Radar

Los principales ciberataques registrados a nivel mundial.

La cronología de SOCRadar, actualizada continuamente, sobre incidentes cibernéticos de alto impacto, con atribución de actores de amenazas, vectores de ataque e impacto por industria.

Actualizado semanalmente Más de 500 incidentes registrados Cobertura global

Ataques de 2025 (48 incidentes).

Empresa / País	Industria	Detalles	Vector de Ataque	Grupo de Amenazas
Medtronic	Medical Technology / Healthcare	Attackers allegedly stole over 9 million records and terabytes of corporate data.	Unauthorized corporate IT access	ShinyHunters
ADT	Home Security / Consumer Services	Breach exposed data tied to 5.5 million customers, including contact and identity information.	Vishing / stolen Okta SSO credentials / Salesforce access	ShinyHunters
McGraw Hill	Education / Publishing	Salesforce-related exposure leaked 13.5 million unique emails and over 100GB of data.	Salesforce misconfiguration	ShinyHunters
Drift Protocol	DeFi / Cryptocurrency	Attackers seized governance control and drained approximately $280 million from protocol users.	Social engineering / pre-signed multisig approvals / durable nonce abuse	North Korean actors
KelpDAO / LayerZero	DeFi / Cryptocurrency	Attackers manipulated verifier infrastructure and stole approximately $290 million in rsETH.	Compromised RPC nodes / DDoS / verifier takeover	Lazarus Group / TraderTraitor
Axios	Software / Open Source	Compromised maintainer account enabled malicious npm releases installing remote access malware across platforms.	Fake Teams call / social engineering / credential theft / supply chain compromise	UNC1069
Checkmarx	Application Security / Software	Attackers leaked roughly 96GB of GitHub data after earlier supply chain compromise.	Stolen GitHub credentials / supply chain compromise	TeamPCP / LAPSUS$
Basic-Fit	Fitness / Consumer Services	Internal system breach exposed personal and banking data of approximately one million members.	Internal system compromise	Unknown
Grinex Exchange	Cryptocurrency Exchange	Attackers stole approximately $13.7 million, forcing the exchange to suspend operations.	Unknown	Unknown
Bitcoin Depot	Cryptocurrency / Bitcoin ATM	Stolen credentials enabled theft of approximately $3.6 million in Bitcoin from company wallets.	Stolen settlement account credentials	Unknown
Instructure / Canvas	Education Technology	Canvas breach exposed roughly 275 million records across approximately 9,000 educational institutions.	Free-For-Teacher account abuse / platform access	ShinyHunters
Charter Communications	Telecommunications	Attackers allegedly leaked 42 million records containing customer, support, and employee information.	Vishing / Microsoft Entra credential theft / Salesforce compromise	ShinyHunters
Checkmarx	Application Security / Software	Backdoored Jenkins plugin harvested cloud credentials, GitHub tokens, SSH keys, and API secrets.	Stolen credentials / malicious Jenkins plugin / supply chain compromise	TeamPCP
GitHub	Software Development / Cloud Platform	Poisoned Nx Console extension enabled theft of credentials and cloning of 3,800 repositories.	Malicious VS Code extension / credential theft	TeamPCP
npm / @antv Ecosystem	Software Development / Package Registry	Worm compromised 639 package versions, stealing developer secrets and propagating through maintainer accounts.	Compromised npm maintainer account / malicious packages / supply chain worm	TeamPCP
Fortinet / Global	Network Security / Infrastructure	FortiBleed exposed credentials for 86,644 Fortinet firewalls across 194 countries.	Cracked exposed FortiGate configuration password hashes	Russian-speaking threat group
Oracle PeopleSoft / Higher Education	Enterprise Software / Education	Zero-day campaign compromised over 100 organizations and leaked hundreds of thousands of student records.	CVE-2026-35273 unauthenticated RCE / lateral movement	ShinyHunters / UNC6240
KDDI / Japan	Telecommunications	Third-party software flaw potentially exposed email credentials belonging to 14.22 million ISP accounts.	Third-party software vulnerability	Unknown
DentaQuest	Healthcare / Dental Benefits	Breach exposed 234GB of healthcare enrollment data affecting millions of individuals.	Unauthorized network access	ShinyHunters
Klue / Multiple Cybersecurity Firms	SaaS / Competitive Intelligence	Dormant integration credential enabled OAuth token theft and Salesforce access across multiple customers.	Dormant credential / OAuth token theft / Salesforce compromise	Icarus
Red Hat / npm	Software / Open Source	Miasma-infected packages harvested developer credentials and self-propagated through compromised publishing access.	Compromised GitHub account / CI/CD supply chain compromise	TeamPCP-linked, uncertain
PyPI Research Packages	Software / Package Registry	Hades worm compromised research packages, stealing credentials through persistent Python startup hooks.	Malicious PyPI packages / supply chain worm	Unknown
npm / asteroiddao	Software / Package Registry	IronWorm infected 36 packages, stealing cloud, API, wallet, and developer credentials.	Compromised npm account / malicious packages / supply chain attack	Unknown
Texas Parks and Wildlife / United States	Government / Wildlife Services	Vendor breach exposed identity and contact information belonging to approximately 3.09 million license holders.	Third-party vendor compromise	Unknown
