USA
Golem
Attackers accessed the "DNA Relatives" feature for 6.9 million users via credential stuffing. Genetic heritage data was scraped. $30M settlement reached in 2025.
700Credit
$50M | 200 Emp.
USA
Unknown
API vulnerability exploited in a "velocity attack" on credit report data. Full names, addresses, DOBs, and SSNs exposed for 5.8 million consumers.
Activision Blizzard
$8.7B | 13,000 Emp.
USA / Global
Lapsus$ Resurgence
Internal Slack tokens were phished, allowing actors to access future game roadmaps and source code for the "Call of Duty" engine. 450GB of data leaked.
Adidas
$41B | 59,000 Emp.
Germany / Global
Scattered Spider
Part of a retail sector wave; customer data including emails and purchase histories stolen via third-party vendor compromise.
Adobe
$19.4B | 29,000 Emp.
Global
Killnet
DDoS attacks masked a concurrent SQL injection on a legacy Behance database. Email addresses and encrypted passwords of 3.2 million creatives were scraped.
Advance Auto Parts
$11B | 68,000 Emp.
USA
Sp1d3r (Snowflake)
A victim of the massive Snowflake cloud storage campaign. Hackers stole 380 million customer records, including Social Security numbers and driver’s license numbers.
Aflac
$19.4B | 12,700 Emp.
USA / Global
Scattered Spider
Insurance claims, SSNs, and health details compromised through a cyberattack, affecting 22.7 million customers and beneficiaries.
Air France-KLM
€27B | 79,000 Emp.
Europe / Global
Anonymous Sudan
Flying Blue loyalty program accounts were brute-forced. 400,000 accounts were locked and miles were fraudulently redeemed.
Alabama Ophthalmology
Small | <100 Emp.
USA (AL)
BianLian
Ransomware attack affecting 131,576 individuals. Personal and medical data was stolen and exfiltrated.
Allianz Life
$7.3B | 5,000 Emp.
USA / Global
Scattered Spider
Sensitive PII including SSNs, emails, and DOBs were accessed via social engineering on a third-party CRM system; 2.8 million records exposed.
Allianz UK
£3B | 5,000 Emp.
UK
Clop
Separate from Allianz Life; Oracle EBS zero-day (CVE-2025-61882) exploited insurance policy systems. Employee and client data exposed.
Almaviva
€1.2B | 10,000 Emp.
Italy
Unknown
Cyberattack on IT provider exposed 2.3TB of data, including sensitive info from client Ferrovie dello Stato Italiane.
Alternate Solutions
$100M+ | 1,000 Emp.
USA
Unknown
Cyberattack exposed medical records, SSNs, and diagnostics for 93,589 patients. Discovered in April; notifications delayed.
Global
RansomHouse
Extortion group claimed theft of 450GB of data regarding future GPU architectures via weak contractor passwords.
Anne Arundel Derm.
$152M | 1,470 Emp.
USA (MD)
Unknown
Significant healthcare breach involving patient sensitive data. Reported to HHS as one of the largest regional incidents.
Apple
$416B | 166,000 Emp.
USA / Global
Infostealers
Not a direct system compromise, but a massive aggregation of user credentials stolen via client-side malware (Infostealers), contributing to 16 billion leaked credentials.
Asahi Group
$4.2B | 28,000 Emp.
Japan
Qilin
Ransomware attack halted brewery distribution systems in Tokyo. 27GB of supplier contracts exfiltrated and encrypted. Nationwide shortages reported.
Japan
RansomHouse
1.1TB of customer and supplier data was stolen via ransomware, disrupting e-commerce operations.
Taiwan / Global
Everest
1TB of data including source code and AI models was stolen via ransomware. A separate campaign compromised 50,000 routers.
AT&T
$122B | 150,000 Emp.
USA
ShinyHunters (Snowflake)
Multiple Incidents: Metadata for "nearly all" wireless customers (approx. 110 million) was stolen, exposing call logs. A separate breach of a marketing partner exposed 86 million SSNs.
Australian Fluid Power
A$50M | 200 Emp.
Australia
Anubis
Ransomware attack led to unauthorized access of employee, customer, and supplier information. Limited systems compromised; no full scale reported.
