Incidents from
In late December 2025, a hacker claimed a cyberattack on ENSAI, France's national school of statistics near Rennes, and published roughly 21 GB of data exposing personal records of around 3,900 students, including ID photos and partial payment card details.
On 31 December 2024 the French Speleology Federation (FFS) disclosed a data leak from its insurance-subscription portal, exposing members' identity, contact details, nationality, profession and licence numbers as part of a wider wave of attacks on French sports federations.
In late December 2025, a data set on roughly 9,551 students of Institut Polytechnique de Paris (incl. ENSAE) was posted to a leak forum, exposing names, emails, postal addresses, phone numbers and about 4,179 IBANs.
On 29 December 2025, an actor calling themselves CZX leaked a 1.35 GB database of more than 400,000 Grenoble École de Management students, alumni and prospects on BreachForums, exposing names, contact details and academic records.
On 29 December 2025, a record of 7,244 Université de Lille students — reportedly from an IUT Informatique internship database — was posted on BreachForums by an actor using the LAPSUS$ name, exposing names, dates of birth, postal addresses, emails and phone numbers.
In December 2025, the dating website "for a Europid vision" WhiteDate suffered a data breach that was subsequently leaked online, initially exposing 6.1k unique email addresses. The leaked data included extensive personal information such as physical appearance, income, education and IQ.
On 28 December 2025, a database of 161,412 members of French at-home music-lesson provider Allegro Musique was leaked, exposing names, postal addresses, emails, phone numbers, social security numbers and registration details.
On 28 Dec 2025, French e-commerce retailer Batteriedeportable (Aubagne) disclosed a November cyberattack that exposed customer identity and contact data — names, dates of birth, postal/email addresses and phone numbers. It claims over a million European customers.
On 28 December 2025, a database of 205,403 B2B prospects from European business directory Europages was reported leaked, exposing contact and company-registration details (names, job titles, employers, postal and email addresses, phone numbers, SIRET and VAT identifiers).
In late December 2025, the LAPSUS$ Group claimed a breach of France's Ministry of Agriculture and Food, leaking roughly 60 GB (97,210 files) of FTP credentials, SQL databases and system logs spanning 32 departments and 19 business applications.
On 27 December 2025, data on roughly 200 members of Club de natation 95 was exposed after its service provider ACRV was compromised, leaking names, postal and email addresses, phone numbers and IP addresses.
In December 2025, the French operations of Italian energy group ENI suffered a data breach claimed by the Lapsus$ group, exposing professional contact details for tens of thousands of business customers; ENI confirmed the incident and notified the CNIL.
In late December 2025, French recruitment platform HelloWork disclosed that data on roughly 2.8 million jobseekers — names, emails and professional-profile details — was scraped from its CV library via a fraudulently used recruiter account and offered for sale online.
On 27 December 2025, French money-transfer fintech PayTrip suffered a data breach exposing data on 74,877 customers, including names, contact details, IBANs and account balances, later circulated online by a threat actor.
In late December 2025, the town hall of Lens (Pas-de-Calais, France) disclosed an intrusion into its information system that paralysed municipal services for about a week, blocking staff software and telephone lines; the attack vector was undisclosed and data theft was not confirmed.
In late December 2025, the French Kick Boxing Federation (FFKMDA) had its member database leaked on BreachForums, exposing 361,321 licensees' names, dates of birth, nationalities, contact details, postal addresses and licence records across 2015-2026 seasons.
In December 2025, French parcel-delivery firm Mondial Relay disclosed a cyberattack in which attackers accessed customer and shipment data — names, emails, postal addresses, phone numbers and parcel-tracking details; a dark-web actor claimed roughly 25.7 million records.
On 26 December 2025, a customer database from French online boutique Nouvelle Lune was leaked, exposing personal data for roughly 161 customers, including names, email and postal addresses, and order history.
Data on roughly 1.3 million members of the French Swimming Federation (FFN) was put up for sale on BreachForums on 23 December 2025 after its Extranat management platform was breached, exposing identity details, contact information and licence numbers.
On 22 December 2025, a database of roughly 240,000 users of French casting platform 123casting was published on BreachForums, exposing identities, contact details, MD5-hashed passwords, physical measurements, ethnic origin, photo/video books, private messages and payment data.
Altitude Infra, a major French independent fiber-optic infrastructure operator, had ~5.76 GB (52 files) stolen from a partner extranet and offered for sale online, exposing network documentation, ISP-partner files and end-customer eligibility data across its 3M+ connected locations.
On 22 December 2025 a database attributed to the French justice system (justice.fr) recirculated online, exposing personal, professional and banking data — including IBAN/BIC — of 1,100+ magistrates, judges, lawyers and judicial staff.
In December 2025, a 680 MB dataset on ~860,000 Chronopost customers — names, emails and parcel details scraped from the La Poste Pickup relay-point network — was published on BreachForums; the data covered shipments from spring 2025.
On 19 December 2025, a data leak at French anti-racism association La Licra (LICRA) exposed the email addresses and hashed passwords of 186 website subscribers and 8 administrators.
On 19 December 2025 France's Ministry of Sports confirmed a breach of a system tied to the Pass'Sport aid scheme, exposing data on about 3.5 million households — names, dates of birth, contact details, social security, INE and CAF numbers — published on a criminal forum.
In December 2025, French telecom operator SFR disclosed a data breach affecting Red by SFR customers, exposing names, postal and email addresses, phone numbers and customer reference numbers after an internal fiber-connection management tool was compromised.
On 17 December 2025, a leak of customer data from French parapharmacy retailer Parashop was disclosed, exposing personal records including full names, dates of birth and postal addresses.
In December 2025, data from France's Pass'Sport program was posted to a popular hacking forum. Initially misattributed to CAF (the French family allowance fund), the data contained 6.5M unique email addresses affecting 3.5M households.
In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum. In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.
On 16 December 2025, adult-content platform Pornhub disclosed that historical analytics data on select Premium users — including email addresses and search/viewing history — was stolen via third-party provider Mixpanel; ShinyHunters claimed ~200 million records and demanded a ransom.
In December 2025, music-streaming platform SoundCloud disclosed a breach in which an attacker abused an internal system to map roughly 29.8 million private email addresses to public profile data — about 20% of its users; no passwords or payment data were taken.
In December 2025, data allegedly breached from the Indian streaming music service "Raaga" was posted for sale to a popular hacking forum. The data contained 10M unique email addresses along with names, genders, ages (in some cases, full date of birth), postcodes and passwords stored as unsalted MD5…
In December 2025, attackers compromised professional email accounts at France's Ministry of the Interior and accessed sensitive police files including the TAJ criminal-records and FPR wanted-persons databases; the ministry confirmed a few dozen files were exfiltrated while attackers claimed data on 16.4 million people.
On 12 December 2025, customer data from French roller-shutter and home-automation retailer Euromatik was exposed in a breach, including names, postal and email addresses, phone numbers, order and contract details, and hashed passwords.
On 12 December 2025, France Ventilation, a French ventilation and air-treatment specialist, disclosed a data breach that exposed customers' payment card details — card number, expiration date and CVV — raising a direct risk of banking fraud.
On 10 December 2025, the Fédération Française de Cyclisme detected an intrusion (via stolen credentials/infostealers, no MFA) exposing licensees' names, dates of birth, nationality, postal addresses, emails and phone numbers; group Dumpsec also claimed to hold ID documents.
In December 2025, the EHPAD Résidence du Parc nursing home in Champdeniers-Saint-Denis (Deux-Sèvres, France), home to around 90 residents, was hit by a ransomware attack that encrypted files and dropped a $5 million ransom note; administrative data and possibly scanned ID documents were exposed.
On 10 December 2025, UFOLEP — the French multi-sport federation — disclosed that a compromised account on its third-party licence-management provider Exalto exposed at least 3,624 member records, including identity, contact and legal-guardian details.
In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed.
Members of insurer ASAF & AFPS had personal data exposed after a breach at Itelis, the optical-care network processing their claims; names, dates of birth, social security numbers, claim records and vision-correction data from 2020-2022 were affected.
In December 2025, French kitchen retailer Cuisinella (Schmidt Groupe) disclosed that an unauthorized third party accessed customer contact details — title, first name, last name, phone number and email address — for thousands of customers; no bank, address or password data was exposed.
In early December 2025, the French Handball Federation (FFHandball) disclosed that its GestHand administrative platform — used by some 2,400 clubs, committees and leagues — was breached via compromised credentials, exposing licensees' names, gender, dates of birth, emails and phone numbers.
In early December 2025, French kitchen and home-furnishing group Schmidt (brands Schmidt and Cuisinella) disclosed that an unauthorized third party had accessed the contact details of thousands of customers and prospects — title, name, first name, phone number and email address.
MédecinDirect, the French teleconsultation platform (a Teladoc Health subsidiary), disclosed on 3 December 2025 a data breach detected on 28 November exposing the personal and health data of around 285,000 patients, with a threat actor claiming up to 323,069 records.
In December 2025, French DIY retailer Leroy Merlin disclosed a cyberattack that exposed the loyalty-program data of several hundred thousand French customers, including names, contact details, postal addresses and dates of birth; no banking data or passwords were affected.
On 1 December 2025, France Travail and the Missions Locales network disclosed that an attacker who hijacked a local-mission agent's account accessed records of about 1.6 million young people, exposing names, dates of birth, social security numbers and contact details.
A former Coupang employee accessed personal data on 33.7 million customer accounts of South Korea's largest e-commerce platform. Coupang announced a $1.17 billion compensation plan; its head of Korean e-commerce resigned.
A threat actor exfiltrated around 387 GB of data (some 411,000 files) from French mortgage and credit broker La Centrale de Financement, exposing highly sensitive customer KYC documents, financial records and internal files, then offered the dataset for sale after failed extortion negotiations.
In late November 2025, the French Football Federation disclosed that attackers used a compromised account to access its Footclubs club-management software and exfiltrate licensees' personal data, including names, dates and places of birth, addresses, contact details and license numbers.
Personal data of 394 La Rochelle residents who booked civil-status appointments was exposed after an attacker exploited a flaw in Synbird, the town hall's third-party appointment-scheduling provider, which serves roughly 1,300 French communes.
Patient data held by the Givors Presqu'Île multidisciplinary health centre was exposed through the November 2025 cyberattack on its medical-software provider Weda, including identity, contact details and sensitive health data.
Disclosed in November 2025, a cyberattack on Itelis — the optical-care third-party network used by insurer AG2R la Mondiale — exposed beneficiaries' names, dates of birth, social security numbers, reimbursement records and vision-correction data for optical coverage handled between 2020 and early 2022.
Clinique du Millénaire in Montpellier was exposed when its medical-records software vendor Weda was breached in November 2025, putting patient identity, contact details and health data at risk among the millions of records handled across Weda's ~23,000 affected practitioners.
In November 2025, the French Dance Federation (FFDanse) suffered a cyberattack on its extranet that damaged the server and exposed licence-holders' personal data, including names, dates of birth, contact details, licence numbers and hashed passwords; no medical or banking data was affected.
In November 2025, Itelis — a French optical health-care network linked to AXA — disclosed a breach exposing roughly 1.6 million beneficiaries' identity and optical-reimbursement data, including names, dates of birth and social security numbers.
MSP du Pré Vicinal, a French multidisciplinary health centre, had patient data exposed via the November 2025 cyberattack on its medical-software provider Weda, including names, postal and email addresses, phone numbers and health data.
On 25 November 2025, a database belonging to French residential maintenance firm ProxiServe surfaced on a hacker forum, exposing personal and service data on 294,639 customers, including names, emails, postal addresses and details of home interventions.
APRS members were exposed in the November 2025 breach of Itelis, AXA's third-party optical-care platform, after an attacker posed as a partner optician; leaked data included names, dates of birth, social security numbers, optical reimbursement records and vision-correction details.
Personal data of residents who booked identity-document appointments through the RDV360 platform was exposed when the third-party provider was breached in late 2025, affecting Chatou town hall among roughly 1,300 French municipalities.
In November 2025, the city of Quimper (France) was caught in a supply-chain breach of appointment-booking provider RDV360, exposing roughly 12,000 contact records (name, postal code, email, phone) of residents who booked ID-card or passport renewals since April 2024.
Saint-Aubin d'Aubigné town hall disclosed on 24 November 2025 that residents' contact details were exposed through its appointment-booking provider RDV360, one of ~1,300 French municipalities hit in a third-party breach of ID/passport booking data.
In November 2025, optical-care platform Itelis was breached via the impersonation of a partner optician, exposing health and identity data of Malakoff Humanis (and AXA) members from optical reimbursement claims processed between 2020 and 2022.
In November 2025, French parcel-delivery firm Colis Privé disclosed unauthorized access to part of its systems that exposed customer contact data — names, postal and email addresses and phone numbers. A threat actor advertised a dataset reportedly running to tens of millions of rows; no passwords or banking data were affected.
In November 2025, the Cl0p extortion gang listed French tyre maker Michelin on its leak site, claiming to have stolen internal manufacturing, engineering, supply-chain, financial and HR files via the Oracle E-Business Suite zero-day (CVE-2025-61882).
In November 2025, French home-appliance repair and refurbishment company Murfy disclosed a data breach exposing the personal data of around 294,000 customers — names, email and postal addresses, phone numbers and service-history details — but no banking data or passwords.
Suzuki France disclosed that a cyberattack on one of its third-party partner systems exposed a customer file containing names, email addresses, postal addresses and phone numbers; no financial data or passwords were affected.
On 19 Nov 2025, Alfortville town hall notified residents that their contact details were exposed in a breach of its appointment-booking provider RDV360, part of a supply-chain attack hitting ~1,300 French municipalities and ~14M records.
On 18 November 2025, users of Resana — France's interministerial collaborative platform run by DINUM — were notified of a data exfiltration after attackers logged in with a compromised account. Up to roughly one million public agents were potentially exposed, triggering ransom emails to civil servants.
In November 2025, Synbird — the SaaS provider handling municipal appointment bookings for around 1,300 French communes — disclosed a breach in which an attacker abused a weakly-secured PDF export to exfiltrate residents' contact details and appointment information.
In November 2025, Dutch fibre-network operator Eurofiber's French unit was breached via an SQL-injection flaw in its outdated GLPI ticketing system, exposing technical and credential data tied to more than 3,600 customer organisations, including major firms and public bodies.
Around 50,000 residents who booked ID-card or passport appointments in Brest had personal contact details exposed after a supply-chain breach of the RDV360 appointment-booking platform used by the town hall.
In November 2025, Pajemploi — the Urssaf service used by French households to declare and pay childcare workers — disclosed a data theft affecting up to 1.2 million employees, exposing names, social security numbers, dates/places of birth, postal addresses and Pajemploi/accreditation numbers.
