Major Incidents or Breaches

• Iran’s state-owned TV broadcaster was hacked mid-broadcast, with programming interrupted to air protest videos against the government.
• The Taiwanese cryptocurrency exchange BitoPro attributed a cyberattack resulting in the theft of $11 million in cryptocurrency to the North Korean Lazarus Group.
• American insurance company Aflac disclosed a breach as part of a broader campaign targeting US insurance providers, with potential theft of personal data. The campaign is linked to Scattered Spider.
• A massive distributed denial-of-service (DDoS) attack peaking at 7.3 Tbps targeted a hosting provider, with Cloudflare mitigating the incident. This is the largest DDoS attack recorded to date.
• A significant data breach exposed a plain text file containing 184 million passwords for services including Google, Microsoft, and Facebook.
• Reports surfaced regarding a leak of 16 billion passwords from various data breaches, raising concerns about widespread credential exposure.

Notable Threat Actor Activity

Major Incidents or Breaches

• Satellite communications provider Viasat was breached by China’s Salt Typhoon cyber-espionage group, which has previously targeted multiple telecom providers in the United States and abroad.
• Krispy Kreme confirmed that personal information of over 160,000 individuals was stolen in a cyberattack that occurred in November 2024.
• Paragon’s commercial spyware “Graphite” was used to target at least two prominent European journalists, attributed to an unnamed customer.

Notable Threat Actor Activity

Major Incidents and Breaches

• Episource, a healthcare SaaS provider, disclosed a data breach affecting 5.4 million patients in the United States, with health information stolen during a January cyberattack.
• Asana reported a flaw in its Model Context Protocol (MCP) AI feature, which exposed customer data from some instances to other organisations.
• Over 1,500 Minecraft players were infected by a multi-stage Java-based malware campaign, distributed via malicious game mods and cheats on GitHub, aiming to steal credentials and authentication tokens.
• Pro-Israel hacking group Predatory Sparrow claimed responsibility for stealing and destroying over $90 million in cryptocurrency from Iran’s Nobitex exchange in a politically motivated attack.
• Water Curse, a newly identified threat actor, was found to have hijacked 76 GitHub accounts to deliver multi-stage malware with data exfiltration and remote control capabilities.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Scania, a major automotive manufacturer, confirmed a cybersecurity incident involving the compromise of insurance claim documents through stolen credentials. The breach was linked to an extortion attempt.
• Cock.li, an email hosting provider, disclosed a data breach impacting over one million user records. Attackers exploited vulnerabilities in the now-retired Roundcube webmail platform to access the data.
• Indian car-sharing firm Zoomcar reported a breach affecting more than 8 million users. Exposed data included names, phone numbers, car registration numbers, addresses, and emails.
• 23andMe was fined £2.31 million by the UK ICO for a data breach exposing genetic data, attributed to serious security failings.
• WestJet Airlines warned customers and employees to be cautious with personal information following a cyber incident affecting its app and website, though core operations continued.
• Paddle.com and its U.S. subsidiary settled with the U.S. FTC for $5 million over allegations of facilitating tech-support scams that harmed consumers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Washington Post disclosed a cyberattack in which email accounts of several journalists, including those covering national security, economic policy, and China, were compromised. The attack is believed to have been conducted by a foreign government and involved breaches of Microsoft accounts.
• Zoomcar Holdings reported a data breach impacting 8.4 million users, as disclosed in a filing with the U.S. Securities and Exchange Commission.
• Law enforcement agencies from six countries seized the Archetyp Market darknet drug marketplace and arrested its administrator. Archetyp Market had been operating since May 2020.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A malicious package was discovered on the Python Package Index (PyPI), masquerading as the legitimate Chimera module. The package is designed to steal sensitive developer-related information, including AWS credentials, CI/CD secrets, and macOS data.

Newly Discovered Vulnerabilities

• Over 46,000 internet-facing Grafana instances remain unpatched and exposed to a client-side open redirect vulnerability. This vulnerability allows for the execution of a malicious plugin and could result in account takeover.
• Microsoft acknowledged that the June 2025 Windows Server security updates are causing DHCP services to freeze on some systems, potentially impacting network operations.

Notable Threat Actor Activity

Major Incidents or Breaches

• WestJet, Canada’s second-largest airline, is investigating a cyberattack that has disrupted access to some internal systems. The company is responding to the breach and assessing the impact on its operations.

• Spyware was discovered on the phones of two Italian journalists. Details on the specific spyware and attribution are not disclosed.

• Ukraine claims to have hacked a Russian aircraft manufacturer. No further technical details were provided.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Victoria’s Secret restored all critical systems following a security incident on 24 May that led to the shutdown of corporate and e-commerce systems.
• Google experienced a major Cloud outage due to an API management issue, disrupting Google services and other online platforms. Cloudflare also suffered a significant outage but confirmed it was not security-related and no data was compromised.
• Microsoft is investigating an ongoing incident affecting authentication for Microsoft 365 users, resulting in user errors with authentication features.
• Microsoft is investigating Secure Boot errors caused by the KB5060533 update, which prevents Surface Hub v1 devices from starting up.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Forensic investigations confirmed that Paragon’s Graphite spyware was used in zero-click attacks targeting Apple iOS devices of at least two journalists in Europe.
• Google Cloud and Cloudflare experienced widespread service outages impacting access to multiple sites and services across various regions.
• Over 80,000 Microsoft Entra ID accounts at hundreds of organizations were targeted in password-spraying attacks using the TeamFiltration pentesting framework.
• A ransomware campaign using the Fog ransomware strain leveraged an unusual mix of legitimate and open-source tools, including the Syteca employee monitoring software, to carry out attacks.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Erie Insurance and Erie Indemnity Company confirmed a cyberattack that caused recent business disruptions and platform outages.
• INTERPOL’s Operation Secure dismantled over 20,000 malicious IP addresses or domains linked to 69 infostealer malware variants, resulting in 32 arrests, the seizure of 117 command-and-control servers, and disruption of infrastructure in 26 countries.
• Over 80,000 Microsoft Entra ID (formerly Azure AD) accounts were targeted in an account takeover campaign using the open-source TeamFiltration tool.
• Coordinated brute-force attacks involving 295 malicious IPs targeted Apache Tomcat Manager interfaces exposed online.

Newly Discovered Vulnerabilities