Major Incidents or Breaches

• A supply-chain attack has compromised Android-based car head units by leveraging a legitimate device-update application to distribute malware. The infected devices are conscripted into a proxy botnet or used for ad fraud operations ^[2].

Newly Discovered Vulnerabilities

• Weak access controls on Windows named pipes have been highlighted as a security risk, with the potential for untrusted processes to access privileged services if proper endpoint verification and command authentication are not enforced ^[3].

Notable Threat Actor Activity

Major Incidents or Breaches

• A new Android malware family targeting vehicle head units manufactured by DoFun has been discovered. The malware is distributed via legitimate software updates and is designed to serve ads and build a proxy botnet, affecting the integrity of in-car systems and potentially exposing user data^[1][7].
• More than 9,300 Amazon Web Services (AWS) access keys have been found publicly exposed and remain active, granting full control over affected corporate accounts and posing a significant supply chain and cloud security risk^[11].
• Toronto’s Hospital for Sick Children (SickKids) suffered a data breach exposing personal information of current and former employees as well as job applicants, due to a vulnerability in third-party software^[18].
• Healthcare technology provider CareCloud reported a breach affecting 3.75 million individuals, with exposure of sensitive data including medical records, Social Security numbers, and bank details^[31].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A database belonging to the people finder service ClarityCheck was found exposed, leaking 9 million images of individuals’ faces ^[57].
• Operation CameraSwarm compromised 14,000 Dahua IP cameras across Ukraine and Russia, with a focus on Russian and CIS telecom networks ^[46].
• The Grandoreiro banking trojan has resurfaced in a new campaign targeting Mexico, following a previous law enforcement takedown ^[36].
• A new Android malware named Manic is actively targeting Ukrainian banks, government, and identity services, as well as Russian and European financial institutions. It can exfiltrate data from offline devices by leveraging nearby infected devices ^[19][28].
• A critical vulnerability in the Elementor Pro WordPress plugin enables attackers to upload executable files for remote code execution on affected servers ^[24].
• A set of 40 malicious Mozilla Firefox extensions, posing as Web3 wallet products, have been identified stealing cryptocurrency wallet secrets ^[22].
• A researcher discovered new Android malware distributed via legitimate DoFun head unit software, serving ads and building a proxy botnet ^[1].
• A new report indicates that one in four data breaches now involve AI-enabled attacks, marking a 56 percent increase from the previous year ^[3].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Japanese cloud and data center provider Sakura Internet disclosed a breach in which hackers accessed its sales management system, exposing contract and membership information for up to 1.36 million accounts ^[15].
• US healthcare IT company CareCloud revealed a data breach impacting more than 3.7 million patients ^[16].
• A database belonging to the people-search tool ClarityCheck was left exposed, containing over 9 million image files of individuals’ faces ^[26].
• Over 14,500 Dahua IP cameras were compromised in a campaign using credential attacks, authentication bypasses, and P2P exploitation, with most affected devices located in Ukraine and Russia ^[8][17].
• Nearly 2,000 hacked WordPress sites were used as infrastructure for the StopAndProtect malware operation, facilitating malware distribution and data theft globally ^[10].
• The Cl0p ransomware group publicly named over 40 victims from its PTC Windchill campaign, including major firms such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision ^[35].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The CareCloud data breach impact has grown significantly, now affecting 3.7 million individuals, far higher than the initially reported 350,000. The breach exposed sensitive health-related information^[30].
• Heights Finance suffered a data breach impacting at least 1.2 million individuals, with attackers stealing names, addresses, phone numbers, Social Security numbers, and financial information from a third-party platform^[37][42].
• SafePal disclosed that an authorization flaw in an order-tracking plugin exposed the personal data of approximately 39,798 customers, including names, email and shipping addresses, phone numbers, and purchase details^[10].
• The FBI reports that Medusa ransomware has breached over 500 critical infrastructure organizations in the United States since June 2021^[11].
• A single attacker has used the same infrastructure to scrape data from both Salesforce and ServiceNow customer portals across multiple industries since 2025^[8].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A threat actor is selling databases allegedly containing 3.6 million Microsoft Azure account records stolen from multiple Fortune 500 companies, reportedly accessed via compromised credentials ^[11].
• Pokémon Center is notifying customers in the UK and Germany of a data breach after hackers stole personal and order information from a third-party logistics provider ^[12].
• The French Ministry of the Economy and Finance disclosed a data breach at the General Directorate of Public Finances, affecting 678,000 individuals, after an attacker accessed tax-related data using compromised credentials ^[17][27].
• SafePal suffered a data breach impacting 40,000 customers, with attackers exploiting a vulnerability in an order-tracking plugin to access customer information ^[30].
• Philips and General Electric are investigating claims that the Clop ransomware gang breached their systems and stole data ^[16].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers after a vulnerability was exploited to steal customer order information. The stolen data is now reportedly being offered for sale by a threat actor ^[1].
• A threat actor claims to have exfiltrated millions of records from major organisations including McDonald’s, TCS, and Vodafone as part of an Azure data theft campaign targeting Fortune 500 companies ^[7].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company ^[11].
• The ShinyHunters extortion group breached RingCentral, exposing personal information of 1.6 million accounts, including names, addresses, email addresses, and phone numbers ^[12][23].
• A data breach at Beacon CRM impacted over 1,000 charities, reportedly due to a compromised AWS access key found in public JavaScript build artifacts ^[24].
• The Scottish Government’s prosecutor’s office suffered a data breach linked to a third-party service provider, with the potential to affect additional agencies ^[15].
• Four individuals were arrested in Brazil and three charged in Europe for exploiting a service provider vulnerability, enabling €30 million in fraudulent bank withdrawals ^[7].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• RingCentral suffered a data breach impacting 1.6 million accounts, with personal information including names, addresses, email addresses, and phone numbers stolen by the ShinyHunters extortion group and subsequently published online ^[11][23].
• Beacon CRM experienced a data breach affecting over 1,000 charities. The breach was traced to a compromised AWS access key exposed in publicly available JavaScript build artifacts ^[24].
• ShipMonk, a logistics provider, was breached, resulting in the theft of shipping information for 14,000 Trezor customers. Exposed data includes names, addresses, email addresses, and phone numbers ^[25].
• The Scottish Government reported a data breach at the prosecutor’s office, attributed to a third-party provider, with concerns that other agencies serviced by the same provider may also be affected ^[15].
• Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company ^[10].
• Four individuals were arrested in Brazil and three charged in Europe for conducting a €30 million bank fraud by exploiting a vulnerability at a service provider, which enabled unauthorised withdrawals from customer accounts ^[6].
• A former data analyst at Brightly Software was sentenced to two years in prison for stealing company data and attempting to extort $2.5 million from the employer ^[12].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users ^[12][20].
• A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer ^[4].
• Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals ^[5].
• The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations ^[8][17].
• Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash ^[6].

Newly Discovered Vulnerabilities