Major Incidents or Breaches

• TransUnion Data Breach: TransUnion reported a data breach impacting 4.4 million individuals. The breach was linked to a third-party application used for US consumer support operations. No further details on the application were disclosed.
• Nevada Ransomware Attack: The state of Nevada confirmed a ransomware attack that resulted in office closures, service disruptions, and data theft. Nevada is working with CISA and law enforcement to restore affected systems.
• Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise, previously associated with Salesforce data theft, also enabled attackers to access a limited number of Google Workspace accounts via the Salesloft Drift integration.
• VerifTools Marketplace Takedown: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents used to bypass KYC checks and facilitate online fraud. Operators relaunched the service on a new domain after the takedown.
• Sogou Zhuyin Update Server Hijack: An abandoned update server for the Sogou Zhuyin IME was hijacked and weaponised in a Taiwan-focused espionage campaign, delivering multiple malware families.
• Iranian Ships Hacked: Communications for dozens of Iranian ships were disrupted in a cyber operation, details of which were not attributed to any specific actor.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• TransUnion suffered a data breach impacting over 4.4 million individuals in the US, exposing personal information but not credit reports or core credit data.
• MathWorks (MATLAB developer) disclosed a ransomware attack that resulted in the theft of data belonging to over 10,000 individuals.
• Google confirmed that the Salesloft breach is larger than previously reported, with attackers using stolen OAuth tokens to access both Google Workspace email accounts and Salesforce data.
• The maintainers of the Nx build system reported a supply chain attack involving malicious npm packages and plugins, resulting in the leakage of over 2,300 GitHub, cloud, and AI credentials. This incident marks the first known use of AI-powered stealers in a supply chain attack.
• Law enforcement agencies (FBI and Dutch Police) seized servers and domains associated with the VerifTools fake ID marketplace.
• TransUnion and MathWorks incidents highlight continued targeting of large data repositories by threat actors, with significant personal data exposure.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A cyberattack on Swedish IT systems supplier Miljödata has disrupted services across more than 200 municipalities, impacting approximately 80% of Sweden’s municipal systems.
• Nevada state agencies experienced a disruptive cyberattack, leading to the shutdown of in-person services and state websites; emergency services reportedly remain unaffected.
• Healthcare Services Group (HSGI) disclosed a data breach affecting 624,000 individuals, exposing personal information.
• Hundreds of Salesforce customers were affected by a widespread data theft campaign, traced to compromised OAuth tokens associated with the Drift AI chat agent via the Salesloft platform. Attackers exported corporate data, including AWS and Snowflake keys.
• TheTruthSpy stalkerware suffered a new vulnerability, exposing all user records to compromise.
• 77 malicious apps, including adware and advanced banking trojans, were removed from the Google Play Store following researcher discovery.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Nevada State Government: A cyberattack has disrupted Nevada state IT systems, forcing the closure of all state offices and impacting government websites, phone systems, and online platforms.
• Farmers Insurance: Data breach affecting 1 million customers; details of the compromised data have not been publicly disclosed.
• Nissan Japan: Confirmed a data breach at subsidiary Creative Box Inc. (CBI), with Qilin ransomware claiming responsibility.
• Healthcare Services Group: Data breach impacted 624,000 individuals, with theft of personal information.
• Auchan: Data breach resulted in theft of personal information from hundreds of thousands of customers.
• Data I/O: Ransomware attack caused operational outages; the full scope of the breach is not yet known.
• Salesloft: Breach led to theft of OAuth and refresh tokens via its Drift chat agent integration, enabling attackers to access Salesforce customer environments and exfiltrate data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Farmers Insurance disclosed a data breach affecting 1.1 million individuals, with the compromise traced to broader attacks on Salesforce environments.
• French retailer Auchan reported a cyberattack that exposed sensitive loyalty account data of several hundred thousand customers.
• Aspire Rural Health System confirmed a data breach impacting nearly 140,000 individuals, attributed to the BianLian ransomware group.
• Data I/O, a chip programming firm, experienced a ransomware attack disrupting communications, shipping, and production operations.
• Arch Linux Project has been subject to a week-long DDoS attack, affecting its website, repository, and forums.
• US pharmaceutical company Inotiv suffered a cyberattack, as reported in threat intelligence bulletins.
• Lab-Dookhtegen claimed responsibility for attacks disabling communications on more than 60 Iranian cargo ships and oil tankers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Aspire Rural Health System suffered a data breach impacting nearly 140,000 individuals, attributed to the BianLian ransomware group, which exfiltrated sensitive data.
• Chip programming firm Data I/O disclosed a ransomware attack that disrupted communications, shipping, and production operations.
• Farmers Insurance reported a data breach affecting over 1 million individuals, with separate notifications filed by Farmers New World Life Insurance and Farmers Group.
• The Arch Linux Project has been subjected to a week-long DDoS attack, disrupting its website, repository, and forums.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• DaVita, a kidney dialysis provider, confirmed that a ransomware gang breached its network and exfiltrated personal and health information of nearly 2.7 million individuals.
• CPAP Medical Supplies and Services disclosed a data breach impacting 90,000 individuals, stemming from an intrusion in December 2024.
• Hundreds of organisations were targeted in a new Atomic macOS Stealer campaign via malvertising between June and August 2025.
• A clickjacking attack was reported that can steal credentials from browser-integrated password managers.
• Grok AI chats, intended to be shared privately, were indexed by Google and became publicly searchable.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• DaVita, a kidney dialysis provider, confirmed a ransomware attack resulted in the theft of personal and health information for nearly 2.7 million individuals.
• CPAP Medical Supplies and Services disclosed a data breach stemming from a December 2024 intrusion, impacting approximately 90,000 people.
• Over 300 entities were targeted between June and August in a new campaign using the Atomic macOS Stealer, delivered via malvertising.
• A clickjacking attack capable of stealing credentials from browser-integrated password managers was disclosed.
• Grok AI chat logs intended to be private were indexed by Google Search, exposing user conversations to the public web.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Colt Technology Services Ransomware Attack

  • UK-based Colt Technology Services confirmed a data breach involving customer documentation theft. The Warlock ransomware gang is auctioning the stolen files. The company is working to restore disrupted systems.

• Orange Belgium Data Breach

  • Orange Belgium disclosed that attackers accessed data of approximately 850,000 customers during a July cyberattack. The breach affected customer accounts but no further technical details were provided.

• Ex-Developer Sentenced for Sabotage

  • A former developer was sentenced to four years in prison for deploying custom malware and a kill switch on his ex-employer’s network, locking out employees after his account was disabled.

• Scattered Spider Member Sentenced

  • Noah Michael Urban, a member of the Scattered Spider cybercrime group, was sentenced to 10 years in prison for wire fraud and conspiracy related to high-profile attacks.

Major Incidents or Breaches

• Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
• Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
• Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
• Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
• Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
• McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
• Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
• The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
• A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
• Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities