The researcher claimed bug bounty protections; Kraken referred the matter to law enforcement, citing the scale of the exploitation as exceeding the bounds of legitimate security research. Separately, Kraken disclosed in June that a security researcher had identified and exploited a critical API vulnerability that enabled unauthorized withdrawals before the bug was reported. Kraken disclosed in May 2025 that three individuals, later revealed to be US government officials acting under a law enforcement pretext, had accessed Kraken’s platform under false identity and exploited its KYC onboarding processes. Beyond the major four, the regional banking and credit union sector absorbed a sustained wave of incidents throughout the year.

For example, a distributed denial of service (DDoS) attack that overwhelms a website is not a data breach. The terms “data breach” and “breach” are often used interchangeably with “cyberattack.” However, not all https://nutritioninpill.com/digital-medicine-digital-health-plus-evidence-plus-humility-forbes/ cyberattacks are data breaches.

Extended Detection and Response platforms that aggregate signals from endpoints, networks, clouds, identities, and email into a single investigation context give security teams the cross-domain visibility needed to detect lateral movement that individual point solutions miss. Reducing dwell time requires detection capabilities that do not depend solely on known attack signatures or internal network monitoring. The 241-day global average breach lifecycle in 2025, the lowest in nine years, reflects real progress, but it still means that by the time most breaches are detected, the average attacker has had eight months of access. IBM’s 2025 Cost of a Data Breach Report documents a $1.14 million cost premium between breaches detected within 200 days and those that exceed that threshold. When an infostealer malware infection harvests credentials from an employee’s device, those https://clomidxx.com/report-massachusetts-general-hospital-targeting-various-blockchain-use-cases/ credentials typically appear in dark web markets within days of the infection.

• The 2025 TransUnion data breach exposed the personal information of 4,461,511 Americans, including names, Social Security numbers, and dates of birth, after attackers exploited a third-party application connected to TransUnion’s US consumer support operations.
• Marriott International did not disclose a new confirmed data breach in 2025, but continued to manage the legal and regulatory aftermath of its 2018 Starwood breach, which had already cost the company £18.4 million in ICO fines and more than $52 million in FTC settlement, with class action proceedings still active in US courts through 2025.
• Approximately 1.2 million customer records were compromised through a third-party reservation and check-in system, with exposed data including names, email addresses, dates of birth, phone numbers, loyalty program details, and, in a subset of cases, passport numbers and expiry dates.
• Affected individuals are encouraged to enroll in the free credit monitoring service within 90 days of receiving their notification letter.
• A third-party vendor used by JPMorgan Chase, Citigroup, and other major Wall Street institutions disclosed a breach that exposed customer names, contact details, and account-related identifiers across multiple financial firms simultaneously.

Common data breach attack vectors

Oracle was accused of using technical “wordplay”, specifically, the distinction between “Oracle Cloud” (its current OCI infrastructure) and “Oracle Cloud Classic” (a legacy environment), to deny a breach in the former while quietly acknowledging exposure in the latter. Oracle’s handling of the March breach became one of the most scrutinized corporate responses to a cybersecurity incident in 2025, not because of what the company did technically, but because of the gap between its public statements and the evidence accumulating in the research community. Oracle released emergency patches in early October, but by then Clop’s leak site had already begun naming victims. The scope affected over 140,000 enterprise tenants spanning Fortune 500 companies, public sector organizations, and mid-market enterprises across multiple industries and regions. Although the vulnerability was reported over two years ago, CloudSEK’s investigation revealed that the endpoint exploited by the attacker had not been updated since 2014 and was in active use as recently as February 17, 2025. The vulnerability, originally reported in December 2022, allows unauthenticated attackers to compromise Oracle Access Manager instances.

• Many data breaches occur on the hardware operated by a partner of the organization targeted—including the 2013 Target data breach and 2014 JPMorgan Chase data breach.
• The 2007 breach of TJX Corporation, the parent company of retailers TJ Maxx and Marshalls, was at that time the largest and costliest consumer data breach in US history.
• The former is rarely used due to a lack of flexibility and reluctance of legislators to arbitrate technical issues; with the latter approach, the law is vague but specific standards can emerge from case law.
• Notification letters began reaching affected patients in October 2025, nine months after the intrusion window closed, a delay that prompted class-action litigation and regulatory scrutiny.
• These two categories remain among the most difficult for affected individuals to detect and resolve.
• The campaign began as early as June, remained undetected across multiple affected organizations through August, and became public knowledge in September when ShinyHunters began contacting victims directly with extortion demands.

Why data breaches happen

According to the Cost of a Data Breach 2025 report, stolen or compromised credentials is one of the top five most common initial attack vectors, accounting for 10% of data breaches and taking up to 186 days to identify. A ransomware attack that locks up a company’s customer data and threatens to leak the stolen data unless the company pays a ransom is a data breach. Substack notifies users of data breach affecting nearly 700,000 accounts

Major Security Incidents & Data Breaches (Disclosed January)

No breach in 2025, or in any prior year, came close to the scale of the credential dataset uncovered by Cybernews researchers in June. The biggest data breaches of 2025 ranged from a 16-billion-credential mega-dump that dwarfed every prior incident in recorded history to precision insider attacks against individual crypto platforms. Inotiv, a pharmaceutical research services provider, confirmed a ransomware incident affecting 9,542 individuals. Exposed data included customer names, Social Security numbers, driver’s license numbers, financial account details, and dates of birth. Under Armour disclosed a ransomware incident in which attackers accessed internal corporate systems, claiming to have accessed data linked to millions of records, though Under Armour had not confirmed the scale at the time of initial disclosure. CISA issued an Emergency Directive in response, one of only a handful issued that year, given the downstream risk of exploit development against organizations running F5 infrastructure.

Klarna’s breach was notable primarily for its vendor origin; the same identity verification provider was confirmed to have been involved in multiple fintech breaches throughout the year, suggesting a single systemic point of failure across the buy-now-pay-later and digital lending sectors. Still, the SWIFT messaging context meant the stolen data carried significant intelligence value for subsequent financial fraud operations. A threat actor had been selling 400GB of stolen Finastra data on dark web forums since October 2024, including sensitive financial transaction records, client credentials, and operational banking data. While not a breach of Zelle’s own systems, the combination of social engineering attacks targeting Zelle users and the platform’s irreversible transaction model made it the payments sector’s most consequential fraud vector of the year.

June 2025 Data Breaches

Despite that record breach count, total victim notices fell sharply from 1.36 billion in 2024 to 278.8 million in 2025, reflecting a strategic shift by attackers from mass-scale indiscriminate breaches toward precision targeting of high-value data repositories. The global average cost of a data breach fell to $4.44 million in 2025, the first decrease in five years, driven by AI-assisted detection that saved organizations nearly $1.9 million per breach, but US organizations bucked that trend, hitting an all-time high of $10.22 million per breach, more than double the global figure. A dataset purportedly containing 31 million AT&T customer records, including names, dates of birth, tax IDs, and contact details, was posted to a dark web forum in May 2025, but AT&T did not publicly confirm the breach at the time of disclosure.