Radar

Major cyber attacks witnessed globally.

SOCRadar's continuously updated chronology of high-impact cyber incidents, with threat actor attribution, attack vectors, and industry impact.

Updated weekly 500+ incidents logged Global coverage

2025 attacks (48 incidents).

Company / Country	Industry	Details	Attack Vector	Threat Group
Medtronic	Medical Technology / Healthcare	Attackers allegedly stole over 9 million records and terabytes of corporate data.	Unauthorized corporate IT access	ShinyHunters
ADT	Home Security / Consumer Services	Breach exposed data tied to 5.5 million customers, including contact and identity information.	Vishing / stolen Okta SSO credentials / Salesforce access	ShinyHunters
McGraw Hill	Education / Publishing	Salesforce-related exposure leaked 13.5 million unique emails and over 100GB of data.	Salesforce misconfiguration	ShinyHunters
Drift Protocol	DeFi / Cryptocurrency	Attackers seized governance control and drained approximately $280 million from protocol users.	Social engineering / pre-signed multisig approvals / durable nonce abuse	North Korean actors
KelpDAO / LayerZero	DeFi / Cryptocurrency	Attackers manipulated verifier infrastructure and stole approximately $290 million in rsETH.	Compromised RPC nodes / DDoS / verifier takeover	Lazarus Group / TraderTraitor
Axios	Software / Open Source	Compromised maintainer account enabled malicious npm releases installing remote access malware across platforms.	Fake Teams call / social engineering / credential theft / supply chain compromise	UNC1069
Checkmarx	Application Security / Software	Attackers leaked roughly 96GB of GitHub data after earlier supply chain compromise.	Stolen GitHub credentials / supply chain compromise	TeamPCP / LAPSUS$
Basic-Fit	Fitness / Consumer Services	Internal system breach exposed personal and banking data of approximately one million members.	Internal system compromise	Unknown
Grinex Exchange	Cryptocurrency Exchange	Attackers stole approximately $13.7 million, forcing the exchange to suspend operations.	Unknown	Unknown
Bitcoin Depot	Cryptocurrency / Bitcoin ATM	Stolen credentials enabled theft of approximately $3.6 million in Bitcoin from company wallets.	Stolen settlement account credentials	Unknown
Instructure / Canvas	Education Technology	Canvas breach exposed roughly 275 million records across approximately 9,000 educational institutions.	Free-For-Teacher account abuse / platform access	ShinyHunters
Charter Communications	Telecommunications	Attackers allegedly leaked 42 million records containing customer, support, and employee information.	Vishing / Microsoft Entra credential theft / Salesforce compromise	ShinyHunters
Checkmarx	Application Security / Software	Backdoored Jenkins plugin harvested cloud credentials, GitHub tokens, SSH keys, and API secrets.	Stolen credentials / malicious Jenkins plugin / supply chain compromise	TeamPCP
GitHub	Software Development / Cloud Platform	Poisoned Nx Console extension enabled theft of credentials and cloning of 3,800 repositories.	Malicious VS Code extension / credential theft	TeamPCP
npm / @antv Ecosystem	Software Development / Package Registry	Worm compromised 639 package versions, stealing developer secrets and propagating through maintainer accounts.	Compromised npm maintainer account / malicious packages / supply chain worm	TeamPCP
Fortinet / Global	Network Security / Infrastructure	FortiBleed exposed credentials for 86,644 Fortinet firewalls across 194 countries.	Cracked exposed FortiGate configuration password hashes	Russian-speaking threat group
Oracle PeopleSoft / Higher Education	Enterprise Software / Education	Zero-day campaign compromised over 100 organizations and leaked hundreds of thousands of student records.	CVE-2026-35273 unauthenticated RCE / lateral movement	ShinyHunters / UNC6240
KDDI / Japan	Telecommunications	Third-party software flaw potentially exposed email credentials belonging to 14.22 million ISP accounts.	Third-party software vulnerability	Unknown
DentaQuest	Healthcare / Dental Benefits	Breach exposed 234GB of healthcare enrollment data affecting millions of individuals.	Unauthorized network access	ShinyHunters
Klue / Multiple Cybersecurity Firms	SaaS / Competitive Intelligence	Dormant integration credential enabled OAuth token theft and Salesforce access across multiple customers.	Dormant credential / OAuth token theft / Salesforce compromise	Icarus
Red Hat / npm	Software / Open Source	Miasma-infected packages harvested developer credentials and self-propagated through compromised publishing access.	Compromised GitHub account / CI/CD supply chain compromise	TeamPCP-linked, uncertain
PyPI Research Packages	Software / Package Registry	Hades worm compromised research packages, stealing credentials through persistent Python startup hooks.	Malicious PyPI packages / supply chain worm	Unknown
npm / asteroiddao	Software / Package Registry	IronWorm infected 36 packages, stealing cloud, API, wallet, and developer credentials.	Compromised npm account / malicious packages / supply chain attack	Unknown
Texas Parks and Wildlife / United States	Government / Wildlife Services	Vendor breach exposed identity and contact information belonging to approximately 3.09 million license holders.	Third-party vendor compromise	Unknown
