Major Incidents or Breaches

• Allianz Life (US): Hackers stole personal information of 1.1 million individuals in a Salesforce data theft attack. Exposed data includes physical addresses, dates of birth, phone numbers, and other sensitive information for life insurance customers.
• Business Council of New York State (US): Data breach in February led to theft of personal, financial, and health information of over 47,000 individuals.
• Inotiv (US): Ransomware attack resulted in encryption of systems and data, impacting business operations.
• Bragg Gaming Group (Global): Hackers accessed internal systems, though operations reportedly unaffected.
• TPG Telecom/iiNet (Australia): Unauthorised access detected in iiNet order management system; investigation ongoing.
• Highly Sensitive Medical Cannabis Data (US): Nearly one million records, including SSNs, government IDs, and health data, exposed due to an unsecured database.
• Polish Power Plant (Poland): Russian hacktivists launched a cyberattack causing operational disruption at a power plant.
• RapperBot DDoS Botnet: US authorities charged a 22-year-old Oregon man for operating the RapperBot botnet, which powered over 370,000 distributed denial-of-service attacks.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Workday disclosed a data breach after attackers accessed a third-party CRM platform via social engineering, likely linked to the broader Salesforce attacks attributed to the ShinyHunters group. Exposed data was limited to “commonly available” business contact information, with no customer data compromised.
• The Canadian House of Commons experienced a data breach, as noted in recent threat intelligence reporting.
• Over 800 N-able N-central servers remain unpatched against two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited. More than 870 instances are affected globally.
• Multiple web hosting firms in Taiwan were targeted by Chinese APT group UAT-7237, aiming for long-term access to high-value targets.
• The US Department of Justice seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator, following an indictment.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Workday disclosed a data breach resulting from attackers gaining access to a third-party CRM platform, reportedly linked to a wider wave of Salesforce-related attacks targeting multiple organizations.
• The Canadian House of Commons suffered a data breach, as reported in the latest threat intelligence bulletin.
• A UK individual was sentenced to 20 months in prison for hacking approximately 3,000 websites.
• Over 800 N-able N-central servers remain unpatched and exposed to two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited.
• US authorities seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator following an indictment.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Norwegian intelligence has attributed a cyber attack on a dam to Kremlin-linked threat actors.
• ICE agents inadvertently added an unauthorised individual to a sensitive group chat, potentially exposing confidential information.

Newly Discovered Vulnerabilities

• A security researcher has released a partial proof-of-concept exploit for a vulnerability in FortiWeb web application firewalls that allows remote authentication bypass. The researcher intends to release a full exploit, increasing the risk of exploitation in the near term.

Notable Threat Actor Activity

Major Incidents or Breaches

• Colt Technology Services, a UK-based telecommunications provider, experienced a cyberattack attributed to the WarLock ransomware group. The incident resulted in a multi-day outage affecting hosting and porting services, with stolen data now being offered for sale.
• Italian hotels suffered a breach in which tens of thousands of scanned guest IDs were stolen and subsequently listed for sale on underground forums, according to CERT-AGID.
• Web infrastructure entities in Taiwan were compromised by the Chinese-speaking APT group UAT-7237. The attackers used customized open-source tools to establish persistent access.
• National Public Data, a service previously involved in a significant Social Security Number leak, has resumed operations under new ownership, raising concerns about the continued exposure and handling of leaked personal data.
• The Canadian House of Commons was reportedly hacked, and the Pennsylvania Attorney General was targeted in a cyberattack. Russia was identified as being behind a separate attack on a court system.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The House of Commons of Canada is investigating a data breach after a cyberattack resulted in the theft of employee information.
• Pro-Russian hackers have been blamed for taking control of critical operation systems at a Norwegian water dam and opening outflow valves, according to the Norwegian Police Security Service.
• Over $300 million in cryptocurrency linked to cybercrime and fraud schemes has been seized through two joint law enforcement and private sector operations.
• The US Courts records system suffered a breach, with details about the exposure and responsible party still unclear.
• Cybercriminals are auctioning live police and government email credentials on the dark web, offering access to sensitive systems and confidential intelligence.
• Four individuals from Ghana have been charged with stealing over $100 million via romance scams and business email compromise (BEC) schemes.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Office of the Pennsylvania Attorney General experienced a cyberattack that disrupted email, phone systems, and their website.
• Manpower disclosed a data breach affecting 140,000 individuals after the RansomHub ransomware group stole sensitive information in January.
• US investigators confirmed that Russian hackers breached the US court electronic filing system, accessing court records and sealed filings.
• Norwegian police attributed suspected sabotage at a dam to pro-Russian hackers, who accessed and manipulated a remote valve control system.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
• Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
• Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
• The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
• Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Connex Credit Union disclosed a data breach affecting 172,000 members, with attackers stealing personal and financial information after breaching its systems.
• The Netherlands’ National Cyber Security Centre (NCSC) reported exploitation of Citrix NetScaler vulnerability CVE-2025-6543 to breach critical organisations in the country.
• Air France experienced a data breach resulting in the leak of frequent flyer data (as per Check Point’s weekly threat bulletin).
• A major automaker’s dealership platform used by over 1,000 US dealerships was found to be vulnerable, allowing car hacking and personal data theft, including the ability for unauthorised remote vehicle unlocking.
• Two hackers reportedly breached North Korean state-sponsored group Kimsuky, stealing and leaking internal data.
• Law enforcement, in collaboration with international partners, took down infrastructure and seized over $1 million associated with the BlackSuit (Royal) ransomware group.
• Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability, leaving them exposed to lateral movement and cloud environment compromise.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Google patched a vulnerability that allowed malicious Google Calendar invites to hijack Gemini agents on target devices, enabling attackers to leak sensitive user data.
• Researchers reported that attackers are leveraging Google paid ads to promote fake Tesla websites, potentially leading to credential theft and other fraudulent activities.

Newly Discovered Vulnerabilities

• WinRAR maintainers released an update addressing an actively exploited zero-day vulnerability (CVE-2025-8088, CVSS 8.8).
• New attack techniques have been identified that exploit flaws in Windows domain controllers, allowing attackers to leverage public DCs via RPC and LDAP to create DDoS botnets.
• Researchers disclosed a now-patched Windows Remote Procedure Call (RPC) Endpoint Mapper (EPM) poisoning vulnerability that could be exploited to escalate privileges within a Windows domain.

Notable Threat Actor Activity