TransUnion stressed that the breach did not involve its core credit database or internal systems, a technically important distinction that nonetheless offers limited comfort to affected consumers. According to the disclosure to the Texas Attorney General, the exposed information includes names, Social Security numbers, and dates of birth. In addition to the personal information that TransUnion reported as compromised, addresses, email addresses, and phone numbers were also stolen according to the hackers’ claims, data categories that TransUnion’s own notifications did not explicitly enumerate but did not categorically deny.
Farmers Insurance was among the first confirmed major victims outside the technology sector. The Cloudflare disclosure prompted the broader security industry to audit its own Salesforce integrations and connected app permissions, a response that came months after the initial vishing wave had already run its course. Whether attackers were collecting competitive intelligence, searching for vulnerability data https://letstalkaboutit.info/if-you-think-you-understand-then-this-might-change-your-mind-4/ applicable to customer environments, or building a target list for future campaigns, the concentration of security industry victims in the Salesforce breach cascade was not coincidental.
- The health sector accounted for the most reported data breaches, at 18% of all notifications, followed by the finance sector at 14% and Australian Government agencies at 13%.
- In the age of enshittification, there is a push to reclaim our feeds and networks.
- Every company that collects this information becomes a target for data breaches — and if a breach happens, you can’t just change your face.
- MailChimp claims that a threat actor was able to gain access to its systems through a social engineering attack, and was then able to access data attached to 133 MailChimp accounts.
- The blast radius extended to over 700 organizations, and the automated AuraInspector campaign that ran through September added an unknown number of records from misconfigured Experience Cloud sites.
Identifying these phases reduces the time taken in detection and enhances response time and efficiency. Regardless of whether the breach comes from an outsider or an insider attack, data breaches follow a pattern. In the following section, we classify major breach variants that form the data breach cycle, each of which has different angles of intrusion and difficulties.
- Second, assess what happened by gathering facts and evaluating risks to affected individuals.
- We’ve compiled 84 data breach statistics that cover types of data breaches, industry-specific stats, risks, and costs, as well as data breach defense and prevention resources.
- ZachXBT had reported $45 million in Coinbase user losses to social engineering attacks in early May 2025, and estimates from Elliptic placed total breach-related losses, including remediation and downstream fraud, at up to $400 million.
- No confirmed direct breach of Target, Walmart, Kroger, or Costco’s core retail infrastructure was publicly disclosed in 2025 at the scale of prior landmark incidents; Target’s 2013 breach affected 40 million payment cards, and no equivalent event struck the major grocery and big-box chains in 2025.
- A new court filing alleges that four months ago, background check company National Public Data (NPD) was breached by hacking group USDoD.
- HealthEquity, the health savings account administrator, continued notifying individuals in 2025 following a 2024 third-party breach that ultimately affected 4.3 million individuals, one of the larger HSA-sector exposures on record.
Major Security Incidents & Data Breaches (Disclosed January)
It means organizations that invested in AI-powered security got faster and cheaper at containing breaches, while the volume of attacks against everyone else continued to accelerate. Understanding the threat actors behind 2025’s breaches is the first step, but knowing whether your organization’s data has already been compromised by one of their campaigns is the operational priority. The breach was linked to $355 million in downstream social engineering losses, attackers using the stolen personal and financial data to impersonate Coinbase support staff and manipulate victims into transferring funds to attacker-controlled wallets. In either case, the group demonstrated that new threat actors can rapidly access established extortion platforms and amplify their leverage against enterprise targets far beyond what their own reputation or infrastructure would support independently. The partnership was modular, operationally efficient, and deliberately structured to distribute law enforcement risk across loosely affiliated members in multiple jurisdictions.
Threat actors
Once governments and businesses moved from paper to digital storage, data breaches became more commonplace. Proper security for virtual environments is crucial to stopping data breaches. We’ve compiled 84 data breach statistics that cover types of data breaches, industry-specific stats, risks, and costs, as well as data breach defense and prevention resources. 🚨 Varonis Threat Labs uncovered SearchLeak, a new AI vulnerability within Microsoft 365 Copilot. Where appropriate, we may liaise with the above organisations about the incidents reported to us. We also have a detailed guide about how to manage a breach, including risk assessments and informing individuals.
Nonetheless, this year’s winner of The We Still Told You So Breachies Award is the messaging app, Discord — once known mainly for gaming communities, it now hosts more than 200 million monthly active users and is widely used to host fandom and community channels. Last year, AU10TIX won our first The We Told You So Award because as we predicted in 2023, age verification mandates would inevitably lead to more data breaches, potentially exposing government IDs as well as information about the sites that a user visits. We’ve long warned that apps delivering your personal information to third-parties, even if they aren’t the ad networks directly driving surveillance capitalism, presents risks and a salient target for hackers. In most cases, if these companies practiced a privacy first https://cryptocurrencyminingreport.com/ip-workflows/mediakinds-next-gen-integrated-receiver-decoder/ approach and focused on data minimization, only collecting and storing what they absolutely need to provide the services they promise, many data breaches would be far less harmful to the victims. To catalog and talk about these breaches we created the Breachies, a series of tongue-in-cheek awards, to highlight the most egregious data breaches.