Major Incidents or Breaches

  • Coupang, South Korea’s largest retailer, will compensate 33.7 million customers with $1.17 billion following a data breach that exposed customer information.
  • Aflac suffered a data breach affecting 22 million individuals, with hackers stealing names, addresses, Social Security numbers, ID numbers, and medical/health insurance information.
  • Sax, a major US accounting firm, disclosed a 2024 data breach impacting 220,000 individuals; the investigation took over a year.
  • Korean Air experienced a data breach affecting thousands of employees after its in-flight catering supplier, KC&D, was hacked.
  • Trust Wallet reported that attackers compromised its browser extension, draining approximately $7 million from 2,596 cryptocurrency wallets.
  • Romanian energy provider Oltenia Energy Complex was hit by a Gentlemen ransomware attack, disrupting its IT infrastructure.
  • A hacker claimed theft of 40 million Condé Nast records following a Wired data leak, with 2.3 million Wired subscriber records made public.
  • The EmEditor website was compromised in a supply chain attack, serving a malicious installer that delivered infostealer malware.
  • Over 90% of parked domains now lead users to scams or malware, a significant increase from less than 5% a decade ago.
  • A Lithuanian national was arrested for distributing clipboard-stealing malware disguised as KMSAuto, infecting 2.8 million systems.
  • A former Coinbase support agent was arrested in India for assisting hackers in stealing sensitive customer information from a company database.

Newly Discovered Vulnerabilities

  • MongoDB vulnerability CVE-2025-14847 (“MongoBleed”) is under active exploitation, allowing unauthenticated, remote attackers to leak sensitive data. Over 87,000 potentially vulnerable instances are exposed worldwide.
  • Fortinet warned that the five-year-old critical FortiOS vulnerability (CVE-2020-12812), which allows 2FA bypass, is still being actively exploited in attacks against unpatched devices.

Notable Threat Actor Activity

  • The HoneyMyte APT (also known as Mustang Panda or Bronze President), linked to Chinese state actors, has evolved its tactics to use a kernel-mode rootkit for delivering and protecting the ToneShell backdoor in attacks against government organisations.
  • Researchers disclosed a spear-phishing campaign that published over two dozen malicious npm packages, used as phishing infrastructure to steal login credentials.
  • Chinese state-affiliated hackers are using a kernel-mode loader to hide ToneShell malware activity during cyberespionage campaigns targeting government entities.

Trends, Tools, or Tactics of Interest

  • Malware in 2025 increasingly targeted platforms beyond Windows, including Android, macOS, and cross-platform environments.
  • OWASP’s Agentic AI Top 10 highlights real-world attacks on autonomous AI systems, including goal hijacking and malicious MCP servers.
  • Supply chain attacks remain prominent, as evidenced by the EmEditor installer compromise and malicious npm package campaigns.
  • There is a significant rise in malicious use of parked domains, now serving as a major vector for scams and malware distribution.
  • 2025 saw a shift from singular large incidents to widespread smaller breaches and attacks, with trusted tools being abused and old vulnerabilities resurfacing.

Regulatory or Policy Developments Affecting the Security Industry

  • Debate continues over the utility of Software Bill of Materials (SBOMs), with industry experts expressing mixed views on their practical effectiveness as regulatory and compliance requirements evolve.