Xsolis	Healthcare Technology	Phishing-driven breach exposed protected health information belonging to approximately 1.4 million individuals.	Phishing	Unknown
Maine Attorney General / United States	Government	Fraudulent VRChat and Discord breach filings forced suspension of the public notification portal.	Fraudulent breach submissions / portal abuse	Unknown
BreachForums	Cybercrime / Underground Forum	Database leak exposed 323,986 users’ emails, IP addresses, usernames, and metadata.	Unknown	Unknown
Trust Wallet	Cryptocurrency / FinTech	Trojanized Chrome extension stole mnemonic phrases, draining $8.5 million from 2,520 wallets.	Supply chain compromise / malicious browser extension	Unknown
Instagram / Meta	Social Media	Alleged scraped dataset exposed approximately 17 million profiles containing identity and contact data.	Alleged API scraping	Unknown
Betterment	Financial Services / FinTech	Social engineering compromise exposed data belonging to approximately 1.4 million Betterment customers.	Phishing / social engineering / third-party platform compromise	ShinyHunters
Okta / Multiple Organizations	Identity and Access Management	Vishing campaign used real-time phishing kits to capture enterprise authentication credentials and sessions.	Vishing / real-time phishing kits	ShinyHunters
SoundCloud	Music Streaming / Technology	Breach exposed 29.8 million accounts, linking email addresses with public profile information.	Unknown	ShinyHunters
Telecom Companies / Cloudflare	Telecommunications / IT Infrastructure	Aisuru botnet launched record 31.4 Tbps DDoS attacks exceeding 200 million RPS.	DDoS / botnet / HTTP and Layer 4 floods	Unknown
Odido	Telecommunications	Breach exposed 6.2 million customers, including financial, identity, and sensitive support data.	Unknown	ShinyHunters
ManoMano	E-commerce	Compromised support environment allegedly exposed data linked to approximately 37.8 million accounts.	Compromised third-party customer service portal	Indra
CarGurus	Automotive Marketplace	Leak exposed 12.4 million records containing personal, contact, and financing-related information.	Unknown	ShinyHunters
France	Government / Financial Administration	Hacker accessed national database containing banking and identity data for 1.2 million accounts.	Stolen official credentials	Unknown
Panera Bread	Food Service / Restaurants	Breach exposed contact information belonging to approximately 5.1 million unique individuals.	Microsoft Entra SSO compromise (claimed)	ShinyHunters
Figure	Financial Services / FinTech	Breach exposed 967,200 unique emails alongside names, birthdates, addresses, and phone numbers.	Unknown	ShinyHunters
Stryker	Medical Technology / Healthcare	Destructive attack wiped over 80,000 corporate devices and disrupted operations across 79 countries.	Microsoft Intune compromise / remote device wiping	Handala
Telus Digital	Business Process Outsourcing	Attackers stole at least 700TB of sensitive client, employee, source code, and support data.	Stolen credentials / cloud account compromise	ShinyHunters
Navia Benefit Solutions	Employee Benefits / Healthcare Administration	API vulnerability exposed personal and health information belonging to approximately 2.7 million individuals.	BOLA API vulnerability	Unknown
Trivy / Checkmarx / Package Ecosystems	Software Development / DevSecOps	Supply chain campaign poisoned trusted releases, packages, workflows, extensions, and developer tooling.	Software supply chain / exposed CI/CD credentials	TeamPCP
Crunchyroll	Entertainment / Streaming	Support system breach allegedly exposed 6.8 million emails and millions of customer tickets.	Third-party employee malware / Okta SSO / Zendesk compromise	Unknown
TriZetto Provider Solutions	Healthcare IT	Year-long portal breach exposed personal and health information of approximately 3.4 million patients.	External web portal compromise	Unknown
University of Hawaii Cancer Center	Education / Healthcare Research	Ransomware attack exposed research and historical identity records affecting approximately 1.24 million individuals.	Ransomware	Unknown

Cómo se rastrean y verifican los incidentes.

Cada entrada de esta cronología se obtiene mediante un proceso de inteligencia por capas que combina monitoreo de fuentes abiertas, revisión de analistas de CTI de SOCRadar y validación cruzada frente a divulgaciones regulatorias.

Monitorear.

Rastreamos foros de hackers, canales de filtración en Telegram, sitios de extorsión de ransomware y divulgaciones regulatorias.

→

Atribuir.

Los analistas de CTI de SOCRadar cruzan TTPs e infraestructura para atribuir los ataques a grupos conocidos.

→

Publicar.

Los incidentes verificados se añaden a la cronología pública dentro de las 24 horas posteriores a su confirmación.

Presentaciones Regulatorias Portales de Extorsión Foros de Hackers Telegram Informes de Amenazas Avisos de Proveedores

Las atribuciones reflejan el consenso predominante entre fuentes abiertas e internas de SOCRadar al momento de la publicación. Las entradas pueden actualizarse a medida que avanzan las investigaciones.

Adelántate al próximo gran incidente.

Recibe el resumen semanal de SOCRadar con nuevos ataques, cambios en las TTP de actores de amenazas y un enfoque destacado por industria.

Suscribirse al Resumen Semanal →