AustralianSuper
A$200B Assets | 1,000 Emp.
Australia
Credential Stuffers
Part of coordinated attacks on superannuation funds. Credential stuffing led to unauthorized access and theft from member accounts. No system breach, but highlighted password reuse risks.
Bank of America
$3.2T Assets | 213,000 Emp.
USA
LockBit
Third-party breach via Infosys McCamish exposed deferred compensation plans, including SSNs and financial data, for 57,000 employees and customers.
Barts Health NHS Trust
£2.5B | 18,000 Emp.
UK
Clop
Zero-day exploit in Oracle E-Business Suite stole employee and patient data, including HR records and medical info. Part of a campaign hitting dozens of organizations.
UK
Clop
Employee payroll data for 15,000 staff members was exfiltrated via MOVEit zero-day, including National Insurance numbers.
Bell Ambulance
Mid-Size | 500+ Emp.
USA (WI)
Unknown
114,000 individuals affected by a data breach where personal and medical data was stolen.
Blue Shield CA
$25B | 7,800 Emp.
USA (CA)
Misconfiguration
Names and policy details for 4.7 million individuals were exposed due to a Google Analytics misconfiguration.
Booking.com
$17B | 20,000 Emp.
Global
Phishing Syndicates
Massive compromise of hotel partner portals allowed hackers to message customers directly within the app, phishing credit card details.
bpost
$7.1B | 36,000 Emp.
Belgium
TridentLocker
Over 30GB of personal and business information was compromised via ransomware and posted online.
Bybit
$2B Vol | 1,000 Emp.
Dubai
Lazarus Group
$1.5 billion ETH heist. Hackers exploited a zero-day in a cold-wallet multisig protocol.
Catwatchful
Private | <50 Emp.
Global
Unknown
Stalkerware app breach exposed customer emails/passwords and victim device data (photos, messages, locations) for 26,000 devices. Company shut down post-incident.
Change Healthcare (UnitedHealth)
$370B (Parent) | 14,000 Emp.
USA
BlackCat / ALPHV
The most consequential healthcare attack in US history. 100-190 million Americans' health and billing data was compromised. The company paid a $22M ransom, but systems were paralyzed for weeks.
Checkout.com
$400M | 5,000 Emp.
UK / Global
ShinyHunters
Outdated merchant documents were accessed via legacy cloud storage. No payment data compromised.
Chinese Surveillance Network
Gov-Linked | N/A
China
Misconfiguration
Unsecured database exposed WeChat profiles, bank details, Alipay info, phone numbers, addresses, and behavioral data on citizens. Largest single exposure of the year (4 billion records).
USA
UNC2447
Vishing attack on an employee granted VPN access. Attackers pivoted laterally but were contained.
Coca-Cola
$45B | 79,000 Emp.
Global
Everest / Storm-0501
Employee documents, passport scans, and marketing strategies were compromised via ransomware.
Coinbase
$10B | 4,000 Emp.
USA / Global
Insider / Lazarus
Overseas support staff bribed to access customer data for extortion. Names, emails, and account details stolen; $400M impact including response costs.
Collins Aerospace (RTX)
$26B | 50,000 Emp.
USA / Global
Unknown
Cyberattack disrupted airport operations in Europe (e.g., Heathrow, Brussels). Sensitive airline and operational data potentially exfiltrated.
Comcast
$47B | 41,000 Emp.
USA
Ransomware (FBCS)
Debt collector FBCS (serving Comcast) suffered a ransomware attack, exposing 4.3 million records including names, SSNs, DOBs, and account details.
Community Health Center, Inc.
$500M | 2,000 Emp.
USA
Skilled Hacker
Infiltration exposed PII and medical info (SSNs, health insurance) for over 1 million patients across CT, NY, and beyond.
Connex Credit Union
$3B Assets | 500 Emp.
USA (CT)
Unknown
Unauthorized access to member data via external system. Names, account numbers, SSNs, and IDs exposed for 172,000 members.
Coupang
$33.7B | 95,000 Emp.
South Korea
Insider / State-Linked
33.7 million customer accounts including names and purchase history were accessed unauthorizedly for 5 months.
Dairy Farmers of America
$21.7B | 18,000 Emp.
USA
Play
SSNs, IDs, and bank numbers were compromised via social engineering campaign.
DaVita
$12B | 60,000 Emp.
USA
Unknown
Patient data affected as part of a wider healthcare sector breach wave.
Dell Technologies
$88B | 120,000 Emp.
USA / Global
Menace / Menelik
API scraping incident. Hackers scraped a support database containing 49 million records, including physical addresses and warranty info.
Deutsche Bank
€27B | 85,000 Emp.
Germany
Clop
Indirect breach via service provider 'Majorel'. Personal data of thousands of clients utilizing the account switching service was compromised.
Global
Unknown
Third-party vendor breach exposed user photos, messages, IDs, names, emails, IPs, and limited billing info. 1.5TB of age-verification data stolen.
Disney
$185B | 195,000 Emp.
USA / Global
Nullbulge
Hacktivist group leaked 1.1TB of internal Slack data, including unreleased project details, employee info, and ad revenue stats. Major IP exposure.
Dodd Group
£500M | 2,500 Emp.
UK
Lynx
Ransomware attack stole ~4TB of data, including files on 8 RAF/Royal Navy bases, visitor logs, and staff details. UK MoD investigated the breach.
Dodo / iPrimus (Vocus)
A$1B | 2,000 Emp.
Australia
Unknown
Breach led to unauthorized access of 1,600 email accounts and 34 SIM swaps, allowing interception of calls and texts (including 2FA codes).
DoorDash
$8B | 23,700 Emp.
USA
Scattered Spider
Social engineering of IT support allowed access to internal tools. Driver licenses and names/addresses of customers and workers were stolen.
USA
Unknown
Supply-chain attack on sales engagement platform exposed business contacts and CRM data for clients like Palo Alto Networks and Zscaler.
Dropbox
$2.5B | 3,000 Emp.
USA
0ktapus
Production environment access gained via stolen developer tokens. Dropbox Sign customer emails and authentication keys were accessed.
Dukaan
Private | 500 Emp.
India
Misconfiguration
Unsecured Apache Kafka instance leaked payment gateway tokens (Stripe, PayPal, Razorpay). Merchant and customer transaction data at risk; undetected for years.
Elastic
$1.3B | 3,000 Emp.
Global
Scattered Lapsus$ Hunters
Linked to Salesforce breaches; internal email account compromised. Potential exposure of customer data in debugging copies.
Envoy Air (American Airlines)
$2B | 18,000 Emp.
USA
Clop
Oracle E-Business Suite exploit accessed business and contact data. No customer PII, but internal disruption.
Farmers Insurance
$19.6B | 20,000 Emp.
USA
UNC6040
Customer data for 1.1 million records was accessed via a misconfigured API in Salesforce integration.
Italy
RansomEXX
7GB of internal documents leaked, including repair manuals and customer purchase agreements. Ferrari refused ransom payment.
FinWise Bank
$96M | ~200 Emp.
USA (UT)
Insider Threat
Names and financial data for 689,000 customers were improperly accessed by a former employee over a two-year period.
Flagstar Bank
$1B+ | 5,000 Emp.
USA
Unknown
2.2 million people affected by a data breach. A $31.5 million settlement was reached.
Flat Earth Sun, Moon & Zodiac
Private | <50 Emp.
Global
Unknown
Breach of app exposed user profiles: names, emails, DOBs, genders, and geolocations (latitude/longitude). Confirmed after initial denial; app updated security.
Freddie Mac
$22.5B | 8,100 Emp.
USA
Unknown
Names and SSNs were exposed in a major breach. Full scope under investigation.
French Football Federation
€500M | 2,000 Emp.
France
Unknown
Amateur player data stolen, including names, DOBs, nationalities, addresses, and license IDs. Up to 2.3 million individuals affected.
Fulgar
~$200M | 1,000 Emp.
Italy
RansomHouse
Corporate data exfiltrated via ransomware; warning issued about potential phishing campaigns.
Gainsight
$252M | 1,200 Emp.
USA
ShinyHunters
CRM data from over 200 client companies was accessed. Part of a larger campaign involving stolen authentication tokens.
Game Freak
$1B+ | 800 Emp.
Japan
Unknown
Massive leak of 1TB+ data, including source code for unreleased Pokémon games, employee details, and future plans.
Australia
Termite
940GB of sensitive patient data, including medical histories, was stolen via ransomware and leaked despite a court injunction.
GlobalLogic (Hitachi)
$1.5B | 25,000 Emp.
USA / Global
Clop
Oracle zero-day exploit stole employee records: names, DOBs, passports, salaries, SSNs, and bank info. 10,500 employees affected.
Google Cloud
$385B | 183,000 Emp.
USA
ShinyHunters
Business contacts were compromised via social engineering on a Salesforce database instance. Limited impact, but increased phishing risk.
Gravy Analytics
$11M | 50 Emp.
USA
Unknown
Precise location data of millions was accessed via unauthorized AWS storage, including sensitive sites.
Habib Bank AG Zurich
$488M | 8,000 Emp.
Switzerland
Qilin
2.5TB of customer and transaction records were stolen via ransomware.
Harrods
$1.3B | 3,200 Emp.
UK
Unknown
Customer names and loyalty details for 430,000 individuals were compromised via a supply-chain attack on an e-commerce provider.
Harvard University
$50B Endowment | 25,000 Emp.
USA (MA)
Clop
Donor and administrative data breached via Oracle exploit and phishing. Names, emails, addresses, and event details exposed.
Hawaiian Airlines
$2.8B | 7,000 Emp.
USA (HI)
Scattered Spider
Customer data including names, DOBs, passports, and loyalty info stolen via third-party breach. Part of airline wave.
Hertz
$8.5B | 26,000 Emp.
USA / Global
Clop
Names, credit cards, and IDs for 1 million customers were exposed via zero-day vulnerabilities in file transfer software.
Hillcrest Convalescent Center
$50M | 500 Emp.
USA
Unknown
Cyberattack stole names, SSNs, medical records, treatments, and insurance for 106,194 residents/patients. Ransomware suspected; notifications delayed.
Hyundai Motor Europe
$90B+ | 100,000+ Emp.
Europe / Korea
Black Basta
IT network infiltration in the German division. 3TB of data allegedly stolen, including legal documents and HR files.
Sweden / Global
Vice Society
Internal email systems compromised via "Reply-chain" phishing. Workstations in Morocco and Kuwait branches were affected.
Ingram Micro
$49B | 27,000 Emp.
USA / Global
SafePay
Emails, phone numbers, and SSNs stolen via unpatched VPN exploit. Global operations were disrupted with a $136 million daily impact.
Islamia University
Gov-Linked | 1,500 Emp.
Pakistan
Indian Cyber Force
Database breach exposed names, phone numbers, addresses, and academic records for thousands of students/staff.
Jaguar Land Rover
$38B | 42,000 Emp.
UK
LockBit 3.0 / Rey
700 internal documents including source code were stolen via compromised Jira credentials. Production at Solihull plant was halted by a related ransomware event.
Jewett-Cameron Trading
$100M | 100 Emp.
USA
Unknown
Ransomware stole video-meeting images, non-public financial data, and encrypted systems. No customer PII reported.
Kering
€21.6B | 45,000 Emp.
France
ALPHV
Credential stuffing on Gucci/Balenciaga client portals led to high-net-worth individual data leaks and a double-extortion ransomware event.
Kido International
Small | ~300 Emp.
UK
Radiant
Ransomware attack compromised children's names, photos, and family details for approximately 8,000 children.
LastPass
N/A (GoTo) | 3,000 Emp.
USA
Unknown APT
Secondary breach of cloud storage. Encrypted vault backups were exfiltrated. While encryption held, metadata (URLs, dates) was visible.
Legal Practice Board WA
Gov | <200 Emp.
Australia
Dire Wolf
Personal data affected; notifications sent to victims in Western Australia.
LexisNexis Risk Solutions
$10B | 35,000 Emp.
USA / Global
Unknown
Data acquired from third-party dev platform. Names, addresses, SSNs, and risk profiles exposed for 364,000 individuals.
LoanDepot
$1B | 6,000 Emp.
USA
ALPHV / BlackCat
Ransomware encrypted systems and exposed SSNs and loan applications for 16.6 million customers. The company refused to pay.
Logitech
$4.6B | 7,300 Emp.
Switzerland / Global
Clop
1.8TB of corporate data was exfiltrated via zero-day exploit. No customer hardware was affected.
Louis Vuitton
~$20B (LVMH) | N/A
France
ShinyHunters
Names, emails, and purchase history were compromised via a supply-chain attack on their CRM system.
MailChimp
$12B (Intuit) | 1,200 Emp.
USA
Scattered Spider
Social engineering of admin panel support staff. 133 accounts breached, mostly crypto-related newsletters.
Mango Fashion
€2.3B | 15,000 Emp.
Spain / Global
Unknown
Third-party breach leaked customer contacts: names, emails, phones, postcodes. No financial data.
ManpowerGroup
$17.6B | 26,700 Emp.
USA / Global
RansomHub
SSNs, passports, and 500GB of corporate data were stolen via ransomware, affecting 144,189 individuals.
Marks & Spencer
$17.2B | 73,000 Emp.
UK
Scattered Spider
Supply chain disruption. 3rd party logistics provider hacked. Sparks loyalty card data for 2M+ users exfiltrated.
Marquis Software Solutions
$100M | 300 Emp.
USA
Akira
Ransomware hit banking clients (70+ institutions). Names, SSNs, account details, and card numbers exposed for 400,000+ consumers.
Mars Hydro
Private | 100 Emp.
China / Global
Unknown
Exposure of IoT grow-light database leaked 2.7B records: Wi-Fi passwords, IPs, emails. Highlighted vulnerabilities in connected devices; data sold on forums.
McDonald's
$25.5B | 150,000 Emp.
Global
Unknown
64 million job applicants' names and emails were exposed via an IDOR vulnerability. No financial data was compromised.
MGM Resorts
$13B | 70,000 Emp.
USA
ALPHV / BlackCat
Vishing attack on Help Desk. All Las Vegas properties forced to manual check-ins and slot machine outages for 10 days. $100M loss.
Microsoft
$211B | 220,000 Emp.
USA
Midnight Blizzard
State-sponsored actors used password spraying to compromise corporate email accounts of senior leadership.
Mixpanel
$200M | 500 Emp.
USA
Unknown
Analytics platform breach exposed SDK-integrated data, including historical subscriber records from clients like Pornhub. OpenAI severed ties; no passwords/payment data.
Motility Software
Private | 200 Emp.
USA
Pear
Ransomware stole client data: names, addresses, DOBs, SSNs, DL numbers. Auto industry focus. 766,000 individuals affected.
MuniOS
Private | <100 Emp.
USA
Ransomware
Key municipal bond market site hit by ransomware, disrupting $4.3T market access. Investor data potentially exfiltrated.
National Public Data
Small | <50 Emp.
USA (FL)
USDoD
Largest Volume Breach: A database containing 2.9 billion records was leaked, exposing SSNs, addresses, and genealogy of nearly every adult in the US, UK, and Canada.
Neiman Marcus
$3B | 10,000 Emp.
USA
Sp1d3r (Snowflake)
Snowflake credential attacks exposed 64 million customer records, including gift card numbers and shopping preferences.
Nikkei
$1.2B | 3,000 Emp.
Japan
Unknown
Names, emails, and chat histories of 17,000 were stolen via malware on the Slack app.
Nintendo
$15B | 7,000 Emp.
Japan / Global
Crimson Collective
Access to production assets, developer files, and backups. No customer data, but significant intellectual property loss.
Nissan
$85B | 132,000 Emp.
Japan / Global
Crimson Collective
Red Hat server misconfiguration allowed unauthorized access. 21,000 finance customer records breached.
Norton (Gen Digital)
$3B | 3,700 Emp.
USA
Credential Stuffers
Thousands of Norton Password Manager accounts compromised via credential stuffing attacks. Not a system breach, but a result of reused passwords.
USA
Scattered Spider
Breach of customer support system via stolen credentials. Support case files (HAR files) containing session tokens were accessed.
Oracle
$50B | 160,000 Emp.
USA
Unknown
Millions of records potentially exposed; SSO passwords stolen.
Orange SA
$48B | 119,000 Emp.
France / Global
Warlock
4GB of business data was stolen via ransomware.
Pakistan FBR
Gov-Linked | 5,000 Emp.
Pakistan
Indian Cyber Force
IRIS tax portal hacked, exposing 150GB of data including CNICs, names, phones, addresses, and tax records for millions.
Pakistan Surveillance
Gov-Linked | N/A
Pakistan
Indian Cyber Force
Over 1,000 CCTV cameras in government facilities, banks, schools, and corporations hacked. Live feeds and archived footage accessed.
PANDORA Jewelry
€1.5B | 27,000 Emp.
Denmark / Global
Unknown
Third-party service hacked, exposing customer names, DOBs, and emails. No financial data.
PayPal
$27B | 29,000 Emp.
USA
Unknown
Credential stuffing attack successfully accessed 35,000 accounts. Personal data and transaction history exposed.
USA / Global
Unknown
Breach of media streaming service exposed emails, usernames, and hashed passwords for millions. Users urged to reset; no financial data compromised.
Pornhub (MindGeek)
Private | ~1,000 Emp.
Canada
ShinyHunters
201 million records including emails and locations were exposed via unauthorized access to Mixpanel analytics.
PowerSchool
$723M | 3,500 Emp.
USA
Unknown
Data of 62 million students and educators including SSNs and medical records was stolen via compromised credentials.
Prosper Marketplace
$500M | 1,000 Emp.
USA
Hiron
Database queries stole personal info: names, SSNs, income details for 13.1 million individuals. No account access.
Prudential Financial
$50B | 40,000 Emp.
USA
ALPHV / BlackCat
Breach affected 2.5 million people. The stolen data included driver’s license numbers and comprehensive insurance policy details.
Pure Storage
$3B | 5,000 Emp.
USA
UNC5537 (Snowflake)
Attackers accessed Snowflake workspace telemetry data and customer names, using the information to attempt targeted attacks against clients.
Qantas
$19B | 26,000 Emp.
Australia
Black Basta / Scattered Spider
Third-party breach released 6 million records including passport numbers and loyalty details.
Radiologic Medical Services
$50M | 300 Emp.
USA
Unknown
Breach compromised personal and health information of 56,902 individuals. Full scope under investigation.
Red Hat
$3.4B | 19,000 Emp.
Global
Crimson Collective
570GB from 28,000 repositories including API keys were stolen; affected clients like IBM and NSA.
Reddit
$800M | 2,000 Emp.
USA
BlackCat
Phishing attack on employee. 80GB of internal docs, code, and employee dashboards stolen. User passwords and accounts were safe.
Renesas Electronics
$10B | 22,000 Emp.
Japan
CoinbaseCartel
Internal files were compromised via ransomware.
USA
Credential Stuffers
Hackers accessed 591,000 active accounts and utilized stored credit cards to purchase streaming subscriptions and hardware.
Royal Mail
£12B | 150,000 Emp.
UK
LockBit
International export services paralyzed for weeks due to encryption. Attackers demanded £65m; negotiations leaked online.
Salesloft
$136M | 1,000 Emp.
USA
Scattered Lapsus$ Hunters
Customer data in Salesforce was stolen via linked breach; part of 1 billion records theft.
Samsung
$234B | 270,000 Emp.
South Korea
Lapsus$
190GB of data stolen, including source code for Galaxy device biometrics and bootloaders. No customer PII, but severe IP loss.
Santander Bank
€57B | 212,000 Emp.
Spain / Global
ShinyHunters (Snowflake)
Breach of a third-party database exposed info of 30 million customers in Chile, Spain, and Uruguay, plus all employees.
Sax LLP
Private | 300 Emp.
USA
Unknown
Unauthorized access exposed PII including names, SSNs, and financial info for 228,876 individuals.
Sepah Bank
$20B Assets | 20,000 Emp.
Iran
Predatory Sparrow
Customer records including accounts, passwords, phones, addresses, and transactions. State-linked disruption. 42 million customers affected.
SimonMed Imaging
$298M | 1,500 Emp.
USA
Medusa
Patient names, medical records, and IDs for 1.27 million were stolen via ransomware; data leaked after non-payment.
SitusAMC
$1.1B | 5,000 Emp.
USA
Unknown
Corporate and customer records including loan agreements were compromised; affected major banks like JPMorgan.
SK Telecom
$13.4B | 23,000 Emp.
South Korea
State-sponsored
SIM management data and keys were stolen via RAT malware on servers; 27 million users affected.
SonicWall
$1B | 1,200 Emp.
USA / Global
Unknown
Access to MySonicWall cloud backups exposed encrypted credentials and firewall configs for all users. No unencrypted data; global password resets mandated.
Japan
RansomedVC
Breach of testing environment server. 3.14GB of data leaked, mostly older build data and test logs.
Sotheby’s
$2B | 1,700 Emp.
Global
Unknown
Data breach exposed employee full names, SSNs, and financial account details. No customer data affected.
SoundCloud
$96M | 430 Emp.
Germany
Unknown
Email addresses and profiles for tens of millions were compromised via unauthorized dashboard access.
Spotify
$19B | 7,700 Emp.
Global
Pirate Group
Metadata for 256 million tracks was scraped via DRM bypass, raising concerns about AI model training misuse.
Global
Misconfiguration
Stalkerware app breach exposed iCloud credentials, device info, and activity logs for nearly 2 million individuals. Operations ceased amid scrutiny.
Stellantis
€190B | 250,000 Emp.
Global
ShinyHunters
Salesforce-linked breach exposed customer contacts. No financial data compromised.
TalkTalk
$1.8B | 1,700 Emp.
UK
b0nd
18.8 million customer names and IPs were exposed via third-party supplier system.
TD Bank
$45B | 95,000 Emp.
Canada / Global
Insider Threat
Names, accounts, and transactions were accessed and shared by a former employee.
Tea Dating App
Private | <100 Emp.
USA / Global
Unknown
Breach exposing 72,000 private verification photos and 1.1 million messages, including sensitive discussions.
TeaOnHer
Private | <50 Emp.
USA / Global
Unknown
Men's dating app breach exposed user emails, usernames, photo IDs, selfies, and admin credentials. Similar to Tea Dating; sensitive verification data leaked.
TeleMessage
Private | 100 Emp.
USA / Israel
Unknown
Plaintext credentials and user lists (many .gov) exposed. Government personnel data at risk.
Teslamate
Open-Source | N/A
Global
Exposure
Self-hosted dashboard instances (1,300+) left exposed, leaking vehicle locations and trip details. Widespread user misconfigurations reported.
The Co-op
$15B | 57,000 Emp.
UK
Hackers
6.5 million customer records were stolen via hack; caused IT outages and empty grocery shelves.
Ticketmaster (Live Nation)
$22B | 44,000 Emp.
Global
ShinyHunters (Snowflake)
Hackers accessed a Snowflake database and stolen details of 560 million customers. $500k ransom demanded.
T-Mobile
$80B | 71,000 Emp.
USA
API Exploit
API vulnerability allowed scraping of 37 million accounts. Data included billing addresses and birth dates.
Toyota
$270B | 370,000 Emp.
Japan
Misconfiguration
Cloud misconfiguration left vehicle location data of 2 million customers public for a decade. Discovered and patched in 2025.
Toys “R” Us Canada
$1B | 5,000 Emp.
Canada
Unknown
Customer data posted online: names, addresses, emails, phones.
TransUnion
$4.4B | 13,000 Emp.
USA
ShinyHunters
SSNs and credit data for 4.4 million were exposed via third-party application.
Trello (Atlassian)
$4B (Atlassian) | 11,000 Emp.
Global
Emo
Attacker utilized a publicly accessible API to scrape 15 million user records, connecting private emails to public names.
Troy Hunt’s Mailing List (HIBP)
N/A | N/A
Global
Phishing
MailChimp compromise exported subscriber list for Have I Been Pwned. Affected blog subscribers; increased spam/phishing risk.
Twitter (X)
Priv. | 1,500 Emp.
