Major Incidents or Breaches

• The ShinyHunters extortion group has been linked to data breaches at Qantas, Allianz Life, LVMH, and Adidas, using voice phishing attacks to steal data from Salesforce environments.
• SafePay ransomware group claims to have stolen 3.5TB of data from Ingram Micro and is threatening to leak the data.
• Telecom provider Orange suffered a cyberattack resulting in service disruptions for both corporate and individual customers.
• The UNC2891 (LightBasin) threat group attempted a physical intrusion by planting a 4G-equipped Raspberry Pi on a bank’s network during a failed ATM heist.
• The City of Saint Paul, Minnesota, called in the National Guard to respond to a cyberattack.
• The National Treasury of South Africa and several other organisations were compromised in mass exploits of on-premises Microsoft SharePoint servers.
• A U.S.-based chemicals company was breached via exploitation of a SAP NetWeaver vulnerability, leading to deployment of the Auto-Color backdoor.
• The Python Software Foundation warned that attackers are using a fake PyPI website to phish for developer credentials.
• Over 250 fake mobile apps targeting Koreans have been used to deploy spyware and conduct blackmail campaigns.
• Discord and other social platforms are being flooded with fraudulent online gaming and wagering sites, which lure users and steal funds.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The City of Saint Paul, Minnesota, suffered a significant cyberattack, prompting the activation of the National Guard in response to disruptions.
• French telecommunications giant Orange disclosed a cyberattack after detecting a breached system on its network.
• Russian airline Aeroflot experienced a cyberattack resulting in the cancellation of over 60 flights and severe delays.
• Allianz Life reported a data breach impacting the majority of its 1.4 million US customers, exposing sensitive personal information.
• The Tea Dating Advice app suffered two security incidents, resulting in the leak of approximately 72,000 images and 59,000 additional images from posts, comments, and direct messages, including unauthorized access to private messages.
• A U.S.-based chemicals company was targeted by attackers exploiting a SAP NetWeaver vulnerability (CVE-2025-31324) to deploy the Linux Auto-Color malware.
• The FBI seized $2.4 million in Bitcoin from a member of the newly emerged Chaos ransomware operation, linked to cyberattacks and extortion payments in Texas.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Toptal suffered a breach of its GitHub organization account, which was used to publish 10 malicious npm packages. These packages were downloaded approximately 5,000 times, constituting a significant software supply chain attack.
• France’s state-owned defense firm Naval Group is investigating a cyberattack after 1TB of allegedly stolen data was leaked on a hacking forum.
• Allianz Life confirmed a data breach impacting the majority of its 1.4 million US customers, including compromised information of customers, financial professionals, and employees.
• NASCAR disclosed that personal information, including names and Social Security numbers, was stolen in an April 2025 ransomware attack.
• The Tea app breach expanded, with a second database leak exposing 1.1 million private user messages and data being circulated on hacking forums.
• Lovense’s connected sex toy app is vulnerable to a flaw that exposes user email addresses, putting users at risk of doxxing.
• Endgame Gear’s OP1w 4k v2 mouse configuration tool was infected with malware and distributed via the official website between June 26 and July 9, 2025.
• The US Energy Department, including its National Nuclear Security Administration, was listed among recent high-profile attacks according to threat intelligence bulletins.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The threat actor group Scattered Spider has been conducting a campaign targeting VMware ESXi hypervisors, focusing on organisations in the retail, airline, transportation, and insurance sectors in North America. The group has been observed deploying ransomware on critical infrastructure by compromising virtualized environments.

Newly Discovered Vulnerabilities

• Researchers have identified over a dozen security vulnerabilities in Tridium’s Niagara Framework. These flaws could allow an attacker present on the same network to compromise smart building and industrial systems globally.
• A critical vulnerability has been found in the Post SMTP email delivery WordPress plugin, which has approximately 400,000 installations. The flaw enables website takeover, and around half of the affected websites remain unpatched.

Notable Threat Actor Activity

Major Incidents or Breaches

• Allianz Life confirmed a data breach impacting the majority of its 1.4 million customers, exposing personal information.
• Steam platform was abused to distribute malware via a pre-release version of a game, leading to infostealer infections.
• Instagram users are being targeted in a novel phishing campaign using convincing emails to steal credentials.

Newly Discovered Vulnerabilities

• Over 200,000 WordPress sites are exposed to hijacking attacks due to a vulnerability in the Post SMTP plugin, allowing attackers to take control of administrator accounts.
• Mitel patched a critical authentication bypass vulnerability in its MiVoice MX-ONE enterprise communication platform, which could allow attackers to access user or admin accounts.
• LG Innotek LNV5110R security cameras are vulnerable to unauthenticated remote code execution; no patch is available.
• A Google Cloud Build vulnerability was disclosed, earning a $30,000 bug bounty.
• ToolShell bugs in Microsoft SharePoint are being actively exploited by cybercriminals and APT groups worldwide.

Notable Threat Actor Activity

Major Incidents or Breaches

• Ransomware attacks increased by 63% year-over-year in Q2 2025, with 276 publicly disclosed incidents reported.
• A hacker compromised Amazon’s Q Developer Extension for Visual Studio Code, injecting data-wiping commands into the AI-powered coding agent.
• Louis Vuitton experienced a data breach impacting customers in multiple countries.
• Steam’s game publishing platform was abused to distribute info-stealing malware via a pre-release version of a game.
• UK national Ollie Holman was sentenced to prison for selling over 1,000 phishing kits, causing losses exceeding $134 million.
• Instagram users are being targeted in a novel phishing campaign leveraging legitimate-looking emails to steal credentials.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has breached hundreds of organizations globally.
• Toptal’s GitHub organization account was compromised, with attackers publishing ten malicious npm packages to the npm registry.
• Security flaws in Airportr, a luggage service used by 10 airlines, exposed user data and allowed attackers to potentially redirect or steal luggage.
• A threat actor named EncryptHub compromised an early access Steam game to distribute info-stealing malware to users.
• CastleLoader malware has infected 469 devices by leveraging fake GitHub repositories and phishing techniques (ClickFix) to deliver info-stealers and remote access trojans.
• Multiple npm developer accounts were compromised in a phishing campaign, resulting in malware being injected into popular npm packages.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
• Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
• Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
• The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
• npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
• Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• AMEOS Group, a large Central European healthcare network, disclosed a security breach potentially exposing customer, employee, and partner information.
• Dior confirmed a cyberattack from January 2025 that resulted in the theft of personal information. Payment information was not compromised.
• Dell reported a breach of its Customer Solution Center demo environment by the World Leaks group. The company stated the leaked data was synthetic and not from real customers or partners.
• A tech startup was found to be selling personal data stolen by infostealer malware and sourced from the dark web.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Dell confirmed that the “World Leaks” extortion group breached one of its product demonstration/test lab platforms. The group is attempting to extort Dell for ransom.
• Dior has begun notifying U.S. customers of a May cybersecurity incident that compromised their personal information.
• Cierant Corporation and law firm Zumpano Patricios disclosed separate data breaches, each affecting over 200,000 individuals.
• The Alcohol & Drug Testing Service (TADTS) reported a ransomware attack in July 2024 that exposed personal information of 750,000 people.
• Over 1,000 CrushFTP servers are currently exposed online and vulnerable to hijack attacks exploiting a critical security bug that provides admin access via HTTPS.
• Louis Vuitton suffered a cyberattack, as reported in recent threat intelligence bulletins.
• Ring users reported a surge in unauthorized device logins on May 28. Ring (Amazon) attributed the incident to a backend update bug and denied an external breach.

Newly Discovered Vulnerabilities