extensions impersonating AITOPIA, with a combined 900,000 downloads, were found exfiltrating users’ AI chat data and browser activity.
• Logitech Options+ and G Hub apps for macOS became non-functional after their code-signing certificate expired, preventing users from launching the applications.
• Multiple enterprises’ file-sharing instances were breached by the “Zestix” threat actor using infostealers to obtain credentials; lack of multi-factor authentication (MFA) was identified as a common vulnerability.
• ownCloud issued a warning to users to enable MFA following reports of credential theft and unauthorised data access.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Jaguar Land Rover (JLR) reported a 43% decline in third-quarter wholesale volumes following a cyberattack in September 2025.
• Sedgwick confirmed a security breach at its federal contractor subsidiary, Sedgwick Government Solutions.
• Two malicious Chrome extensions, installed by approximately 900,000 users, were found exfiltrating ChatGPT and DeepSeek conversations and browsing data.
• NordVPN denied a breach after a threat actor leaked data allegedly sourced from the company; an internal investigation is ongoing.
• Researchers linked dozens of major data breaches to a single initial access broker using credentials exfiltrated by information stealers.
• A phishing campaign is actively abusing Google Cloud Integration Application infrastructure to steal Microsoft 365 credentials, bypassing standard email filters.

Newly Discovered Vulnerabilities