In November 2025, the Everest ransomware group claimed to have stolen 343GB of data from apparel maker Under Armour. After no ransom was paid, customer data was leaked in January 2026, exposing roughly 72.7 million unique email addresses with names, dates of birth, genders, locations and purchase histories. This is a separate incident from the 2018 MyFitnessPal breach.
In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online. The following month, a further corpus of data was released bringing the total to 103k.
Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in…
On 12 November 2025, French medical-software publisher Weda disclosed a cyberattack in which compromised practitioner credentials (stolen by infostealer malware) gave attackers unauthorized access to its patient-record platform, potentially exposing sensitive medical data for tens of thousands of healthcare professionals.
Around 11 November 2025, the Fédération Française de Cardiologie disclosed that an unauthorized intrusion into its IT systems exposed members' personal data — including names, postal and email addresses, phone numbers and passwords. No banking or medical data was compromised.
In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records. The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country.
On 10 November 2025, French web-hosting and VPS provider OuiHeberg was reported to have leaked customer contact records — names, email addresses, phone numbers and postal addresses — following a security incident affecting its infrastructure.
In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly.
In November 2025, a database of around 5 million records from French adult-content subscription platform MYM was published on a cybercrime forum, exposing creators' and subscribers' names, emails, postal addresses, phone numbers, IP addresses, birthdates and MD5-hashed passwords; the data traces back to a 2021 compromise.
In November 2025, data breached from the Zilvia.net Nissan 240SX Silvia and Z Fairlady car forum was leaked. The breach exposed 288k unique email addresses along with usernames, IP addresses and salted MD5 password hashes sourced from the vBulletin based platform.
In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand, largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims.
In late October 2025, France Travail — France's public employment agency — disclosed a breach in which attackers used credentials harvested by infostealer malware to access job-seeker accounts and exfiltrate sensitive personal, identity and financial data; about 16,479 affected records were catalogued.
On 27 October 2025, Italian sofa and furniture retailer Poltronesofà suffered a ransomware attack that encrypted its servers and exposed personal data of thousands of customers, including names, postal addresses, emails, phone numbers and tax identification numbers; no banking data was affected.
In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum. Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos.
An intrusion into the French Shooting Federation's ITAC information system between 18-20 October 2025 exposed personal data of its licensees — including licence numbers, civil status and contact details — with up to around 274,000 members potentially affected.
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as…
A September 2025 cyberattack on regional health-identity platforms used by several French Regional Health Agencies (ARS) exposed patient identity data; an attacker claimed roughly 35 million patient records across 130+ public hospitals, later offered for sale by the DumpSec group.
On 19 October 2025, the Centre Hospitalier Intercommunal de Haute-Comté in Pontarlier (France) was hit by a Cryptolocker ransomware attack that encrypted part of its data, forcing a full IT shutdown and a return to paper-based care; attackers demanded a 5 million euro ransom.
In October 2025, Spanish fashion retailer Mango disclosed that an external marketing service provider was breached, exposing customers' first name, country, postal code, email address and phone number; no passwords or banking data were affected.
A cyberattack on the shared regional health platform (Prédice/GIP Inéa) hosting patient identity data from public hospitals in Hauts-de-France exposed records such as names, dates and places of birth, contact details and, in some cases, social security numbers; medical records were not affected.
Ransomware group Qilin attacked the IT systems of public high schools run by France's Hauts-de-France region in October 2025, paralysing some 80% of around 269 schools and claiming over 1 TB of stolen data including students' ID documents, CVs and academic transcripts.
On 6 October 2025, France Travail — France's national public employment agency — was hit by one of several 2025 data leaks, with personal records of roughly 5,500 job seekers exposed, including names, France Travail IDs, registration categories, email addresses, RSA welfare status and CIR identifiers.
In late October 2025, data breached from the Hungarian political party TISZA was published online before being extensively redistributed. Stemming from a compromise of the TISZA Világ service earlier in the month, the breach exposed 200k records of personal data including email addresses along with…
On 4 October 2025 Discord disclosed a breach of a third-party customer-support provider that exposed support-ticket data and roughly 70,000 government-ID photos (submitted for age-verification appeals), plus names, emails, IP addresses and partial billing details.
In October 2025, retailer Canadian Tire was the victim of a data breach that exposed almost 42M records. The data contained 38M unique email addresses along with names, phone numbers and physical addresses.
Qilin ransomware operators encrypted servers across Asahi's Japanese data centres, halting ordering, shipment, and production at 30 factories, leaking 27 GB of internal data, and exposing personal information of approximately 1.5 million customers, employees, and contacts.
On 25 September 2025, a leak attributed to France Travail, France's public employment agency, exposed the personal data of about 9,971 job seekers, including their email addresses, names and the email address of their assigned advisor.
In September 2025, French ethical cooperative bank La Nef notified shareholders that their email addresses were exposed after a cyberattack on third-party voting provider SLIB; only email addresses were affected, with no banking data, IDs or passwords compromised.
On 23 September 2025, French medical-lab group Inovie Labosud disclosed a breach exposing administrative and medical data of an estimated 3.2 million patients after attackers used a third-party provider's stolen credentials.
In September 2025, EV-charging billing provider Digital Charging Solutions disclosed that a contracted third-party service provider had accessed customer records without authorization, exposing names and email addresses of an initial single-digit number of affected users.
On 19 September 2025, the French Table Tennis Federation (FFTT) disclosed a data breach in which an attacker used a compromised account to bulk-extract member records, exposing the personal data of as many as 254,000 licensees, though no banking or health data.
French luxury skincare group Clarins confirmed in September 2025 that the Everest extortion gang had exfiltrated contact details of customers in France, the US and Canada; the actor claimed over 600,000 records, with no financial data affected.
On 9 September 2025, media-streaming software company Plex disclosed that an unauthorized third party had accessed one of its databases, exposing user emails, usernames, securely hashed passwords and authentication data, and forcing an account-wide password reset.
In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online. The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number,…
On 3 September 2025, a data leak was claimed affecting Eklo, a French budget and eco-friendly hotel chain. Details on the volume and exact categories of exposed customer data remain unverified.
In September 2025, a database of 117,963 Syma Mobile customers — exposing names, dates of birth, postal and email addresses, phone numbers and ID-document details — was put up for sale on a dark-web forum alongside other French datasets.
In September 2025, Prosper announced that it had detected unauthorised access to their systems, which resulted in the exposure of customer and applicant information. The data breach impacted 17.6M unique email addresses, along with other customer information, including US Social Security numbers.
In August 2025, the "marketplace that connects artists to prospective clients" Artists&Clients, suffered a data breach and subsequent ransom demand of US$50k.
A cyberattack on Britain's biggest carmaker forced JLR to shut down its global IT network and halted vehicle production in the UK, China, Slovakia, India, and Brazil for five weeks — now considered the most economically damaging cyber incident in UK history.
In August 2025, the Swedish system supplier Miljödata was the victim of a ransomware attack. Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files.
In August 2025, French retailer Auchan disclosed a breach exposing personal data of several hundred thousand Waaoh loyalty-program customers — names, titles, postal and email addresses, phone numbers and loyalty card numbers; bank data and PINs were not affected.
On 28 July 2025, French web host FranceLink was hit by the Akira ransomware group, which encrypted about 93% of its servers and threatened to leak roughly 20GB of exfiltrated customer data.
In August 2025, Google confirmed that a Salesforce CRM instance holding contact data for small-business Google Ads prospects was breached by ShinyHunters (UNC6040) via a vishing attack, exposing roughly 2.55 million records of business names, emails and phone numbers.
On 13 August 2025, Partner Immo, a French provider of online property- and condominium-management software, was reported as the target of a ransomware/data-leak incident; the exact scope and exposed data were not publicly confirmed.
In August 2025, French online cycling and sports retailer Alltricks had its Sendinblue/Brevo email-marketing system compromised; attackers sent customers convincing phishing emails from the brand's own infrastructure, exposing names, email addresses and purchase history.
On 12 August 2025, France Travail, France's public employment agency, disclosed unauthorized access to its employer-facing job portal that exposed the contact details of business users — names, email addresses, phone numbers and an internal technical identifier.
In October 2025, a reincarnation of the hacking forum BreachForums, which had previously been shut down multiple times, was taken offline by a coalition of law enforcement agencies.
In August 2025, over 1M unique email addresses appeared in a breach allegedly obtained from Italian fashion designer Giglio. The data also included names, phone numbers and physical addresses. Giglio did not respond to repeated attempts to disclose the incident.
In early August 2025, French optician chain Optic 2000 was hit by a cyberattack — confirmed on 30 July 2025 and affecting four stores around Paris — that exposed customer records including names, social security numbers, dates of birth, postal addresses, phone numbers and optician details.
In August 2025, Air France-KLM disclosed that attackers accessed customer data — names, contact details, Flying Blue loyalty numbers and status, and customer-service request subjects — via a compromised third-party customer-service platform.
On 6 August 2025, French telecom operator Bouygues Telecom disclosed a cyberattack that exposed personal data of 6.4 million customer accounts, including contact details, contractual data, civil status and IBANs (no card numbers or passwords).
In August 2025, Danish jewelry maker Pandora disclosed a breach of a third-party CRM platform (Salesforce) in which attackers stole customer contact data — names, email addresses and birth dates — while stating no passwords or payment data were taken.
In July 2025, a vulnerability in the GiveWP WordPress plugin exposed the names and email addresses of approximately 30k donors to the Pi-hole network-wide ad blocking project. Pi-hole subsequently self-submitted the list of impacted donors to HIBP.
On 26 July 2025, a database attributed to France's Céreq (Centre d'études et de recherches sur les qualifications) holding records on 210,607 people — surnames, first names, email addresses and phone numbers — was posted on the BreachForums leak forum.
In July 2025, the sexual healthcare product maker Hello Cake suffered a data breach. The data was subsequently posted on a public hacking forum and included 23k unique email addresses along with names, phone numbers, physical addresses, dates of birth and purchases.
On 25 July 2025, French telecom group Orange detected unauthorized access to one of its information systems; the Warlock ransomware group later claimed the attack and published about 4 GB of data, which Orange described as outdated or low-sensitivity.
France Travail disclosed on 22 July 2025 that an intrusion via its Kairos platform exposed the personal data of around 340,000 job seekers, including names, postal and email addresses, phone numbers, France Travail IDs and jobseeker status; passwords and bank details were not affected.
The DragonForce ransomware group claimed a July 2025 attack on French dry-cleaning chain 5àSec, exfiltrating roughly 290 GB of data — SQL production and test databases spanning the group's France, Switzerland, Luxembourg, Spain and Portugal operations — and published it after the company declined to pay.
In July 2025, Allianz Life was the victim of a cyber attack which resulted in millions of records later being leaked online. Allianz attributed the attack to "a social engineering technique" which targeted data on Salesforce and resulted in the exposure of 1.1M unique email addresses, names,…
In July 2025, France's CNFPT — the national training body for local-government staff — disclosed a targeted intrusion into its trainers' portal that exposed personal files of about 34,000 external instructors, including ID documents, bank details (RIB), contracts, diplomas and CVs.
In July 2025, French luxury brand Louis Vuitton disclosed that an unauthorized third party had accessed customer data — names, contact details, postal addresses, dates of birth and purchase history — as part of a global breach affecting clients in France, South Korea and other markets; no payment data was exposed.
In mid-2025, Sorbonne Université (Paris) suffered a breach of its HR/payroll system that exposed personal data of roughly 32,000 current and former staff, including contact details, identity information and family members' names.
Around 7.8 million profiles of current and former members of France's school sports federation UNSS were scraped from its OPUSS intranet by two teenagers using stolen credentials, exposing names, dates of birth, schools, contact details and more.
In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly. The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card…
A junior developer at C&M Software — a Central Bank-authorized provider of Pix instant-payment connectivity — was paid roughly R$5,000 to hand over credentials. Attackers used the access to drain approximately R$800 million ($148 million) from reserve accounts at six Brazilian financial institutions in 2.5 hours.
In June 2025, 107k unique customer email addresses were allegedly obtained from TheSqua.re, the "easiest way to find your next serviced apartment". The data also included names, phone numbers and cities which were subsequently posted to a popular hacking forum.
In June 2025, MaReads, the website for readers and writers of Thai-language fiction and comics suffered a data breach that exposed 74k records. The breach included usernames, email addresses, phone numbers and dates of birth. MaReads is aware of the breach.
In June 2025, the Anubis ransomware gang claimed a 64GB leak of ~39,000 confidential files from Disneyland Paris — engineering plans and behind-the-scenes photos/videos of park attractions — said to be stolen via a compromised third-party contractor.
A cyberattack on Hôpital privé de la Loire (Ramsay Santé) in Saint-Étienne, France exposed personal data of up to 530,000 patients, including identity details, social-security numbers (NIR), ID documents and consultation records, after a hacker used stolen physician credentials.
In June 2025, headlines erupted over a "16 billion password" breach. In reality, the dataset was a compilation of publicly accessible stealer logs, mostly repurposed from older leaks, with only a small portion of genuinely new material.
In October 2025, data stolen from the Salesforce instances of multiple companies by a hacking group calling itself "Scattered LAPSUS$ Hunters" was publicly released.
CNPC USA was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-16.
Jasper Products was named on the Play ransomware data-leak (extortion) site on 2025-06-16.
NF Stroth & Associates was named on the Play ransomware data-leak (extortion) site on 2025-06-16.
TBN Israel Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-16.
Israel’s fuel supply system Data was named on the Handala ransomware data-leak (extortion) site on 2025-06-15.
S&H Express was named on the Play ransomware data-leak (extortion) site on 2025-06-15.
099 ISP Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Aerodreams Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Israel’s fuel supply system Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Israel’s fuel supply system Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
NPD Products was named on the Play ransomware data-leak (extortion) site on 2025-06-14.
Project Partners was named on the Play ransomware data-leak (extortion) site on 2025-06-14.
Rollex was named on the Play ransomware data-leak (extortion) site on 2025-06-14.
Y.G. New Idan Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Ajmanre.gov.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-06-12.
alleray-labrouste was named on the Incransom ransomware data-leak (extortion) site on 2025-06-12.
AP Lettering was named on the Spacebears ransomware data-leak (extortion) site on 2025-06-11.
Mount Rogers Community Services was named on the Incransom ransomware data-leak (extortion) site on 2025-06-10.
In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records. The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system.
Community Choice Credit Union was named on the Play ransomware data-leak (extortion) site on 2025-06-09.
EUC Sjlland was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-06-09.
Homestead Gardens was named on the Play ransomware data-leak (extortion) site on 2025-06-09.
In June 2025, the Indian CME platform Omnicuris suffered a data breach that exposed approximately 200k records of healthcare professionals. The data included names, email addresses, phone numbers, geographic locations and other data attributes relating to professional expertise and training…
Hudson River Housing was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-07.
waiwhetu-medical-centre was named on the Incransom ransomware data-leak (extortion) site on 2025-06-07.
Kittery Police Department was named on the Incransom ransomware data-leak (extortion) site on 2025-06-06.
MTTEXPERTISES.COM was named on the Incransom ransomware data-leak (extortion) site on 2025-06-06.
Nunez Dental was named on the Incransom ransomware data-leak (extortion) site on 2025-06-06.
A*****e.gov.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-06-05.
Ebac was named on the Play ransomware data-leak (extortion) site on 2025-06-05.
iscamen was named on the Incransom ransomware data-leak (extortion) site on 2025-06-05.
Lts.com.vn was named on the Flocker ransomware data-leak (extortion) site on 2025-06-05.
Triumph Construction was named on the Play ransomware data-leak (extortion) site on 2025-06-05.
cemeteries.local was named on the Incransom ransomware data-leak (extortion) site on 2025-06-04.
Funktel GmbH was named on the Incransom ransomware data-leak (extortion) site on 2025-06-04.
https://devimco.com/ was named on the Metaencryptor ransomware data-leak (extortion) site on 2025-06-04.
In June 2025, luxury jeweller Cartier (Richemont) disclosed a data breach in which attackers accessed customer records — names, email addresses and country of residence — though no passwords, payment or banking data were exposed.
FLOE Internationa was named on the Play ransomware data-leak (extortion) site on 2025-06-03.
Jericho Fire Department was named on the Kairos ransomware data-leak (extortion) site on 2025-06-03.
On 3 June 2025, a customer database belonging to Kaviari, the Paris-based luxury caviar and premium seafood house, was reported leaked, exposing shoppers' names, contact details, dates of birth, account credentials and order histories.
Rochon was named on the Play ransomware data-leak (extortion) site on 2025-06-03.
Sandhills Medical Foundation was named on the Incransom ransomware data-leak (extortion) site on 2025-06-03.
Sorter Construction was named on the Play ransomware data-leak (extortion) site on 2025-06-03.
Weeks after the CNSS breach, the hacktivist Jabaroot leaked roughly 4 terabytes of data — millions of property certificates, title deeds, ID cards, passports, and banking documents — from Morocco's national land conservation agency ANCFCC.
Capital Trade was named on the Play ransomware data-leak (extortion) site on 2025-06-02.
http://www.kcac.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-06-02.
Universidad Técnica del Norte Ecuador was named on the Incransom ransomware data-leak (extortion) site on 2025-06-02.
valuestoreit was named on the Incransom ransomware data-leak (extortion) site on 2025-06-02.
Vinda Group was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-06-02.
Dcsdev.org was named on the Flocker ransomware data-leak (extortion) site on 2025-06-01.
sitro.com.au was named on the Incransom ransomware data-leak (extortion) site on 2025-05-31.
Trustgrp.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-05-31.
Acorn Sales was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-30.
Anchor Industries was named on the Play ransomware data-leak (extortion) site on 2025-05-30.
geruestba was named on the LockBit ransomware data-leak (extortion) site on 2025-05-30.
Jordan Drug was named on the Incransom ransomware data-leak (extortion) site on 2025-05-30.
M&H Electric Fabricators was named on the Embargo ransomware data-leak (extortion) site on 2025-05-30.
mysfa.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-30.
STANDBYTE was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-30.
Tri-Point Solutions was named on the Play ransomware data-leak (extortion) site on 2025-05-30.
UnigazJordan was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-05-30.
W.E. Bowers was named on the Play ransomware data-leak (extortion) site on 2025-05-30.
http://metromont.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-05-29.
http://www.innsofaurora.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-05-29.
Mulia Raya was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-05-29.
Cator Ruma & Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-28.
The Czech government publicly attributed a years-long cyber-espionage campaign against an unclassified network of its Ministry of Foreign Affairs to APT31, a group linked to China's Ministry of State Security. The intrusion, active since at least 2022, targeted designated critical national infrastructure.
Eliel Cycling was named on the Play ransomware data-leak (extortion) site on 2025-05-28.
Fujipoly Ltd was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-28.
KDV Label was named on the Play ransomware data-leak (extortion) site on 2025-05-28.
l*s.com.vn was named on the Flocker ransomware data-leak (extortion) site on 2025-05-28.
Corantioquia was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-27.
Eight8Ate Holdings, Inc was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-27.
http://www.iptelecom.at was named on the Ciphbit ransomware data-leak (extortion) site on 2025-05-27.
WAT Supplies was named on the Play ransomware data-leak (extortion) site on 2025-05-27.
Wrap & Send Services was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-27.
allstarflooring.com was named on the Embargo ransomware data-leak (extortion) site on 2025-05-26.
Antea Luce was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-26.
Autosur, a major French vehicle-inspection network, suffered a data breach exposing personal and vehicle records of millions of customers — names, emails, postal addresses, phone numbers, license plates and vehicle details — advertised for sale on a cybercrime forum.
Carrera Chevrolet was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-26.
Frederick's Machine & Tool Shop was named on the Play ransomware data-leak (extortion) site on 2025-05-26.
Media Links was named on the Play ransomware data-leak (extortion) site on 2025-05-26.
D****v.org was named on the Flocker ransomware data-leak (extortion) site on 2025-05-25.
oxparkrec.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-25.
Seneca Gaming & Entertainment was named on the Nitrogen ransomware data-leak (extortion) site on 2025-05-25.
In May 2025, hosting provider ColoCrossing identified a data breach that impacted customers of their ColoCloud virtual server product. ColoCrossing advised the incident was isolated to their cloud/VPS platform and stemmed from a single sign-on vulnerability.
Coweta County School System was named on the Nitrogen ransomware data-leak (extortion) site on 2025-05-24.
T******p.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-05-24.
Vernon Milling was named on the Play ransomware data-leak (extortion) site on 2025-05-24.
AKJ Energiteknik was named on the Play ransomware data-leak (extortion) site on 2025-05-23.
In May 2025, a coalition of law enforcement agencies took down the criminal infrastructure behind the malware used to launch ransomware attacks in a new phase of "Operation Endgame".
South Atlantic Federal Credit Union was named on the Play ransomware data-leak (extortion) site on 2025-05-23.
4Motive was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-22.
CNHI LLC was named on the Play ransomware data-leak (extortion) site on 2025-05-22.
Curewell Pharmacy & Surgicals was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-22.
Greater Seattle Concrete was named on the Play ransomware data-leak (extortion) site on 2025-05-22.
piercecountylibrary.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-22.
AttainX was named on the Play ransomware data-leak (extortion) site on 2025-05-21.
Neighborhood Development Services was named on the Kairos ransomware data-leak (extortion) site on 2025-05-21.
Rivers Academy West London was named on the Incransom ransomware data-leak (extortion) site on 2025-05-21.
Durham Arts Council was named on the Kairos ransomware data-leak (extortion) site on 2025-05-20.
Florida Lung was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-20.
Runtec was named on the Lynx ransomware data-leak (extortion) site on 2025-05-20.
The Vascular Experts was named on the Incransom ransomware data-leak (extortion) site on 2025-05-20.
Tri State Electric was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-20.
K & K Fence was named on the Play ransomware data-leak (extortion) site on 2025-05-19.
Colegio de la Compania de Maria Vigo was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Fong Shann Printing Philippines was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Grupo Boulevard was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
null was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-18.
RECI SYSTEMS was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Road Development Corporation was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Termolar was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-18.
diyar.com was named on the Lynx ransomware data-leak (extortion) site on 2025-05-17.
Gearhiser Peters Elliott & Cannon was named on the Lynx ransomware data-leak (extortion) site on 2025-05-17.
Maruichi Leavitt Pipe & Tube was named on the Lynx ransomware data-leak (extortion) site on 2025-05-17.
nissi-beach.com was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
npfy.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
ros.eu was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
www.davisdavisco.com was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
alpha-steuer.de was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
Carney Badley Spellman was named on the Play ransomware data-leak (extortion) site on 2025-05-16.
ccrcda.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
finanzconsult-immobilien.de was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
south african airways (flysaa.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
Triple Jump was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-16.
[DISCLOSED]OeTTINGER Brauerei was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-15.
GARDNER ORTHOPEDICS was named on the Incransom ransomware data-leak (extortion) site on 2025-05-15.
http://www.gloucesterva.gov was named on the BlackSuit ransomware data-leak (extortion) site on 2025-05-15.
Grafton Technologies was named on the Play ransomware data-leak (extortion) site on 2025-05-14.
Kingsmen Creatives Ltd. was named on the Embargo ransomware data-leak (extortion) site on 2025-05-14.
Redirecting... was named on the Hellcat ransomware data-leak (extortion) site on 2025-05-14.
Regal Ideas was named on the Play ransomware data-leak (extortion) site on 2025-05-14.
Royal Chemical was named on the Lynx ransomware data-leak (extortion) site on 2025-05-14.
Sao Camilo Cachoeiro de Itapemirim was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-14.
architekturbuero-heller.de was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-13.
On 13 May 2025, luxury fashion house Christian Dior Couture (LVMH) began notifying customers — first in Asia — that an intrusion discovered on 7 May exposed names, contact details, purchase histories and marketing preferences; no bank or payment-card data was affected.
Dishaka was named on the Play ransomware data-leak (extortion) site on 2025-05-13.
First Choice Courier & Messenger was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-13.
Looper Goodwine was named on the Kairos ransomware data-leak (extortion) site on 2025-05-13.
Nedved Architekti was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-13.
Operative was named on the Play ransomware data-leak (extortion) site on 2025-05-13.
Overhead Door of Nova Scotia was named on the Play ransomware data-leak (extortion) site on 2025-05-13.
Patient data managed by Pulsy, the regional e-health operator (GRADeS) for France's Grand Est region, was reported leaked on 13 May 2025, exposing identity details, contacts and sensitive health information including care pathways and hospitalisation records.
thaonlesvosges.fr was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-13.
www.colemanmaterials.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-13.
altara.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
atlplasticsurgeon.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
EIZO Rugged Solutions was named on the Play ransomware data-leak (extortion) site on 2025-05-12.
iacc.holdings was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
industrialdynamics.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
jtalleycorp.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
Just Concrete & Masonry was named on the Play ransomware data-leak (extortion) site on 2025-05-12.
net-move.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
southernavionics.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
www.condista.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
www.dermatologysolutions.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
www.philsmithauto.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
dac-law.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
kraftkisarna.se was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
millercaggiano.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
ossman.co.uk was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
pratthomes.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
pryor-morrow.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
stitaly.it was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.harrissteelco.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.irisid.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.precisiontextiles-usa.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.setpointsystems.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.texlaenergy.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
American Eagle Logistics - Full Leak was named on the Monti ransomware data-leak (extortion) site on 2025-05-10.
citrusmagic.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-10.
statesmanbiz.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-10.
Verrex was named on the Play ransomware data-leak (extortion) site on 2025-05-10.
www.cityofgroveok.gov was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-10.
EMX Enterprises was named on the Play ransomware data-leak (extortion) site on 2025-05-09.
Gistic Research was named on the Play ransomware data-leak (extortion) site on 2025-05-09.
hennessyfunds.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-09.
Mountain View Mushrooms was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-09.
Sweet Shop USA was named on the Play ransomware data-leak (extortion) site on 2025-05-09.
UniTrak was named on the Play ransomware data-leak (extortion) site on 2025-05-08.
vzlom7may.omg was named on the LockBit ransomware data-leak (extortion) site on 2025-05-08.
Amtech Software was named on the Monti ransomware data-leak (extortion) site on 2025-05-07.
GPF Lewis was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-07.
LGM was named on the Termite ransomware data-leak (extortion) site on 2025-05-07.
Sioux Chief was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-07.
Transport Lutztulln was named on the Orca ransomware data-leak (extortion) site on 2025-05-07.
Breen Construction Services was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Commune de Jemeppe-sur-Sambre was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-06.
Downtown Travel was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
ehlers-inc.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-06.
Marine Technical Surveyors was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Mediprobe Research was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-06.
Novosit was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Rand Technology was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Sugar Lake Lodge was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Technical Die-Casting was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Trybus was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
In May 2025, the South American mobility services platform Ualabee had hundreds of thousands of records scraped from an interface on their platform. The data included 472k unique email addresses along with names, profile photos, dates of birth and phone numbers.
Webcor was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Alberta Construction Safety Association was named on the Play ransomware data-leak (extortion) site on 2025-05-05.
ATI Systems was named on the Play ransomware data-leak (extortion) site on 2025-05-05.
Hire Velocity (lan.hirevelocity.com) was named on the Lynx ransomware data-leak (extortion) site on 2025-05-05.
OeTTINGER Brauerei was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-05.
pbw- was named on the LockBit ransomware data-leak (extortion) site on 2025-05-05.
CabinC.com was named on the Lynx ransomware data-leak (extortion) site on 2025-05-04.
soundtransit.org was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-04.
valedolobo.com was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-04.
American Eagle Logistics - Press Release was named on the Monti ransomware data-leak (extortion) site on 2025-05-03.
ddecor.com was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
edisoft.es was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
iycsa.com.co was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
Kalin Hobeltechnik was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-03.
ruizre.es was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
arc-com.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-02.
derichsukonertz.de was named on the Lynx ransomware data-leak (extortion) site on 2025-05-02.
[DISCLOSED]Imedexsa was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-02.
ECOM America was named on the Play ransomware data-leak (extortion) site on 2025-05-02.
Government of Peru was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-02.
kll-law.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-02.
pdcm.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-02.
runtec.co.jp was named on the Lynx ransomware data-leak (extortion) site on 2025-05-02.
Southern Fidelity was named on the Play ransomware data-leak (extortion) site on 2025-05-02.
The Seydel Companies was named on the Play ransomware data-leak (extortion) site on 2025-05-02.
In May 2025, 160k records of customer data was allegedly obtained from Creams Cafe, "the UK's favourite dessert parlour". The data included email and physical addresses, names and phone numbers.
Custom Paper was named on the Play ransomware data-leak (extortion) site on 2025-05-01.
Defected Records was named on the Play ransomware data-leak (extortion) site on 2025-05-01.
maywdef was named on the Lynx ransomware data-leak (extortion) site on 2025-05-01.
StudioVaiani was named on the Incransom ransomware data-leak (extortion) site on 2025-05-01.
The Saint James Hospital Group was named on the Incransom ransomware data-leak (extortion) site on 2025-05-01.
WDEF-TV was named on the Lynx ransomware data-leak (extortion) site on 2025-05-01.
Coop UQAM was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-30.
Digestive Specialists was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-30.
FCC was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-30.
Gorham Sand & Gravel was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
Missouri Pipe Fittings was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
National Steel City was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
Penn Emblem (penn.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-04-30.
PermaCold Engineering was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
southernagllc.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-30.
Telco Intercontinental was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-30.
Ushio was named on the Termite ransomware data-leak (extortion) site on 2025-04-30.
BOLL Logistik was named on the Play ransomware data-leak (extortion) site on 2025-04-29.
Cooper Global Chauffeured was named on the Play ransomware data-leak (extortion) site on 2025-04-29.
David Mills CPA, LLC was named on the Lynx ransomware data-leak (extortion) site on 2025-04-29.
Haas & Associates was named on the Play ransomware data-leak (extortion) site on 2025-04-28.
Hpital Glengarry Memorial Hospital (clglen.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-04-28.
LaBella Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-28.
Mantel Machine Products was named on the Play ransomware data-leak (extortion) site on 2025-04-28.
Minnesota Lawyers Mutual Insurance was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-28.
Scientel Solutions was named on the Play ransomware data-leak (extortion) site on 2025-04-28.
Crawford Door Sales was named on the Play ransomware data-leak (extortion) site on 2025-04-27.
FMT Consultants was named on the Play ransomware data-leak (extortion) site on 2025-04-27.
Global Media Group was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-26.
M'AR De AR Hotels was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-26.
MDB was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-26.
Stadtwerke Schwerte GmbH was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-26.
AKTO was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-25.
corporateflight.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
friscochamber.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
greatplainstransport.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
impactcanada.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
Kasb Bank - K-Trade was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-25.
Kenworth Del Sur was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-25.
pay4freight.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
shgcpa.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
arkansasprimarycare.com was named on the Incransom ransomware data-leak (extortion) site on 2025-04-24.
buildingmaterialspecialties.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-24.
In April 2025, Carrefour Mobile, the Belgian MVNO of the Carrefour retail group, suffered a data breach exposing personal data of about 64,000 customers, including names, contact details, home addresses, portal passwords and, for some, passport numbers.
Colorado Pulmonary Intensivists was named on the Kairos ransomware data-leak (extortion) site on 2025-04-24.
end2endtechnologies was named on the Lynx ransomware data-leak (extortion) site on 2025-04-24.
https://fortunesociety.org/ was named on the BlackSuit ransomware data-leak (extortion) site on 2025-04-24.
https://www.pacmet.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-04-24.
Vicarage Court Solicitors was named on the Lynx ransomware data-leak (extortion) site on 2025-04-24.
amethystgroup.co.uk was named on the Lynx ransomware data-leak (extortion) site on 2025-04-23.
Farmo Res was named on the Lynx ransomware data-leak (extortion) site on 2025-04-23.
iaconnect was named on the LockBit ransomware data-leak (extortion) site on 2025-04-23.
Lantronix was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
lemi-group was named on the Incransom ransomware data-leak (extortion) site on 2025-04-23.
Mafi was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-23.
Milicic was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-23.
NESCTC was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
Springer & Steinberg was named on the Lynx ransomware data-leak (extortion) site on 2025-04-23.
Suburban Carting was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
The Derby High School was named on the Kairos ransomware data-leak (extortion) site on 2025-04-23.
The Human Bean was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
Acos Favorit was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-22.
All Book Covers was named on the Play ransomware data-leak (extortion) site on 2025-04-22.
Bacton Transport Services was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-22.
In April 2025, French second-hand retail chain Easy Cash disclosed a breach exposing the names, first names and dates of birth of around 92,000 customers, traced to a compromised in-store workstation.
franklin nursing home was named on the Incransom ransomware data-leak (extortion) site on 2025-04-22.
Independent Financial Services was named on the Play ransomware data-leak (extortion) site on 2025-04-22.
Jet Ice was named on the Play ransomware data-leak (extortion) site on 2025-04-22.
R&N Manufacturing was named on the Lynx ransomware data-leak (extortion) site on 2025-04-22.
C-Mec was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-21.
Social-engineering of a third-party service desk gave Scattered Spider a domain administrator, which they used to deploy DragonForce ransomware on M&S's VMware ESXi estate at Easter 2025 — knocking out contactless payments, Click & Collect, and online ordering for over six weeks.
Pharma Force was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-21.
tuttoperlufficio.eu was named on the LockBit ransomware data-leak (extortion) site on 2025-04-21.
Z****a.com was named on the Flocker ransomware data-leak (extortion) site on 2025-04-19.
dhsmithco.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-18.
[EVIDENCE PACK 2] Telecontrol was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-18.
In April 2025, French parking operator Indigo disclosed a breach after attackers accessed its information systems and stole customer names, postal and email addresses, phone numbers and vehicle license plates; no banking data or passwords were affected.
The Tech Interactive was named on the Moneymessage ransomware data-leak (extortion) site on 2025-04-18.
d-line was named on the Kairos ransomware data-leak (extortion) site on 2025-04-17.
EVERTECH INSTRUMENTAL CO., LTD was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-17.
Feldman & Lopez was named on the Lynx ransomware data-leak (extortion) site on 2025-04-17.
HOPI was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-17.
Hyalogic was named on the Lynx ransomware data-leak (extortion) site on 2025-04-17.
Koninklijke Ahold Delhaize N.V. was named on the Incransom ransomware data-leak (extortion) site on 2025-04-17.
Red Chamber was named on the Play ransomware data-leak (extortion) site on 2025-04-17.
Sally B Gold was named on the Lynx ransomware data-leak (extortion) site on 2025-04-17.
VIÑUELAS ABOGADOS was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-17.
aeamg.org.br was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
aqhch.com.cn was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
ende.bo was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
iblinfo.de was named on the Incransom ransomware data-leak (extortion) site on 2025-04-16.
jackpotjunction.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
McElwee Firm was named on the Lynx ransomware data-leak (extortion) site on 2025-04-16.
semex.com was named on the Underground ransomware data-leak (extortion) site on 2025-04-16.
spscompanies.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-16.
toolsign.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-16.
In April 2025, French optical and hearing-aid retailer Alain Afflelou disclosed a breach caused by a vulnerability at a third-party CRM provider, exposing the personal and commercial data of thousands of customers and prospects.
Astra Products was named on the Lynx ransomware data-leak (extortion) site on 2025-04-15.
Destination Toronto was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
On 15 April 2025, car-rental company Hertz disclosed a data breach stemming from the late-2024 zero-day exploitation of Cleo's file-transfer software by the CL0P group, exposing customer names, contact details, dates of birth, driver's licences, credit-card and passport data.
James & Sons Fine Jewelers was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Lake HVAC was named on the Lynx ransomware data-leak (extortion) site on 2025-04-15.
Merri-Makers was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Miller Boskus Lack Architects was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
nevadareadymix.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-15.
O'Brien & Ryan was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Oregon Department of Environmental Quality was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-15.
trocaire.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-04-15.
Voigt-Abernathy Company was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Waller was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Calmont Group was named on the Play ransomware data-leak (extortion) site on 2025-04-14.
Comport Technology Solutions was named on the Play ransomware data-leak (extortion) site on 2025-04-14.
Cortez Resources was named on the Play ransomware data-leak (extortion) site on 2025-04-14.
MENTAL HEALTH was named on the Incransom ransomware data-leak (extortion) site on 2025-04-14.
Orthopaedic Specialists of Connecticut was named on the Incransom ransomware data-leak (extortion) site on 2025-04-14.
intelliloan.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-13.
acimfunds.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-12.
bilbie.com.au was named on the Lynx ransomware data-leak (extortion) site on 2025-04-12.
Bjørklund was named on the Termite ransomware data-leak (extortion) site on 2025-04-12.
Chickenshed was named on the Incransom ransomware data-leak (extortion) site on 2025-04-12.
Dimension Composite was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-12.
On IT was named on the Termite ransomware data-leak (extortion) site on 2025-04-12.
Restaurant Associates was named on the Lynx ransomware data-leak (extortion) site on 2025-04-12.
visionproducts.llc was named on the LockBit ransomware data-leak (extortion) site on 2025-04-12.
C?l???t Group was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Codinter was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Colmar Industrial Supplies was named on the Lynx ransomware data-leak (extortion) site on 2025-04-11.
Harvest, a French wealth-management software editor, was hit by a Run Some Wares ransomware double-extortion attack disclosed in April 2025; internal and client files were exfiltrated and published, reportedly exposing data on tens of thousands of individuals and thousands of companies.
hotelemc2.c was named on the LockBit ransomware data-leak (extortion) site on 2025-04-11.
Imagineering Finishing Technologies was named on the Incransom ransomware data-leak (extortion) site on 2025-04-11.
KER Custom Molders was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
mbmdubai.com was named on the Braincipher ransomware data-leak (extortion) site on 2025-04-11.
New York Sports Club was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Noyen Construction was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
PAC Strapping Products was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Sfrent.net was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources.
During 2025, Synthient aggregated billions of records of "threat data" from various internet sources. The data contained 183M unique email addresses alongside the websites they were entered into and the passwords used.
The Study was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
3P Corporation was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-10.
Bonick Landscaping was named on the Play ransomware data-leak (extortion) site on 2025-04-10.
Cane Creek Cycling Components was named on the Play ransomware data-leak (extortion) site on 2025-04-10.
chesterfieldtwp.org was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
finetech.de was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
inspec-international.com was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
silocaf.com was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
ccso2014.local(sheriffs) was named on the Incransom ransomware data-leak (extortion) site on 2025-04-09.
gramoll.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-09.
A hacktivist using the alias Jabaroot leaked more than 53,000 PDF files and CSV databases from Morocco's National Social Security Fund, exposing national ID numbers, salaries, and banking details for nearly 2 million employees across some 500,000 companies.
Coop57 was named on the Incransom ransomware data-leak (extortion) site on 2025-04-08.
crystal-d.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-08.
https://www.thirdave.com was named on the Metaencryptor ransomware data-leak (extortion) site on 2025-04-08.
physiciansmedicalbilling.net was named on the LockBit ransomware data-leak (extortion) site on 2025-04-08.
RFMS, Inc. was named on the Kairos ransomware data-leak (extortion) site on 2025-04-08.
shengyusteel.com was named on the Underground ransomware data-leak (extortion) site on 2025-04-08.
Thiekon Constructie was named on the Incransom ransomware data-leak (extortion) site on 2025-04-08.
[DISCLOSED]Cell C was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-07.
Galesburg Area Chamber of Commerce was named on the Kairos ransomware data-leak (extortion) site on 2025-04-07.
IDS Infotech was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-07.
Telecontrol was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-07.
asiapacificex.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-06.
graphiquedefrance.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-06.
Groupe Delcourt was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-06.
grupotersa.com.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-04-06.
Hofmann Fördertechnik GmbH was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-06.
Swiss Capitals Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-06.
ABITL Finishing was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
Baltimore Steel Erectors was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
Blackmon Mooring was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-05.
Csm Engineering was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
Hawk Technology was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
https://www.mmwec.org was named on the BlackSuit ransomware data-leak (extortion) site on 2025-04-05.
Industrial Corona de México was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-05.
L&S Mechanical (Reuploaded) was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-05.
Nexia Poyiadjis IT was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-05.
TEDOM was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-05.
Fraser Trebilcock was named on the Play ransomware data-leak (extortion) site on 2025-04-04.
National Sign corp was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-04.
Royal Glass was named on the Play ransomware data-leak (extortion) site on 2025-04-04.
Sansone Group was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-04.
Alton Steel was named on the Lynx ransomware data-leak (extortion) site on 2025-04-03.
Hop Industries was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
Lifebreath was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
OTA Management was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
Parvin-Clauss Sign Company was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
Regionale Verkehrsbetriebe was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
A little gift of exclusive data for everyone was named on the Daixin ransomware data-leak (extortion) site on 2025-04-02.
Clarity Ventures was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-02.
crownlaboratories.com was named on the Abyss ransomware data-leak (extortion) site on 2025-04-02.
Fulfillment Plus was named on the Play ransomware data-leak (extortion) site on 2025-04-02.
The Hoff Brand SL Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-04-02.
delta-life.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-04-01.
europtec.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-04-01.
intellioan.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-04-01.
A data leak disclosed on 1 April 2025 exposed personal contact details of people associated with Reporterre, the French independent environmental news outlet, including last names, first names, email addresses and postal addresses.
State's Attorney Office was named on the Kairos ransomware data-leak (extortion) site on 2025-04-01.
The Loretto Hospital was named on the Incransom ransomware data-leak (extortion) site on 2025-04-01.
CMC Technology Group was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
Meridian Senior was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
Saunders and Saunders was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
SIRIUS S.R.L. was named on the Nitrogen ransomware data-leak (extortion) site on 2025-03-31.
Sonrisas Dental Health was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
test1234.com was named on the LockBit ransomware data-leak (extortion) site on 2025-03-31.
In March 2025, data from Samsung Germany was compromised in a data breach of their logistics provider, Spectos. Allegedly due to credentials being obtained by malware running on a Spectos employee's machine, the breach included 216k unique email addresses along with names, physical addresses, items…
www.assisi.nl was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-30.
AJF Inspections & Engineering () was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Amatech was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
bahnlog.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-29.
Commercial Concrete Systems was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Forrest City School District was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
importantsteps.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-29.
Martin Mechanical (martin.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Pacific Residential Mortgage was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Senior Support Services was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
Solar Optimum was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
solaroptimum.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
amatechinc.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-28.
augustssons.se was named on the Incransom ransomware data-leak (extortion) site on 2025-03-28.
Direct Traffic Control was named on the Lynx ransomware data-leak (extortion) site on 2025-03-28.
entandallergy.com was named on the Abyss ransomware data-leak (extortion) site on 2025-03-28.
A ransomware attack on French wealth-management software vendor Harvest (Run Some Wares group, detected 27 Feb 2025) exposed personal and financial data of customers of insurer MAIF and banking group BPCE (Banque Populaire / Caisse d'Épargne) in a supply-chain breach.
phaus.us&phakr.com&phabodysystems.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-28.
W*******w.com was named on the Flocker ransomware data-leak (extortion) site on 2025-03-28.
www.bassi.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-28.
www.solventacentroamerica.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-28.
brattenelectrictn.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
City of Fort St. John (city.cityfsj.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-03-27.
conterra.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
In March 2025, data allegedly sourced from German Doner Kebab was published on a popular hacking forum. The data included 162k unique email addresses alongside names, phone numbers and physical addresses. German Doner Kebab subsequently sent a disclosure notice to impacted individuals.
NEW JERSEY CPA was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-03-27.
In late March 2025, a threat actor known as 'rose87168' claimed to have stolen roughly 6 million authentication records from an Oracle Cloud SSO/LDAP endpoint, potentially affecting over 140,000 tenants; Oracle initially denied any breach before privately confirming a compromise to customers.
www.allmilmoe.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.carolinaac.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.DSelectrical.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.garbinc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.hongthongrice.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.s3s.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.solidworld.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
On 26 March 2025, internal data from Centrale Nantes, a French public engineering grande école, was reported leaked, including private reports and projects, user logins with password hashes, source code, and administrative documents.
Concord Orthopaedics Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-03-26.
Genie Healthcare Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-03-26.
In March 2025, almost 55k records were breached from the Hungarian education office website TehetségKapu. The data was subsequently published to a popular hacking forum and included email addresses, names and usernames.
TriCity Family Services was named on the Incransom ransomware data-leak (extortion) site on 2025-03-26.
usCalibration was named on the Play ransomware data-leak (extortion) site on 2025-03-26.
www.afnigc.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.argentosc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.cormidom.com.do was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.creativelogisticservices.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.fkm-elemente.de was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.lions-online.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.mododoc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.ripplejunction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
B&C Industries was named on the Play ransomware data-leak (extortion) site on 2025-03-25.
bioclimaservice.it was named on the LockBit ransomware data-leak (extortion) site on 2025-03-25.
In late March 2025, French medical-laboratory network Cerballiance disclosed a data breach traced to a February intrusion on an IT provider's server, exposing administrative and some health data of patients in the PACA region, including names, social security numbers and certain test reports.
cisd.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
fepasa.com.ar was named on the LockBit ransomware data-leak (extortion) site on 2025-03-25.
Kimco Steel was named on the Play ransomware data-leak (extortion) site on 2025-03-25.
mnm.hu was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
Okeene Elementary School was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-25.
OMLTD.CO.JP was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
ossc.com.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-03-25.
technicare.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
texascompressionservices.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
In March 2025, a phishing attack successfully gained access to Troy Hunt's Mailchimp account and automatically exported a list of people who had subscribed to the newsletter for his personal blog.
www.rivaldt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum. The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes.
allbiz.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-24.
In March 2025, French vehicle-inspection network Autosur (Diagnosur brand) disclosed a breach exposing data on roughly 10.7 million customers — names, postal and email addresses, phone numbers, and detailed vehicle records including registration plates and VINs — later offered for sale online.
Lupin Limited was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-24.
TMT Clam Dredger was named on the Incransom ransomware data-leak (extortion) site on 2025-03-24.
www.exemplar.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-24.
abeyor.fr was named on the Incransom ransomware data-leak (extortion) site on 2025-03-23.
Goshen Medical Center was named on the BianLian ransomware data-leak (extortion) site on 2025-03-23.
Precision Accounting Intl was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-23.
Doumen was named on the Lynx ransomware data-leak (extortion) site on 2025-03-22.
Innovative Surfaces was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-22.
REOC San Antonio was named on the Play ransomware data-leak (extortion) site on 2025-03-22.
SPARSH Hospital was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-22.
Zaveta Custom Homes was named on the Play ransomware data-leak (extortion) site on 2025-03-22.
Cayman National Bank was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-21.
In March 2026, the NSFW AI companion platform Cuties AI suffered a data breach that was subsequently published to a public hacking forum. The incident exposed 144k unique email addresses along with display names, avatars, prompts and descriptions used to generate AI adult images, as well as URLs to…
gbsn.com.br was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
https://www.orangeville.ca was named on the BlackSuit ransomware data-leak (extortion) site on 2025-03-21.
Officio Medical was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-21.
www.abmenviro.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.accessfinanceonline.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.ahmadiyya.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.allstarhealthcaresolutions.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.avalonapparel.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.broadmoormethodist.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.core-1.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.elizajennings.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.engines.man.eu was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.esquirebrands.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.gcsnet.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.gestionquintessence.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.mslglobalexp.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.njcalwe.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.oneupinnovations.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.parklandmanufacturing.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.scpautomation.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.sinkdirect.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.solinst.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
Cargills Bank was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-20.
On 20 March 2025, the French scouting and guiding association Éclaireuses et Éclaireurs de France had personal data on roughly 44,000 members exposed, including names, dates and places of birth, postal addresses, professions, emails and phone numbers.
Instituto de Ojos was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-20.
interiseworld.com was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-20.
In March 2025, French sporting-goods retailer Intersport had data on roughly 3.4 million customers stolen via a compromised FTP server and put up for sale on BreachForums, exposing names, contact details, addresses, PayPal references and transaction history (no banking credentials).
L&S Mechanical was named on the Spacebears ransomware data-leak (extortion) site on 2025-03-20.
Megacentro was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-20.
Newtown Friends School (newtownfriends.org) was named on the FOG ransomware data-leak (extortion) site on 2025-03-20.
Obra Play was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-20.
Whittaker & Company was named on the Spacebears ransomware data-leak (extortion) site on 2025-03-20.
www.georgehay.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-20.
www.janvier-labs.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-20.
yano.tokyo was named on the Blackout ransomware data-leak (extortion) site on 2025-03-20.
alphaoil.ca was named on the Incransom ransomware data-leak (extortion) site on 2025-03-19.
controlledair.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-19.
Coopertruni was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-19.
Kiribati Government was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-19.
newhollandwood.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-19.
Palomino Petroleum was named on the Lynx ransomware data-leak (extortion) site on 2025-03-19.
Q railing was named on the Play ransomware data-leak (extortion) site on 2025-03-19.
THX Transport was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-19.
warmsworth.doncaster.sch.uk was named on the Incransom ransomware data-leak (extortion) site on 2025-03-19.
51talk.com was named on the LockBit ransomware data-leak (extortion) site on 2025-03-18.
airtelligence.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-18.
AMICIO was named on the Lynx ransomware data-leak (extortion) site on 2025-03-18.
CD was named on the Monti ransomware data-leak (extortion) site on 2025-03-18.
In March 2025, French direct insurer Direct Assurance (an AXA subsidiary) suffered a breach via its partner Run Assurance: attackers exploited a flaw in the data exchanges between the two firms to access customer personal data, raising identity-theft and phishing risks.
expertdata.com.au was named on the Incransom ransomware data-leak (extortion) site on 2025-03-18.
gaertnerhof-jeutter.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-18.
Gloria Cales was named on the Monti ransomware data-leak (extortion) site on 2025-03-18.
Harcourts Prime Properties was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-18.
Ted Hosmer Enterprises was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-18.
assaabloy.com\$14.4B\Sweden\229GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
baillie.com\$130.5M\USA\52GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
bluedge.com\$104.5M\USA\994GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
CableVision was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-17.
ccktech.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
kyb.com\$600.5M\USA\1.8TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
oneill.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
RAE (Real Academia Española) (rae.es) was named on the FOG ransomware data-leak (extortion) site on 2025-03-17.
rocketstores.com\$738.9M\USA\3.2TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
tempel.com\$628.7M\USA\111GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
thermoid.com\$183.2M\USA\199GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
urban1.com\$460.3M\USA\2.5TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
www.baxterlaboratories.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
www.jhayber.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
Courageous Home Care was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-16.
www.ameda.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-16.
yeanshalle.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-15.
Bancroft Wines was named on the Incransom ransomware data-leak (extortion) site on 2025-03-14.
Casale Del Giglio was named on the Orca ransomware data-leak (extortion) site on 2025-03-14.
Fulcrum Lifting was named on the Lynx ransomware data-leak (extortion) site on 2025-03-14.
idcconstruction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-14.
Indiv Usa was named on the Lynx ransomware data-leak (extortion) site on 2025-03-14.
jennyyoo.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-14.
mdm-insurance.com was named on the Abyss ransomware data-leak (extortion) site on 2025-03-14.
Perrigo Company was named on the Termite ransomware data-leak (extortion) site on 2025-03-14.
Tryon was named on the Lynx ransomware data-leak (extortion) site on 2025-03-14.
Backes was named on the Play ransomware data-leak (extortion) site on 2025-03-13.
Best Cheer Stone was named on the Play ransomware data-leak (extortion) site on 2025-03-13.
chfindustries.com\$253.8M\USA\2.5TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-13.
Cothron's Security Professionals was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-13.
dtrglaw.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-13.
fstlogistics.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-13.
Harrells.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-13.
In March 2025, rental-application files held by French real estate network Laforêt were exposed, leaking tenants' identity documents and bank account details (RIB) along with the rest of their dossiers.
muellersyste was named on the LockBit ransomware data-leak (extortion) site on 2025-03-13.
rixos.com was named on the Embargo ransomware data-leak (extortion) site on 2025-03-13.
SL Tennessee Information was named on the Play ransomware data-leak (extortion) site on 2025-03-13.
University Diagnostic Medical Imaging, PC (udmi.net) was named on the FOG ransomware data-leak (extortion) site on 2025-03-13.
www.raymond.in was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-13.
baillie.com\$130.5M\USA\52GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
El Camino Real Academy (elcaminorealacademy) was named on the FOG ransomware data-leak (extortion) site on 2025-03-12.
HYPERNOVA TELECOM was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-12.
HYPONAMIRU was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-12.
rocketstores.com\$738.9M\USA\3.2TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
tempel.com\$628.7M\USA\111GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
thermoid.com\$183.2M\USA\199GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
TUV India Pvt. Ltd. was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-03-12.
urban1.com\$460.3M\USA\2.5TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
www.visualisation.one was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-12.
ciscientific.com.au was named on the Lynx ransomware data-leak (extortion) site on 2025-03-11.
Edesur Dominicana was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-11.
Essex County OB/GYN Associates was named on the Incransom ransomware data-leak (extortion) site on 2025-03-11.
Longue Vue Club was named on the Lynx ransomware data-leak (extortion) site on 2025-03-11.
quigleyeye.com\$33.6M\USA\3.4TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-11.
Research Electronics International was named on the Nitrogen ransomware data-leak (extortion) site on 2025-03-11.
Skyward Specialty Insurance was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-11.
Springfield Water and Sewer Commission was named on the Lynx ransomware data-leak (extortion) site on 2025-03-11.
Trymata was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-11.
Wilkinson Rogers (wilkinsonrogers.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-11.
wmk-hvb.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-11.
aiibeauty.com\$274.8M\USA\508GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
amalgamatedsugar.com\$764.8 M\USA\464GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
caltrol.com\$296.3M\USA\224GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
dccsagroup.com&csahome.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-10.
[DISCLOSED]Nationz Technologies Inc. was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-03-10.
formanmills.com\$422.2M\USA\846GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
Fred Salvucci was named on the Kairos ransomware data-leak (extortion) site on 2025-03-10.
Magnolia Manor (magnoliamanor.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-10.
pace-usa.com\$134.4M\USA\65GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
steelwarehouse.com\$570.3M\USA\679GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
www.hexosys.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-10.
ACTi Corporation was named on the Lynx ransomware data-leak (extortion) site on 2025-03-09.
baldaufarchitekten.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
BerksBar.org was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
British virgin islands London Office was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-09.
Buckley BalaWilson Mew was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Clawson Honda was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Compound Solutions was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Dectron was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
emperors.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Gevril was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Greenwood Village South GVS was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Holiday Comfort was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Insider Technologies Limited was named on the Embargo ransomware data-leak (extortion) site on 2025-03-09.
Jerue Companies was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Nor Arc was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Peak Season was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Salemerode.com was named on the Flocker ransomware data-leak (extortion) site on 2025-03-09.
State Bar of Texas (www.texasbar.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Syma-System was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
T J Machine & Tool was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
williampevear.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
wog-kaiserbaeder.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Yorke & Curtis was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
mitchellmcnutt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-08.
Tech NH was named on the Lynx ransomware data-leak (extortion) site on 2025-03-08.
www.dcarosolutions.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-08.
www.jpwindustries.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-08.
Suspicious network activity at Yale New Haven Health led to the largest U.S. healthcare data breach of 2025: 5.5 million patients had names, contact details, dates of birth, medical record numbers, and Social Security numbers stolen. The health system later agreed to an $18 million class-action settlement.
ACDC Express was named on the Lynx ransomware data-leak (extortion) site on 2025-03-07.
Allworx was named on the BianLian ransomware data-leak (extortion) site on 2025-03-07.
alphabaking.com\$421.9M\USA\1TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-07.
associatedasset.com\$288M\USA\26GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-07.
bayvillage.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
grede.com\$814.7M\USA\524GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-07.
Island Realty was named on the BianLian ransomware data-leak (extortion) site on 2025-03-07.
lofotenseafood.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-07.
Minnesota Orthodontics was named on the BianLian ransomware data-leak (extortion) site on 2025-03-07.
REYCOTEL was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-07.
srmg.com.au was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
total-ps.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
wheats.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
Adval Tech was named on the Lynx ransomware data-leak (extortion) site on 2025-03-06.
agi.net was named on the Monti ransomware data-leak (extortion) site on 2025-03-06.
Dynamic Closures was named on the Lynx ransomware data-leak (extortion) site on 2025-03-06.
electrocraft.com\$190.1M\USA\477GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-06.
hickorylaw.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
holtcat.com\$1B\USA\868GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-06.
lovesac.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
Naples Heritage Golf & Country Club was named on the Incransom ransomware data-leak (extortion) site on 2025-03-06.
Oberlin Cable Co-op (oberlin.net) was named on the FOG ransomware data-leak (extortion) site on 2025-03-06.
stanleyconsultants.com\$190.5M\USA\388GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-06.
Tugwell Pump & Supply was named on the Lynx ransomware data-leak (extortion) site on 2025-03-06.
WJCC Public Schools (wjccschools.org) was named on the FOG ransomware data-leak (extortion) site on 2025-03-06.
www.centersheetmetal.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
www.convention.qc.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
www.hinton.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
www.portlandschools.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
Best Collateral, Inc. was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-05.
Pervedant was named on the Lynx ransomware data-leak (extortion) site on 2025-03-05.
Schmiedetechnik Plettenberg GmbH & Co KG was named on the Lynx ransomware data-leak (extortion) site on 2025-03-05.
SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-05.
The 19 biggest gitlabs was named on the FOG ransomware data-leak (extortion) site on 2025-03-05.
USA Rice<br /> was named on the Kairos ransomware data-leak (extortion) site on 2025-03-05.
On 5 March 2025, French borrower-insurance broker UTwin notified clients that an intrusion into its IT system had temporarily exposed identity details, email addresses and phone numbers; the company said no banking, medical or contract data was affected.
www.black-star.fr was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
www.cda.be was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
www.japanrebuilt.jp was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
www.sunsweet.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
365labs - Security Corp was named on the Monti ransomware data-leak (extortion) site on 2025-03-04.
Brien, Inc. was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
In March 2025, French sushi-delivery chain Côté Sushi had the personal data of roughly 1.1 million customers — names, dates of birth, emails and phone numbers — scraped from its loyalty/delivery database and offered for sale on a cybercrime forum.
dsrny.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-04.
Ewald Consulting was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Garner, P.C. was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
goencon.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-04.
Grupo Baston Aerossol (baston.com.br) was named on the FOG ransomware data-leak (extortion) site on 2025-03-04.
Keystone Pacific Property Management LLC was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
In March 2025, French postal operator La Poste disclosed a breach of its 'Élection du Timbre' platform exposing personal data of about 50,000 users — names, year of birth, email, phone and postal addresses — which was put up for sale online by an attacker.
Layfield and Borel CPA's L.L.C was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Legal Aid Society of Salt Lake was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Pampili (pampili.com.br) was named on the FOG ransomware data-leak (extortion) site on 2025-03-04.
Phoenix was named on the Monti ransomware data-leak (extortion) site on 2025-03-04.
Seabank Group was named on the Lynx ransomware data-leak (extortion) site on 2025-03-04.
Tata Technologies was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-04.
Wendy Wu Tours was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-04.
almostfamousclothing.com\$183M\USA\375GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
andreyevengineering.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-03.
Central McGowan (centralmcgowan.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-03.
ceratec.com was named on the Abyss ransomware data-leak (extortion) site on 2025-03-03.
everelgroup.com\$259M\Italy\440GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
familychc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-03.
Grafitec was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
ICO was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
Itapeseg was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
K**d.edu was named on the Flocker ransomware data-leak (extortion) site on 2025-03-03.
Klesk Metal Stamping Co (kleskmetalstamping.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-03.
La Unión was named on the Lynx ransomware data-leak (extortion) site on 2025-03-03.
LINKGROUP was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
logic insectes was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
New .Gov ? was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
Openreso was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
quigleyeye.com\$33.6M\USA\435GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
regulvar.com\$253.5M\Canada\3.6TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
RJ IT Solutions was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
S********e.com was named on the Flocker ransomware data-leak (extortion) site on 2025-03-03.
ssmcoop.com\$22.5M\USA\26GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
synaptic.co.tz was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
Vitenas Cosmetic Surgery was named on the Kairos ransomware data-leak (extortion) site on 2025-03-03.
bestbrands.com\$25.5M\USA\659GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
britannicahome.com\$20.6M\USA\2.8TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
Couri Insurance Agency was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
FM.GOB.AR was named on the Monti ransomware data-leak (extortion) site on 2025-03-02.
Ganong Bros was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
germancentre.sg was named on the Incransom ransomware data-leak (extortion) site on 2025-03-02.
gruppocogesi.org was named on the LockBit ransomware data-leak (extortion) site on 2025-03-02.
International Process Plants was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
IT-IQ Botswana was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
kinseysinc.com\$74.9M\USA\675GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
M&n Management was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
midwayimporting.com\$43.7M\USA\915GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
newhorizonsbaking.com\$163M\USA\455GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
North American Fire Hose was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
Optometrics was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
Pre Con Industries was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
revitalash.com\$21.5M\USA\1.2TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
steelerubber.com\$17.9M\USA\116GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
uniekinc.com\$37.5M\USA\1.8TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
Workforce Group was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-02.
breakawayconcretecutting.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-01.
Newton & Associates, Inc was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-01.
associatedasset.com\$288M\USA\26GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
branchgroup.com\$333M\USA\253GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
curtisint.com\$37.2M\Canada\676GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
Disclosed on 28 February 2025, a data breach at France's École Nationale de la Sécurité, a private-security and VTC training school, exposed the personal records of roughly 30,000 trainees, including national ID numbers, social security numbers, VTC licence numbers and contact details.
On 28 February 2025, a threat actor claimed to have stolen a database from EDF's hydraulic generation division (DPIH), exposing power-plant intervention and maintenance plans, security inspection results and maintenance staff IDs; EDF and researchers disputed the actor's nuclear claims.
electrocraft.com\$190.1M\USA\477GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
Engineering Mechanics was named on the Lynx ransomware data-leak (extortion) site on 2025-02-28.
grede.com\$814.7M\USA\524gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
Inversiones Clinica Del Meta SA was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-02-28.
pace-usa.com\$134.4M\USA\65gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
stanleyconsultants.com\$190.5M\USA\388GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
steelwarehouse.com\$570.3M\USA\679gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
sublettecountywy.gov was named on the Incransom ransomware data-leak (extortion) site on 2025-02-28.
uniquehd.com\$13.7M\USA\429GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
www.casinoessentials.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-28.
www.journeyoilfield.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-28.
On 28 February 2025, a data leak attributed to Zephir (France) exposed personal records of roughly 67,000 people, including names, email addresses, phone numbers and bank account details (IBAN).
Biogena GmbH & Co KG was named on the Lynx ransomware data-leak (extortion) site on 2025-02-27.
jtu.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-02-27.
teamwass.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-27.
www.nasonptc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-27.
www.townofbourne.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-27.
3cBSI was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
alphabaking.com\$421.9M\USA\1TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-26.
Arcandco was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
caltrol.com\$296.3M\USA\224gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-26.
Finck Cigar was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
Genea was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Gitlabs: Synelixis Solutions, INGV, VMO Holdings was named on the FOG ransomware data-leak (extortion) site on 2025-02-26.
holtcat.com\$1B\USA\868GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-26.
ITU AbsorbTech was named on the Lynx ransomware data-leak (extortion) site on 2025-02-26.
Kendall Auto Group was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
London Belgravia was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Muller Insurance was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
National Legal Service was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Nationz Technologies Inc. was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-26.
Nichino Ryokka Co Ltd was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
On 26 February 2025, Nord Emploi — the Nord department's RSA return-to-employment support platform — was hit by a data leak exposing personal and social-support records of roughly 200,000 benefit recipients, including identity, contact, CAF/RSA and detailed welfare-accompaniment data.
Omni United was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
powelltool.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-26.
Rooks Rider Solicitors was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Story Environmental was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
Vermeer Mexico was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
www.amerasphalt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.cmsg.cl was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.emeryair.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.envirolabsinc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.kppm.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.newburghhealthcarecenter.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.obrienavocats.qc.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
acmefan.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
ALCOTT HR GROUP was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
bluedge.com\$104.5M\USA\994GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-25.
Convert Solar was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
essenzamovies.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-02-25.
Fairhaven Shipyard Companies was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
First Federal Savings & Loan was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
GANRO was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
hgmlegal.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
lifting.com\$135.8M\USA\1.4TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-25.
megamtls.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-25.
neatem.fr | Update! was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-25.
ossc.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-02-25.
pacresmortgage.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
PPS Services Group was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
Radco Industries was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
South Georgia Accounting Services was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-25.
tequaly.com was named on the Embargo ransomware data-leak (extortion) site on 2025-02-25.
unila.edu.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-02-25.
Vvf Ilinois Services was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
welcompanies.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.ateliermonarque.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.avalon-hotel.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.bwdtechnology.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.confabca.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.rgb.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.wpisd.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
Xepa Soul was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
aiibeauty.com\$274.8M\USA\508GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
amalgamatedsugar.com\$764.8 M\USA\464gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
chfindustries.com\$253.8M\USA\2.5TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
compactmould.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-24.
denbyco.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-24.
[DISCLOSED] Aishu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-24.
everelgroup.com\$259M\Italy\440GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
[EVIDENCE] Aishu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-24.
Fireplace Warehouse was named on the Kairos ransomware data-leak (extortion) site on 2025-02-24.
formanmills.com\$422.2M\USA\846gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
Geokon was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
IDEA Expertises was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
In February 2025, the Romanian arm of telecommunications company Orange suffered a data breach which was subsequently published to a popular hacking forum.
Planet One was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
regulvar.com\$253.5M\Canada\3.6TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
Stürmer Maschinen was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
BluAgent Technologies, Inc was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
G& was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
Gitlabs: Naphix, WDNA, Bayteq was named on the FOG ransomware data-leak (extortion) site on 2025-02-23.
Novi Community School District was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
ondaralogistica.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-23.
Shaghalni was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
www.famcomachine.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-23.
alleghenybradford.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-22.
CCOO Servicios was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-22.
evergreenpnw.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-22.
Excel Security was named on the Lynx ransomware data-leak (extortion) site on 2025-02-22.
Peter Glenn Ski Sport was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-22.
SPEED Co was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-22.
teamsters175.org was named on the Incransom ransomware data-leak (extortion) site on 2025-02-22.
Lazarus operators substituted the implementation contract during a routine Safe multisig transaction, draining ~$1.5 billion in ETH and staked-ETH derivatives from Bybit's Ethereum cold wallet — the largest single cryptocurrency theft in history.
In February 2025 the French Football Federation (FFF) suffered a data breach via a compromised account on its licensee-management platform; at least ~43,000 users had personal data exposed, including names, contact details, and copies of ID documents.
guadeloupeformation.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
headcount.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
jindalgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
(kc2) geokon.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-21.
planetone-asia.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-21.
statesideseattle.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-21.
www.elecgalapagos.com.ec was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.electro-fusion.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.fla-esq.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.midwestvascular.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.nola-law.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.saracenproperties.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.witheyaddison.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
californiaclingpeaches.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-20.
eaglepost.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
ehdd.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-20.
Fortune Electric Co Ltd was named on the Lynx ransomware data-leak (extortion) site on 2025-02-20.
gilcar.co was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
Ligentia was named on the Termite ransomware data-leak (extortion) site on 2025-02-20.
Medical File was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-20.
newhorizonsbaking.com\$163M\USA\455GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-20.
www.okddsi.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
www.phdental.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
www.pransystems.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
www.riverdale.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
Alabama Ophthalmology Associates was named on the BianLian ransomware data-leak (extortion) site on 2025-02-19.
BeniPlus was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Brolly was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
DR.Claims FL LLC was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Eservices.gov.zm was named on the Flocker ransomware data-leak (extortion) site on 2025-02-19.
EzyLegal was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Gitlabs: Next TI, VISEO, Hochschule Trier was named on the FOG ransomware data-leak (extortion) site on 2025-02-19.
Haggin Oaks Golf (hagginoaks.com) was named on the FOG ransomware data-leak (extortion) site on 2025-02-19.
haleycomfort.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-19.
Help Me Grow Yolo was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
NimuSoft was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Pulmonary Physicians of South Florida Clinics | Data security breach! was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-19.
Ranhill Bersekutu was named on the Lynx ransomware data-leak (extortion) site on 2025-02-19.
Revi was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
On 19 February 2025, the Vienne Departmental Fire and Rescue Service (SDIS 86) in France suffered a website compromise that exposed an internal database, including user logins, hashed passwords and email addresses, along with sensitive station and emergency-intervention information.
Supreme Administrative Court of Bulgaria was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-19.
Afa Systems Ltd. was named on the Underground ransomware data-leak (extortion) site on 2025-02-18.
bestbrands.com\$25.5M\USA\659GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
boostheat.com was named on the Bashe ransomware data-leak (extortion) site on 2025-02-18.
Buanderie Centrale de Montreal was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-18.
lavi.co.il was named on the Incransom ransomware data-leak (extortion) site on 2025-02-18.
midwayimporting.com\$43.7M\USA\915GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
pyasolutions.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-18.
ranhillbersekutu.com.my was named on the Lynx ransomware data-leak (extortion) site on 2025-02-18.
revitalash.com\$21.5M\USA\1.2TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
uniekinc.com\$37.5M\USA\1.8TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
www.alphamedctr.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.ccttechnologies.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.copleystoughton.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.macmed.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.mwmechanicalinc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
Allied Tenesis was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
almostfamousclothing.com\$183M\USA\375GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Autoschade Pippel was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
bisindustries.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-17.
Bulldog Oilfield Services was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Bushmans was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Cirion Technologies was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-17.
Cuna Supply was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Dane Court Grammar School was named on the Kairos ransomware data-leak (extortion) site on 2025-02-17.
Greencastle-Antrim Senior High School (gcasd.org) was named on the FOG ransomware data-leak (extortion) site on 2025-02-17.
hamton was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
Hisingstads Bleck was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
HRS_IDEA_Expertises was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
https://www.dapope.com/ was named on the BlackSuit ransomware data-leak (extortion) site on 2025-02-17.
Inland Empire Distribution Systems, Inc. was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
kinseysinc.com\$74.9M\USA\675GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Leadership Strategies was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
lekiaviation.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-17.
LINTEC & LINNHOFF Holdings was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
mgainnovation.com\$30.9M\USA\215GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
myhscu.com was named on the Embargo ransomware data-leak (extortion) site on 2025-02-17.
neatem.fr was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-17.
northernresponse.com\$17.4M\Canada\366GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Oxford Companies was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Pedensia Graphics Distribution was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
Persante Health Care was named on the Incransom ransomware data-leak (extortion) site on 2025-02-17.
Rheinischer Sch was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
savoiesfoods.com\$18.2M\USA\95GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
On 17 February 2025, French sports-experience e-commerce retailer Sport Découverte (sport-decouverte.com) was reported breached, with a database of roughly 488,000 customer accounts — names, dates of birth, phone numbers and email addresses — exposed.
ssmcoop.com\$22.5M\USA\26GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Stage 3 Separation was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Startek Peglar & Calcagni was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
steelerubber.com\$17.9M\USA\116GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Swissmem was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-17.
teamwass.com\$676.3M\USA\451GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
The Townsley Law Firm Information was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Toi Toi USA was named on the Kairos ransomware data-leak (extortion) site on 2025-02-17.
Transkid was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Weed Man Canada was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Winbas was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
www.macter.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-17.
Wylie Steel Fabricators was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
A*u.edu.au was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
annegrady.org was named on the Embargo ransomware data-leak (extortion) site on 2025-02-16.
Gitlabs: Acqua development, QBurst, Pamyra.de was named on the FOG ransomware data-leak (extortion) site on 2025-02-16.
Gpstech2007.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
Mervis.info was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
Realtime.tw was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
In February 2025, 23 billion rows of stealer logs were obtained from a Telegram channel known as ALIEN TXTBASE. The data contained 284M unique email addresses alongside the websites they were entered into and the passwords used.
City of McKinney was named on the Incransom ransomware data-leak (extortion) site on 2025-02-15.
Empire Home Center was named on the Lynx ransomware data-leak (extortion) site on 2025-02-15.
halex.com was named on the Abyss ransomware data-leak (extortion) site on 2025-02-15.
(M)Empire-home-center was named on the Lynx ransomware data-leak (extortion) site on 2025-02-15.
Northeast Delta Human Services Authority was named on the Incransom ransomware data-leak (extortion) site on 2025-02-15.
saulttribe.com/kewadin.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.310tempering.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.cityoftarrant.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.colacouronnelocations.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.imgenterprises.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.naga.ae was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.rowetactical.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.solardatasystems.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.transcend-info.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
In February 2025, data obtained from an earlier Adpost breach surfaced. The dataset contained 3.3M records including email addresses, usernames, and display names. Adpost later published a disclosure notice and advised they'd forced a credential refresh, among other actions.
brockbanks.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-14.
In February 2025, the spyware service Cocospy suffered a data breach along with sibling spyware service, Spyic. The Cocospy breach alone exposed almost 1.8M customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs,…
Heritage South Credit Union was named on the Embargo ransomware data-leak (extortion) site on 2025-02-14.
In February 2025, the spyware service Spyic suffered a data breach along with sibling spyware service, Cocospy. The Spyic breach alone exposed almost 876k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs,…
The Agency was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-14.
www.calspa.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-14.
Aspire Rural Health System was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Ball, LLP was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Borel CPA's L.L.C was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Dain, Torpy, Le Ray, Wiest and Garner, P.C. was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
enventuregt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-13.
Financial Services of America, Inc. was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Gitlabs: Omydoo, Ayomi, ADULLACT was named on the FOG ransomware data-leak (extortion) site on 2025-02-13.
leonardo.com was named on the Threeam ransomware data-leak (extortion) site on 2025-02-13.
Mozo Grau (mozo-grau.com) was named on the FOG ransomware data-leak (extortion) site on 2025-02-13.
In February 2025, French motorcycle insurer Mutuelle des Motards suffered a breach of a marketing contact database, exposing names, email addresses, phone numbers and postal codes of more than 1.3 million members.
Nash Brothers Construction was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Nippon Steel USA was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
R Molds Inc was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Shields Facilities Maintenance was named on the Play ransomware data-leak (extortion) site on 2025-02-13.
snoqualmietribe.us was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-13.
alderconstruction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
askgs.ma was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
bergconst.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
britannicahome.com\$20.6M\USA\2.8TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-12.
burdickpainting.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
In February 2025, France's Caisse des dépôts disclosed that attackers used stolen login credentials to access the Ircantec pension platform and steal the personal data of about 70,000 public-sector contract workers, hospital practitioners and roughly 1,000 local elected officials.
Chronopost, the French express parcel carrier, confirmed in February 2025 that an intrusion detected on 29 January 2025 exposed personal data of around 210,000 customers, including names, postal addresses, phone numbers and delivery signatures.
columbiacabinets.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
curtisint.com\$37.2M\Canada\676GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-12.
E*******s.gov.zm was named on the Flocker ransomware data-leak (extortion) site on 2025-02-12.
ekvallbyrne.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Gitlabs: INGV, Spacemanic, Squeezer-software was named on the FOG ransomware data-leak (extortion) site on 2025-02-12.
Hess (hess-gmbh.de) was named on the FOG ransomware data-leak (extortion) site on 2025-02-12.
http://thermaseal.net was named on the Ciphbit ransomware data-leak (extortion) site on 2025-02-12.
krmcustomhomes.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
laderalending.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
MICRO MANUFACTRING was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-02-12.
minnesotaexteriors.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Obex Medical was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-12.
Omni Fiber LLC was named on the Monti ransomware data-leak (extortion) site on 2025-02-12.
rogerspetro.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
slchc.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Societatea Energetica Electrica S.A. was named on the Lynx ransomware data-leak (extortion) site on 2025-02-12.
steveallcorn.remax.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
STIIIZY Full Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-02-12.
sundanceliving.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
The Brown & Hurley Group was named on the Lynx ransomware data-leak (extortion) site on 2025-02-12.
thejdkgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
twncomm.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
uniquehd.com\$13.7M\USA\429GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-12.
weathersa.co.za was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Aurora Public Schools (aurorak12.org) was named on the FOG ransomware data-leak (extortion) site on 2025-02-11.
Baltimore Country Club was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
CESI was named on the Termite ransomware data-leak (extortion) site on 2025-02-11.
Cold Storage Manufacturing was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
EAC Consulting was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Fastighetsservice AB was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Hammond Trucking & Excavation was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-11.
Jildor Shoes was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Kensington Glass Arts was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
In February 2025, French toy retailer King Jouet was hit by a breach of its online order-tracking interface; a hacker claimed 4.3 million records, but the company said fewer than 25,000 customers across two stores had names, contact details and order information exposed.
In February 2025, the public safety policy management systems company Lexipol suffered a data breach. Attributed to the self-proclaimed "Puppygirl Hacker Polycule", the breach exposed an extensive number of documents and user records which were subsequently published publicly.
Logix Corporate Solutions was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-11.
Mainline Information Systems was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Monroe Transportation Services Inc was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Neaton Auto Products Manufacturing was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
primesourcestaffing.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-11.
ROCK SOLID Stabilization & Reclamation was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Rogers was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-11.
Saint George's College (saintgeorge.cl) was named on the FOG ransomware data-leak (extortion) site on 2025-02-11.
sehma.com was named on the Threeam ransomware data-leak (extortion) site on 2025-02-11.
Shinn Fu Company of America was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
sole technology was named on the Monti ransomware data-leak (extortion) site on 2025-02-11.
The Children's Center Of Hamden was named on the Incransom ransomware data-leak (extortion) site on 2025-02-11.
The University of Notre Dame Australia (nd.edu.au) was named on the FOG ransomware data-leak (extortion) site on 2025-02-11.
Tie Down Engineering was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
TMC was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-11.
abcapital.com.ph was named on the LockBit ransomware data-leak (extortion) site on 2025-02-10.
Albright Institute was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
ASRAM Medical College and Hospita was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
Atlas Commodities was named on the Lynx ransomware data-leak (extortion) site on 2025-02-10.
bazcooil.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
Capital Cell Global (CCG) was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
D-7 Roofing was named on the BianLian ransomware data-leak (extortion) site on 2025-02-10.
Enfin was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
kaplanstahler.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
komline.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
Lexington Electric was named on the Lynx ransomware data-leak (extortion) site on 2025-02-10.
Marshall Motor Holdings was named on the Lynx ransomware data-leak (extortion) site on 2025-02-10.
ome.tv | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-02-10.
Recievership Specialists was named on the BianLian ransomware data-leak (extortion) site on 2025-02-10.
sdfab.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
WhoHire was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
www.jsp.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. was named on the FOG ransomware data-leak (extortion) site on 2025-02-09.
Handala New Telegram Channel was named on the Handala ransomware data-leak (extortion) site on 2025-02-09.
Hpisd.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-09.
Israel Police Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-02-09.
Leading Edge Specialized Dentistry was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-09.
wwcsd.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-09.
G*********7.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-08.
M****s.info was named on the Flocker ransomware data-leak (extortion) site on 2025-02-08.
R******e.tw was named on the Flocker ransomware data-leak (extortion) site on 2025-02-08.
SAKAI SOUKEN Co. was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-08.
Gitlabs: Chalmers tekniska högskola, Fligno, 3SS was named on the FOG ransomware data-leak (extortion) site on 2025-02-07.
sautech.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-07.
teamues.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-07.
In early February 2025, Vorwerk's Thermomix recipe community Espace-Recettes.fr (Rezeptwelt) was breached via a compromised third-party server, exposing names, postal addresses, emails, phone numbers, dates of birth and cooking preferences of roughly 3.3 million users across several countries.
Gitlabs: eConceptions, Top Systems, DIEM was named on the FOG ransomware data-leak (extortion) site on 2025-02-06.
northernresponse.com\$17.4M\Canada\366GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-06.
Robertshaw was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-06.
savoiesfoods.com\$18.2M\USA\95GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-06.
SmithDunn&Co was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-06.
zsattorneys.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-06.
A2b-cargo.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-05.
Banfi Vintners was named on the Lynx ransomware data-leak (extortion) site on 2025-02-05.
corehandf.com was named on the Threeam ransomware data-leak (extortion) site on 2025-02-05.
Dash Business was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
Hall Chadwick was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
India car owners was named on the Bashe ransomware data-leak (extortion) site on 2025-02-05.
Mid-State Machine & Fabricating Corp was named on the Play ransomware data-leak (extortion) site on 2025-02-05.
NESCTC Security Services was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
OFW Law was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
Shinsung Delta Tech was named on the Lynx ransomware data-leak (extortion) site on 2025-02-05.
St Clair Orthopaedics and Sports Medicine P.C. was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
Toshapp.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-05.
alojaimi.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
C and R Molds Inc was named on the BianLian ransomware data-leak (extortion) site on 2025-02-04.
C2S Technologies Inc. was named on the Everest ransomware data-leak (extortion) site on 2025-02-04.
capstoneins.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Casper's Truck Equipment was named on the Kairos ransomware data-leak (extortion) site on 2025-02-04.
clarkfreightways.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
coel.com.mx was named on the Bashe ransomware data-leak (extortion) site on 2025-02-04.
Commercial Solutions was named on the BianLian ransomware data-leak (extortion) site on 2025-02-04.
cornwelltools.com\$218.7M\USA\4.6TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-04.
escada.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
gaheritagefcu.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Gitlabs: hemio.de, SOLEIL, Devlion was named on the FOG ransomware data-leak (extortion) site on 2025-02-04.
heartlandrvs.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
ITSS was named on the Everest ransomware data-leak (extortion) site on 2025-02-04.
Medical Reports was named on the Kairos ransomware data-leak (extortion) site on 2025-02-04.
mgainnovation.com\$30.9M\USA\215GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-04.
mistralsolutions.com was named on the Bashe ransomware data-leak (extortion) site on 2025-02-04.
rashtiandrashti.com\$19.1M\USA\786GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-04.
sportadmin.se was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Town Counsel Law & Litigation was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-04.
www.aswgr.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
www.aymcdonald.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Daniel Island Club was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
Dickerson & Nieman Realtors was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
DPC Development was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
[EVIDANCE] AIshu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-03.
Evidn Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-02-03.
Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia was named on the FOG ransomware data-leak (extortion) site on 2025-02-03.
gruppozaccaria.it was named on the LockBit ransomware data-leak (extortion) site on 2025-02-03.
Karadeniz Holding (karadenizholding.com) was named on the FOG ransomware data-leak (extortion) site on 2025-02-03.
KWS was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
ome.tv was named on the Bashe ransomware data-leak (extortion) site on 2025-02-03.
Pineland community service board was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-03.
Ponte16 Hotel & was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-03.
QGS Development was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
realtaxcanada.com was named on the Bashe ransomware data-leak (extortion) site on 2025-02-03.
Sheridan Nurseries was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
smithmidland.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-03.
The Hill Brush was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
Woodway USA was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
www.origene.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-03.
www.wongfleming.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-03.
Ayres Law Firm was named on the BianLian ransomware data-leak (extortion) site on 2025-02-02.
Civic Committee was named on the BianLian ransomware data-leak (extortion) site on 2025-02-02.
Four Eye Clinics was named on the Abyss ransomware data-leak (extortion) site on 2025-02-02.
Growth Acceleration Partners was named on the BianLian ransomware data-leak (extortion) site on 2025-02-02.
jpcgroupinc.com was named on the Abyss ransomware data-leak (extortion) site on 2025-02-02.
Tosaf Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-02-02.
usuhs.edu was named on the LockBit ransomware data-leak (extortion) site on 2025-02-02.
CAMRIDGEPORT was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-01.
Eascon was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Falcon Gaming was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
GATTELLI SpA was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof was named on the FOG ransomware data-leak (extortion) site on 2025-02-01.
My New Jersey Dentist was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-01.
Nano Health was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-01.
Technico was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Utilissimo Transportes was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Wireless Solutions (Morris.Domain) was named on the Lynx ransomware data-leak (extortion) site on 2025-02-01.
Zamzow's was named on the Lynx ransomware data-leak (extortion) site on 2025-02-01.
A**-****o.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-31.
BH Aircraft Company, Inc. was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-31.
Attackers exfiltrated Kenya's national company-registry data from the Business Registration Service — including ownership and beneficial-owner records touching President Ruto and the Kenyatta family's firms — and offered it for sale on the dark web.
Pembina Trails School Division was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-31.
T*****p.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-31.
Engine Power Source was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
FENSTERMAKER was named on the Monti ransomware data-leak (extortion) site on 2025-01-30.
Gitlabs: Prasaga, HE2B, Kombinat was named on the FOG ransomware data-leak (extortion) site on 2025-01-30.
Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG was named on the FOG ransomware data-leak (extortion) site on 2025-01-30.
ibericar was named on the Monti ransomware data-leak (extortion) site on 2025-01-30.
icicibank.com | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-01-30.
Jalaram Produce was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
jayaapparelgroup.com\$60.6M\USA\824GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
johnpaulrichard.com\$60M\USA\985GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
KPI Engineering was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
malindoair.com | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-01-30.
nenok.de was named on the Monti ransomware data-leak (extortion) site on 2025-01-30.
Night Hawk was named on the Play ransomware data-leak (extortion) site on 2025-01-30.
payahmedabadechallan.org was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-30.
Scott Engineering was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
Silverado Contractors was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
soitinlaine.fi was named on the Threeam ransomware data-leak (extortion) site on 2025-01-30.
sunrise-soya.com\$42.2M\Canada\504GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
In January 2025, the Rezeptwelt (German for "recipe world") forum for Thermomix owners suffered a data breach. The incident exposed 3.1M registered users' details including names, email and physical addresses, phone numbers, dates of birth and bios (usually cooking related).
Tri-Sen Systems was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
ttucorp.com\$27.6M\USA\1TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
vsstransportationgroup.com\$54.5M\USA\522GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
Zschimmer and Schwarz was named on the Termite ransomware data-leak (extortion) site on 2025-01-30.
air europa was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
alkodistributors.com\$33.5M\USA\345GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-29.
biagibros.com\$273M\USA\820GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-29.
Boldon James was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Boutin Jones (boutindentino.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-29.
By design was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Cahoon Farms was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Cimarron Telephone Company was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
City Of Beloit was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Commercial & Residential Management Group was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
daVinci was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
DEL Packaging was named on the Kairos ransomware data-leak (extortion) site on 2025-01-29.
Delta Screen & Filtration () was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
Heart to Heart Hospice was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Israel Ministry of National Security Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-01-29.
Johnston was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Marshall & Bruce Printing was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Menominee Tribal Clinic was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
midwaymetals.com.vn was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-29.
Mission Locale Montpellier was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Plymouth Foam was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Rossi Real Estate (ROSSIDG.LOCAL) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
SCV Med Group was named on the Monti ransomware data-leak (extortion) site on 2025-01-29.
Strategic Materials was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
The Wendt Agency was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
tnlottery.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
TRIVAD was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Turning Leaf (TURNINGLEAF.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
W*****e.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-29.
Wallin & Klarich was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Acoustiblok was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
BBLAWFIRM was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
broward.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-01-28.
Carthage Police Department was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-28.
cnnindonesia.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-28.
lnetwork was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
metalurgica roma was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
sce.org.sg was named on the Lynx ransomware data-leak (extortion) site on 2025-01-28.
www.healthcarewithinreach.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-28.
On 27 January 2025, French HIV/hepatitis-prevention charity AIDES disclosed a breach of a secured file-sharing server, exposing supporters' identity, contact and banking details (IBAN) and, for some, health-related information.
AIshu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-01-27.
Alo Center (hq.aloteknik.se) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-27.
https://leehartman.com was named on the Metaencryptor ransomware data-leak (extortion) site on 2025-01-27.
International AIDS Vaccine Initiative (iavi.org) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-27.
lhps.org was named on the Incransom ransomware data-leak (extortion) site on 2025-01-27.
Prinston Pharmaceutical (huahaius.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-27.
Weeks, Brucker & Coleman, Ltd | Legal Services was named on the Everest ransomware data-leak (extortion) site on 2025-01-27.
Let’s Secure Insurance was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-26.
Metro Wire & Cable was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-26.
DataSociete was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-25.
envirosep.com was named on the Abyss ransomware data-leak (extortion) site on 2025-01-25.
Keepz was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-25.
Arrow Motor Auctions was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-24.
De La Salle High School (dlshs.org) was named on the FOG ransomware data-leak (extortion) site on 2025-01-24.
In January 2025, 435k email addresses were scraped from the "doxing" service Doxbin. Posts to the service are usually intended to disclose the personal information of non-consensually third parties.
In January 2025, E.Leclerc's Prime énergie (energy-rebate) platform was hit by fraudulent account access, exposing customers' names, email addresses, login credentials, file numbers, rebate amounts and service descriptions; the breach was disclosed to affected users on 24 January 2025.
ELTEK Group (eltekgroup.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-24.
In late January 2025, the French Mountaineering and Climbing Federation (FFME) disclosed a breach exposing a dataset of 808,881 member accounts, including names, postal and email addresses, member IDs, dates of birth and phone numbers.
icicibank.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-24.
Kooijman Vianen (kooijmanvianen.nl) was named on the FOG ransomware data-leak (extortion) site on 2025-01-24.
ORU Mabee Center was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-24.
PrimoTicketing was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-24.
Punjab.gov.pk was named on the Flocker ransomware data-leak (extortion) site on 2025-01-24.
topackt.com was named on the LockBit ransomware data-leak (extortion) site on 2025-01-24.
www.pcm.com.mx was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-24.
archaeologicalresearchservices.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-23.
Cyrious Software was named on the BianLian ransomware data-leak (extortion) site on 2025-01-23.
Medical Associates of Brevard was named on the BianLian ransomware data-leak (extortion) site on 2025-01-23.
PINELAND BHDD COMMUNITY SERVICES was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-23.
reesndt.ca was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-23.
samsill.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-23.
starkaerospace.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-23.
www.missionbank.bank was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-23.
Christian Community Aid was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-22.
Gossett Motor Cars was named on the Lynx ransomware data-leak (extortion) site on 2025-01-22.
ilemgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
Jacobs & Thompson was named on the Lynx ransomware data-leak (extortion) site on 2025-01-22.
Mintz Law Firm, LLC was named on the Lynx ransomware data-leak (extortion) site on 2025-01-22.
Omni Fiber LLC - Press Release was named on the Monti ransomware data-leak (extortion) site on 2025-01-22.
SANTA MARIA LABORATORIO was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-22.
sdkgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.americanstandard-us.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.grohe.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.manpower.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.reesndt.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-22.
Bethany Hospital was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-21.
boardman-hamilton.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
FAAB Invest Advisors Private Limited was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-21.
Inaya Clinique was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-21.
malindoair.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-21.
Marukai was named on the Lynx ransomware data-leak (extortion) site on 2025-01-21.
miedemaproduce.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
Nimbus Facility Services was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-21.
precisionmechsd.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
RETAL Baltic Films was named on the Incransom ransomware data-leak (extortion) site on 2025-01-21.
Solaris-pharma.com leakage was named on the Everest ransomware data-leak (extortion) site on 2025-01-21.
supremegroup.co.in was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
whychoosebw.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
Angotti & Reilly was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
Clutch Industries was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
On 20 January 2025 the French Archery Federation (FFTA) disclosed a breach stemming from a flaw at its shared license-management provider; a dataset of 625,434 accounts (names, dates of birth, postal addresses, phones, emails, profile photos) was offered for sale online.
fol-23.fr was named on the Bashe ransomware data-leak (extortion) site on 2025-01-20.
Kinseth Hospitality Companies was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
P****b.gov.pk was named on the Flocker ransomware data-leak (extortion) site on 2025-01-20.
PetroVietnam Exploration Production Corporation was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-20.
Sentinel Systems was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
The Urswick School was named on the Kairos ransomware data-leak (extortion) site on 2025-01-20.
Zuk Group Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-01-20.
TG3 Electronics was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-19.
Kassin & Carrow was named on the Lynx ransomware data-leak (extortion) site on 2025-01-18.
Marina Family Medical was named on the Moneymessage ransomware data-leak (extortion) site on 2025-01-18.
MassDevelopment was named on the BianLian ransomware data-leak (extortion) site on 2025-01-18.
betclic.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-17.
Kilgore College (kilgore.edu) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Nightingale Hammerson was named on the Kairos ransomware data-leak (extortion) site on 2025-01-17.
peponline.org was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Regina Coeli Convent was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Taylor Regional Hospital (thcg.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Washington Gastroenterology (DHSWA.NET) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Access Capital Partners SA was named on the Lynx ransomware data-leak (extortion) site on 2025-01-16.
anupalanonline.com was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-16.
bsegroup.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-16.
Fish Nelson and Holden was named on the BianLian ransomware data-leak (extortion) site on 2025-01-16.
In January 2025, the eyewear seller Frame & Optic suffered a data breach. The incident exposed almost 16k unique email addresses along with names, phone numbers and geolocation data including country, state and postcode.
Real Tax was named on the Kairos ransomware data-leak (extortion) site on 2025-01-16.
Solaris Pharma proof was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
The Hoff Brand SL was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
Volt Infrastructure was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
Woodlake was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
www.liteputer.com.tw was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-16.
www.solariumrevestimentos.com.br was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-16.
A*****Y.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-15.
AKConstructors.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-15.
anwsd.org was named on the Threeam ransomware data-leak (extortion) site on 2025-01-15.
Combined Pool and Spa was named on the Kairos ransomware data-leak (extortion) site on 2025-01-15.
communisis.com & paragon.world was named on the Lynx ransomware data-leak (extortion) site on 2025-01-15.
fplfood.com\$675M\USA\21GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-15.
FSOCIETY X FUNKSEC was named on the Flocker ransomware data-leak (extortion) site on 2025-01-15.
J.G. Electrical Installations was named on the Kairos ransomware data-leak (extortion) site on 2025-01-15.
Lowe Engineers was named on the Lynx ransomware data-leak (extortion) site on 2025-01-15.
optiline.com\$127.3M\USA\947GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-15.
pnp.co.za was named on the Bashe ransomware data-leak (extortion) site on 2025-01-15.
Woodport Doors was named on the Lynx ransomware data-leak (extortion) site on 2025-01-15.
www.eurocert.pl was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-15.
Buttery (butterycompany.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-14.
Douglas County, GA (DDCWSA.COM) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-14.
Farmacia Cofar was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-14.
In January 2025, the Fédération Française de Force (FFForce) had personal data of 64,512 members exposed via a compromised shared sports-licensing IT provider; records (names, dates of birth, emails, postal addresses, phone numbers) were later sold on BreachForums.
In January 2025, the Fédération Française de Roller et Skateboard had the personal data of roughly 577,000 members exposed after a shared sports-federation IT provider was compromised; names, dates of birth, email/postal addresses and phone numbers were leaked.
Intelservice.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-14.
In January 2025, French clothing retailer Kiabi disclosed a credential-stuffing attack on its secondhand site (secondemain.kiabi.com) that exposed the names, dates of birth, contact details and IBANs of about 20,000 customers.
pittman-construction.com was named on the LockBit ransomware data-leak (extortion) site on 2025-01-14.
QualiTech (qualitech.com) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-14.
SciTech Services, Inc. was named on the FOG ransomware data-leak (extortion) site on 2025-01-14.
Sharm Reef Hotel was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-14.
Solaris Pharma was named on the Everest ransomware data-leak (extortion) site on 2025-01-14.
Spectrum was named on the Incransom ransomware data-leak (extortion) site on 2025-01-14.
The Chicano Federation was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-14.
The University of Oklahoma (ou.edu) was named on the FOG ransomware data-leak (extortion) site on 2025-01-14.
udb.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-14.
WPD.WOODPORTDOORS.COM was named on the Lynx ransomware data-leak (extortion) site on 2025-01-14.
adveo.com\$740.7M\France\1.1TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-13.
atpformosa.gob.ar was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Biomedical Caledonia Medical Laboratory (calmedlab.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
Browdy (bl.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
candelasyasociados.es was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Conad (conad.lan) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Delap & Waller was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Findhelp Information Services was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
gelco-s-a.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
healthcarewithinreach.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-13.
Imperial Valley Respite (ivrespite.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
lamejor.com.co was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
mi.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-13.
Nash Brothers Construction (nashdom.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
nicatel.com.uy was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Novati Constructions was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Onecare was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
oyolasvegas.com was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
PHG CPAs (bushman.biz) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Riverina Medical was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
SERGAS Group was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
In January 2025, stealer logs with 71M email addresses were added to HIBP. Consisting of email address, password and the website the credentials were entered against, this breach marks the launch of a new HIBP feature enabling the retrieval of the specific websites the logs were collected against.
telering.de was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
viacaojacarei.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Welcomehallmission.com was named on the Everest ransomware data-leak (extortion) site on 2025-01-13.
In January 2025, the GPS tracking service LandAirSea suffered a data breach that exposed 337k unique customer email addresses alongside names, usernames and password hashes.
Arun Estates was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Astaphans was named on the Lynx ransomware data-leak (extortion) site on 2025-01-11.
Avril Supermarché Santé was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Barber Specialties was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Bnext.nl was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Brachot was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
COROB was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Costex was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Granby Industries was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Jim Thompson was named on the Lynx ransomware data-leak (extortion) site on 2025-01-11.
Mortgage Investors Group (MIG) was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Patriarche Office of Architecture was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Plasma-Therm was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
RocSearch was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Schuff Steel Company was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
T. Hasegawa USA was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Unisource Information Services was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
amerplumb.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-10.
Evidn was named on the Everest ransomware data-leak (extortion) site on 2025-01-10.
massdevelopment.com\$24.6M\USA\1.2TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-10.
OmniRide (omniride.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-10.
Protected: Title Hidden was named on the Everest ransomware data-leak (extortion) site on 2025-01-10.
ptcky.com\$5M\USA\902GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-10.
Qualinet was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-10.
www.wisesocon.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-10.
xtremmedia.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-10.
alansarioman.com was named on the Embargo ransomware data-leak (extortion) site on 2025-01-09.
awimc.com\$102.7M\USA\440GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-09.
azpay.me | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-01-09.
castlehillha.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
CO-VER Power Technology SpA Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
depewgillen.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-09.
drive-lines.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
evasair.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-09.
Fukoku Co. Ltd. was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-09.
hapsch.de was named on the Threeam ransomware data-leak (extortion) site on 2025-01-09.
Izmocars Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
Myhealthcarebilling Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
Sarah Car Care Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
Infostealer malware on the endpoints of 15+ Telefónica employees gave the Hellcat ransomware group credentials into the company's internal Jira ticketing system. Social-engineering escalated the access to SSH. The group did not extort — it publicly published 2.3 GB including 24,000 employee emails, 470,000 internal Jira tickets, and 5,000 internal documents.
www.excelresourcing.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.fairhallzhang.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.leaguecenter.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.mie.com.my was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.primalwear.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.rotaryeng.co.th was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.temotekstil.com.tr was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
acquafertil.com.br was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-08.
bendixengineering was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-01-08.
fwmep.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-01-08.
General Digital was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-08.
General Digital CRM was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-08.
Huntington Hotel Group was named on the Termite ransomware data-leak (extortion) site on 2025-01-08.
kingpower.com was named on the Abyss ransomware data-leak (extortion) site on 2025-01-08.
sahpetrol.com.tr was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-08.
In January 2025, a data breach of the publishing company Scholastic surfaced. The breach contained 4.2M unique email addresses with many of the records also including name, phone number and physical address.
astaphans.com was named on the Lynx ransomware data-leak (extortion) site on 2025-01-07.
jimthompson.com was named on the Lynx ransomware data-leak (extortion) site on 2025-01-07.
Saint-Bar (saintbar.be) was named on the FOG ransomware data-leak (extortion) site on 2025-01-07.
Sunflower Medical Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-07.
u0 Excel Transportation was named on the Lynx ransomware data-leak (extortion) site on 2025-01-07.
molars.co.ke was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-06.
yoniot.cn was named on the Darkvault ransomware data-leak (extortion) site on 2025-01-06.
akantha.fr was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-05.
Car Care Plan - Turkey was named on the Hellcat ransomware data-leak (extortion) site on 2025-01-05.
Hunter Taubman Fischer & Li was named on the Lynx ransomware data-leak (extortion) site on 2025-01-05.
aliorbank.pl was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
assurified.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
baldinger-ag.ch was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
bigalsfoodservice.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
bms.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
certifiedinfosec.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
credio.eu was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
datascan.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-04.
fpj.com.py PART1 was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
fpj.com.py PART2 was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
fpj.com.py PART3 was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
gannons.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
hasa-arg.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-04.
lamaisonducitron.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
legilog.fr was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
minerasancristobal.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
Montreal North was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-04.
netromsoftware.ro was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
northernsafety.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
perucontrols.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-04.
pindrophearing.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
polleninformation.at was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
prixet.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
protectasecurity.pe was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
sansirostadium.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
scopeset.de was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
sella.eng.br was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
servicepower.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
sfr.fr was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
siapenet.gov.br was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
talonsolutions.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
trifecta.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
trinitesolutions.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
Amourgis & Associates was named on the Lynx ransomware data-leak (extortion) site on 2025-01-03.
Nikki-Universal Co Ltd was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-03.
www.alliancemat.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-03.
www.geedingconstruction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-03.
confluxhr.com was named on the Darkvault ransomware data-leak (extortion) site on 2025-01-02.
groupegm.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-02.
CM Buck & Associates was named on the Lynx ransomware data-leak (extortion) site on 2025-01-01.
http://www.kitevuc.com was named on the Ciphbit ransomware data-leak (extortion) site on 2025-01-01.
lianbeng.sg was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-01.
regencymedia was named on the LockBit ransomware data-leak (extortion) site on 2025-01-01.