State of (in)security - Week 24, 2025
Take action: Attackers are hiding malicious AI commands in messages to people, hoping people will use AI to parse messages. Read your messages! Before an AI does that! