After studying English Literature and Creative Writing, they worked on local newspapers and online publications, including Outlander Magazine. The strangely-worded letter sent out to customers suggested that “a person who searched for a particular package or misused a package lookup tool” could have uncovered personal information relating to customers, such as phone numbers. From small startups to huge corporations, these breaches are impacting everyone and understanding the full scope of the problem is the first step to preventing your business from falling victim. As a privacy and consumer advocacy organization, we approach artificial intelligence with both careful consideration and concern. We recognize AI’s profound implications for civil liberties, environmental justice, economic equity, and the concentration of power in the technology sector. These issues are at the core of our mission and shape our approach to using AI in our work.
The breach was caused by the exploitation of vulnerabilities in Cleo’s file transfer software, including flaws that allowed unauthorized file uploads/downloads and command execution. The breach has impacted multiple organizations, with data being exfiltrated from companies like Hertz and WK Kellogg. The leaked data included applicants’ full names, email addresses, and phone numbers. The breach potentially exposed the personal data of approximately 64 million job applicants globally. The breach affected the personal information of up to 6 million Qantas customers, with Qantas later confirming a precise figure of 5.7 million unique customer records.
Trust our attorney-vetted privacy policy generator along with our terms of service generator and EULA generator. Our platform is packed with features to bolster your consumer data security and reduce the risk of a privacy breach. The most recent example of a privacy breach comes from Canada, after a damaging cybersecurity incident hit Suncor Energy — one of its largest petroleum companies. Details of the incident are still not clear and the company’s systems are not fully operational yet, even a week after the initial outage. In 2025, the Data Breach Chronology captured 8,019 data breach notification filings from state and federal agencies that publish breach reports. These represented 4,080 unique breach events impacting at least 375 million individuals.
In May 2025, M&S suffered a major cyberattack attributed to the “Scattered Spider” group, deploying DragonForce ransomware to encrypt virtual machines and steal customer data, severely disrupting online retail systems. The breach, potentially linked to vulnerabilities in M&S’s IT outsourcing partner, Tata Consultancy Services, is expected to cause a £300 million ($400 million) profit loss, with recovery projected to extend into July 2025. The breach impacted a wide array of Salesloft’s customers, with security researchers estimating that over 700 organizations were affected. While Zscaler was a prominent victim, other companies like Google and Allianz Life were also impacted due to their use of the platform’s integrations. The ransomware attack compromised the sensitive data of over 45,000 residents and employees. Motility Software Solutions, a provider of dealer management software (DMS), experienced a data breach.
The “meticulously gathered and maintained” database offered comprehensive behavioral, economic, and social profiles of the vast majority of the Chinese population. Researchers believe that one collection, named “tw_db” contains Taiwan-related details. In a new blow to Ola Bini’s legal guarantees, Ecuadorean authorities retained the free software developer and security expert yesterday in Quito and ordered his immediate deportation from the country. The whole blog is worth a read as a reminder that phishing can get anyone, and we thank Troy Hunt for his feedback on this and other breaches to include this year. For indirect notifications, you should consider measures used for other public announcements.
- The University of Pennsylvania was the victim of two breaches in the same month.
- Cause of the breach was a sophisticated cyberattack that exploited vulnerabilities in GrubHub’s systems.
- The PowerSchool data breach in February 2025 compromised the sensitive information of approximately 62 million students, making it a major cybersecurity incident within the education sector.
- No credentials or payment data were taken, but the value to attackers is the mapping between a real email address and a named creator profile, high-quality raw material for targeted phishing against musicians and rights holders.
What Is The Biggest Healthcare Data Breach?
Those figures count exposures of personal information rather than unique people. We attribute each event to the half of the year in which it was first reported. Learn the key GDPR basics for companies — from mandatory documents and technical and organizational measures to DPAs, data subject rights, and data breaches. In early 2025, Hertz reported a data breach caused by a vulnerability at third-party provider Cleo, a file-sharing service. In the following article, you will find the most important data breaches of 2025 along with practical lessons companies can use to prevent similar incidents.
University Of Pennsylvania Data Breaches: Two Hits In November
The February 2025 edition of our Data Breach Report highlights some of the most significant cybersecurity incidents affecting organizations across various industries. From massive data leaks exposing billions of records to targeted ransomware attacks compromising highly sensitive information, this month’s breaches reveal critical vulnerabilities in cybersecurity defenses. In this report, we break down the key details of each breach, including the scale of the exposure, the types of data compromised, and the underlying causes that led to these incidents. April 2025 marked a concerning month in cybersecurity, with data breaches impacting a wide array of industries—from healthcare and finance to telecommunications and even professional sports. Millions of individuals had their sensitive data compromised as a result of ransomware attacks, third-party vulnerabilities, software misconfigurations, and unauthorized access incidents.
Manpower clarified that the attack was isolated to the franchise’s network and did not affect ManpowerGroup’s wider corporate systems, and the company has offered complimentary credit monitoring to those affected. The breach exposed the data of a limited number of Google’s business customers. While Google stated that no consumer passwords or financial data were compromised, the company issued a warning to its 2.5 billion Gmail users due to the potential for targeted follow-up attacks. Because social engineering and phishing attacks are leading causes of breaches, training employees to recognize and avoid these attacks can reduce a company’s risk of a data breach. In addition, training employees to handle data properly can help prevent accidental data breaches and data leaks. The terms “data breach” and “breach” are often used interchangeably with “cyberattack.” However, not all cyberattacks are data breaches.
We track notifications and group them by breach event using the information available. This is a challenging task because a single breach usually produces many varying notifications across different states and over time. Our published counts report events rather than individual filings, and for each event we use the largest affected count reported across its filings.
India’s opposition parties are asking the government to urgently launch a probe into the breach and create a working data security plan for government agencies and departments. Customer names https://asiatalksreview.com/ and some information about their current Anthropic balances were the only types of information leaked in the incident, and customers impacted by the mistake have been notified. Students and guardians may have had their personal information stolen from the system by a threat actor who managed to find a way in via a remote access server. The hack is known to have occurred at the beginning of the month, but that information was only made public by city officials this week. Additionally, the consequences of these breaches are nothing if not substantial.
Attackers broke into roughly 14,000 accounts using recycled passwords and then leveraged the DNA Relatives feature to harvest profile data on 6.9 million people who had never had their own accounts compromised. Datasets specifically targeting people of Ashkenazi Jewish and Chinese descent were advertised for sale, which turned the incident into an ethnic targeting concern rather than a conventional identity theft case. 23andMe initially blamed customers for password reuse and changed its terms of service to restrict class actions, both of which drew heavy criticism.
We recommend agencies prepare by having a breach management plan and that they practice it through group scenarios so they are prepared and can act efficiently when the time comes. Case notes and examples are a great way to learn about privacy by understanding how others have responded to a breach. We’re working hard, but there might be delays in progressing your complaint. Depending on your jurisdiction and the harm involved, you may be able to bring a civil claim for compensation, either individually or as part of a class action. Privacy Rights Clearinghouse makes no representations as to the accuracy of the information included in the Data Breach Chronology. While we work to minimize issues like hallucination or incorrect inferences through careful system design and validation steps, we acknowledge that complete elimination of these problems isn’t currently possible.