Xsolis	Healthcare Technology	Phishing-driven breach exposed protected health information belonging to approximately 1.4 million individuals.	Phishing	Unknown
Maine Attorney General / United States	Government	Fraudulent VRChat and Discord breach filings forced suspension of the public notification portal.	Fraudulent breach submissions / portal abuse	Unknown
BreachForums	Cybercrime / Underground Forum	Database leak exposed 323,986 users’ emails, IP addresses, usernames, and metadata.	Unknown	Unknown
Trust Wallet	Cryptocurrency / FinTech	Trojanized Chrome extension stole mnemonic phrases, draining $8.5 million from 2,520 wallets.	Supply chain compromise / malicious browser extension	Unknown
Instagram / Meta	Social Media	Alleged scraped dataset exposed approximately 17 million profiles containing identity and contact data.	Alleged API scraping	Unknown
Betterment	Financial Services / FinTech	Social engineering compromise exposed data belonging to approximately 1.4 million Betterment customers.	Phishing / social engineering / third-party platform compromise	ShinyHunters
Okta / Multiple Organizations	Identity and Access Management	Vishing campaign used real-time phishing kits to capture enterprise authentication credentials and sessions.	Vishing / real-time phishing kits	ShinyHunters
SoundCloud	Music Streaming / Technology	Breach exposed 29.8 million accounts, linking email addresses with public profile information.	Unknown	ShinyHunters
Telecom Companies / Cloudflare	Telecommunications / IT Infrastructure	Aisuru botnet launched record 31.4 Tbps DDoS attacks exceeding 200 million RPS.	DDoS / botnet / HTTP and Layer 4 floods	Unknown
Odido	Telecommunications	Breach exposed 6.2 million customers, including financial, identity, and sensitive support data.	Unknown	ShinyHunters
ManoMano	E-commerce	Compromised support environment allegedly exposed data linked to approximately 37.8 million accounts.	Compromised third-party customer service portal	Indra
CarGurus	Automotive Marketplace	Leak exposed 12.4 million records containing personal, contact, and financing-related information.	Unknown	ShinyHunters
France	Government / Financial Administration	Hacker accessed national database containing banking and identity data for 1.2 million accounts.	Stolen official credentials	Unknown
Panera Bread	Food Service / Restaurants	Breach exposed contact information belonging to approximately 5.1 million unique individuals.	Microsoft Entra SSO compromise (claimed)	ShinyHunters
Figure	Financial Services / FinTech	Breach exposed 967,200 unique emails alongside names, birthdates, addresses, and phone numbers.	Unknown	ShinyHunters
Stryker	Medical Technology / Healthcare	Destructive attack wiped over 80,000 corporate devices and disrupted operations across 79 countries.	Microsoft Intune compromise / remote device wiping	Handala
Telus Digital	Business Process Outsourcing	Attackers stole at least 700TB of sensitive client, employee, source code, and support data.	Stolen credentials / cloud account compromise	ShinyHunters
Navia Benefit Solutions	Employee Benefits / Healthcare Administration	API vulnerability exposed personal and health information belonging to approximately 2.7 million individuals.	BOLA API vulnerability	Unknown
Trivy / Checkmarx / Package Ecosystems	Software Development / DevSecOps	Supply chain campaign poisoned trusted releases, packages, workflows, extensions, and developer tooling.	Software supply chain / exposed CI/CD credentials	TeamPCP
Crunchyroll	Entertainment / Streaming	Support system breach allegedly exposed 6.8 million emails and millions of customer tickets.	Third-party employee malware / Okta SSO / Zendesk compromise	Unknown
TriZetto Provider Solutions	Healthcare IT	Year-long portal breach exposed personal and health information of approximately 3.4 million patients.	External web portal compromise	Unknown
University of Hawaii Cancer Center	Education / Healthcare Research	Ransomware attack exposed research and historical identity records affecting approximately 1.24 million individuals.	Ransomware	Unknown

How incidents are tracked and verified.

Every entry in this chronology is sourced through a layered intelligence pipeline combining open-source monitoring, SOCRadar CTI analyst review, and cross-validation against regulatory disclosures.

Monitor.

We track hacker forums, Telegram leak channels, ransomware extortion sites, and regulatory disclosures.

→

Attribute.

SOCRadar CTI analysts cross-reference TTPs and infrastructure to attribute attacks to known groups.

→

Publish.

Verified incidents are added to the public chronology within 24 hours of confirmation.

Regulatory Filings Extortion Portals Hacker Forums Telegram Threat Reports Vendor Advisories

Attributions reflect the prevailing consensus from open and SOCRadar-internal sources at publication time. Entries may be updated as investigations progress.

Stay ahead of the next major incident.

Get the SOCRadar weekly briefing with new attacks, threat actor TTP changes, and industry spotlight.

Subscribe to Weekly Briefing →