Major Incidents or Breaches

• The Texas Department of Transportation (TxDOT) suffered a data breach in which a threat actor downloaded 300,000 crash records from its database.
• United Natural Foods, Inc. (UNFI) experienced a cybersecurity incident, leading to proactive system shutdowns and operational disruption. The exact attack vector remains unknown.
• A widespread outage impacted Heroku, preventing developers from accessing the platform and disrupting web services for over six hours.
• OpenAI’s ChatGPT experienced a global outage, affecting user access across web, mobile, and desktop platforms.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Sensata Technologies confirmed a data breach following an April ransomware attack, with personal data of current and former employees compromised.
• United Natural Foods (UNFI), North America’s largest publicly traded grocery wholesaler, experienced a cyberattack that forced the shutdown of some systems.
• Data stolen from Ticketmaster during the 2024 Snowflake data theft attacks was briefly relisted for sale by the Arkana Security extortion group, but no new breach is indicated.
• SentinelOne disclosed new details about an attempted supply chain attack by Chinese hackers, targeting the company through an IT services and logistics provider.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A supply chain attack targeting npm and PyPI ecosystems has been identified, affecting over a dozen packages associated with GlueStack. The attack delivers malware via a change to “lib/commonjs/index.js,” potentially impacting millions globally.
• Over 700 users across Latin America, primarily in Brazil, have been infected since early 2025 through a campaign distributing malicious Chromium-based browser extensions designed to steal user data.

Newly Discovered Vulnerabilities

• A command injection vulnerability in TBK DVR-4104 and DVR-4216 digital video recording devices is being actively exploited by a new Mirai botnet variant, enabling attackers to hijack vulnerable devices.

Notable Threat Actor Activity

Major Incidents or Breaches

• A supply chain attack compromised 15 popular Gluestack NPM packages, which collectively have over 950,000 weekly downloads. The compromised packages were modified to include malicious code functioning as a remote access trojan (RAT).
• Two malicious NPM packages, disguised as utility tools, were discovered to be destructive data wipers. When installed, these packages delete entire application directories, causing potential data loss for affected users.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Optima Tax Relief, a U.S. tax resolution firm, suffered a Chaos ransomware attack, resulting in the leakage of stolen data.
• Kettering Health, a healthcare provider managing 14 medical centers in Ohio, confirmed a May cyberattack by the Interlock ransomware group, with data exfiltration.
• Ukrainian critical infrastructure was targeted by a new data wiper malware, PathWiper, in a disruptive attack attributed to previously unseen malware.
• 86 million AT&T customer records, including names, dates of birth, phone numbers, email addresses, street addresses, and social security numbers, are reportedly being sold on the dark web.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Interlock ransomware group claimed responsibility for a cyberattack on Kettering Health, leaking data allegedly stolen from the healthcare network’s systems.
• A threat actor has re-released data from the 2021 AT&T breach, this time combining files to directly link Social Security numbers and birth dates to 49 million phone numbers.
• Two members of the ViLE gang were sentenced for breaching a US federal law enforcement web portal and conducting an extortion scheme.
• The U.S. Department of Justice seized cryptocurrency funds and 145 clearnet and dark web domains associated with the BidenCash carding marketplace.
• Cisco Talos researchers reported a destructive ‘PathWiper’ attack using new wiper malware against an unnamed critical infrastructure organization in Ukraine.
• Thousands of Asus routers have been compromised and incorporated into botnets.
• Cybercriminals are exploiting a simple technique to steal Salesforce business data for extortion purposes.
• The FBI issued an alert that the BADBOX 2.0 Android malware campaign has infected over 1 million consumer IoT devices, converting them into residential proxies for malicious use.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Play ransomware gang has breached approximately 900 organizations globally as of May 2025, including critical infrastructure and government entities, according to an FBI advisory.
• Media giant Lee Enterprises has disclosed a data breach affecting nearly 40,000 individuals, resulting from a February 2025 ransomware attack.
• Ukrainian police arrested a hacker who compromised 5,000 accounts at an international hosting company to mine cryptocurrency, causing $4.5 million in damages.
• Ukrainian intelligence claims to have hacked Russian aerospace and defense company Tupolev, developers of strategic bombers.
• Multiple domains of the BidenCash carding market, a dark web marketplace for stolen credit cards and personal data, have been seized in an international law enforcement operation.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
• A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

• Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
• A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
• Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
• Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
• CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Major Incidents or Breaches

• Cartier disclosed a data breach after its systems were compromised, exposing customers’ personal information.
• The North Face warned customers of a credential stuffing attack in April that resulted in theft of personal information from its website.
• SentinelOne experienced a seven-hour outage due to a software flaw.
• A significant phishing campaign is targeting users in France, using leaked personal data to craft convincing emails.
• The “Russian Market” cybercrime marketplace has become a major platform for trading credentials stolen by information stealer malware.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A spear-phishing campaign has been identified targeting Chief Financial Officers (CFOs) and other financial executives across six global regions. Attackers are distributing emails posing as recruiters and leveraging the legitimate remote access tool NetBird to establish persistent access to victims’ systems.

Newly Discovered Vulnerabilities

• A trojanized version of the PuTTY SSH client has been observed in the wild. Attackers are distributing this malicious version to establish unauthorized remote access via a simple SSH backdoor.

Notable Threat Actor Activity