USA
Data Scraping
200 million user email addresses leaked on hacking forums. Data was scraped using an API flaw from previous years but released fully in 2025.
Global
Lapsus$
Full compromise of internal slack, AWS, and G-Suite via purchased contractor credentials.
Ubisoft
$2.7B | 20,000 Emp.
France / Global
Unknown
Internal systems were abused for account manipulation. Marketplace offline; transactions rolled back.
USA
Unknown
Personal data files were stolen via misappropriated key on server; extent under investigation.
Under Armour
$5.9B | 7,000 Emp.
USA / Global
Unknown
November breach via third-party vendor exposed customer emails, purchase histories, and fitness data for millions.
UNFI (United Natural Foods)
$30B | 30,000 Emp.
USA
Unknown
Supply chain disruption hit grocery ops (e.g., Whole Foods). Potential data exfiltration.
University of Pennsylvania
$20B Endowment | 20,000 Emp.
USA (PA)
Clop
Oracle EBS zero-day hit employee/financial data: names, SSNs, bank info for thousands (including 1,500 in Maine). Part of Clop campaign affecting 100+ orgs.
University of Phoenix
$1B | 5,000 Emp.
USA
Clop
Similar Oracle exploit exposed student/employee data: names, contacts, DOBs, SSNs. Linked to broader education sector hits.
Vastaamo
Private | 300 Emp.
Finland
Aleksanteri Kivimäki
Ongoing from 2020 breach; 2025 prosecution exposed mental health records for 9,000+ patients. Second suspect aided extortion; company bankrupt.
Verisure
€3B | 20,000 Emp.
Sweden / Global
Unknown
Unauthorized access to customer and employee info post-IPO.
Verizon
$134B | 105,000 Emp.
USA
Insider Threat
Employee database breach involving 63,000 employees. Insider inadvertently published sensitive file to internal share.
Vietnam Airlines
$4B | 20,000 Emp.
Vietnam
Mustang Panda
23 million customer records were uploaded to data-trading forums after hackers breached a technology partner.
Volkswagen Group
€280B | 670,000 Emp.
Germany / Global
Qilin / 8Base
Ransomware stole owner data, vehicle info, and internal docs (France division). Separate claims on invoices and contracts.
Volvo Group
$50B | 100,000 Emp.
Sweden
Akira / Datacarry
R&D data, vehicle telemetry source code, and employee SSNs were stolen via ransomware attack on HR vendor.
Washington Post
$550M | 2,500 Emp.
USA
Clop
180GB of employee archive data including SSNs and bank details stolen via Oracle EBS vulnerability.
Wealthsimple
$1B | 1,000 Emp.
Canada
Unknown
SINs, IDs, account numbers, and IPs exposed for <1% of clients.
Western Digital
$18B | 65,000 Emp.
USA
ALPHV
"My Cloud" service outage for 10 days. 10TB of data exfiltrated, including customer phone numbers and eCommerce database.
Western Sydney University
A$1B | 3,000 Emp.
Australia
Unknown
February SSO compromise exposed student demographics, enrollments, and academics for 10,000+. Separate dark web dump of sensitive data from 2024 access.
WestJet
$5B | 14,000 Emp.
Canada
Scattered Spider
Passenger data: names, DOBs, addresses, passports, loyalty info for 1.2 million individuals.
Williams & Connolly
Private | 300 Emp.
USA (DC)
China-Nexus
Attorney email accounts breached. No client data taken.
WK Kellogg
$2.6B | 3,300 Emp.
USA
Clop
Employee and vendor data including SSNs were stolen via file transfer exploit.
Workday
$8.7B | 20,400 Emp.
Global
ShinyHunters
Business contacts were compromised via vishing on third-party CRM systems; potentially tens of millions affected.
Yale New Haven Health
$6.5B | 29,000 Emp.
USA (CT)
Unknown
5.5 million individuals' PII and medical records were copied via ransomware. $18M settlement reached.
Yum! Brands
$6B | 36,000 Emp.
USA / UK
Ransomware
300 locations in the UK forced to close for a day due to IT outage. Employee data accessed.
USA
Unknown
Code repositories and potential customer data were accessed via a 2FA misconfiguration.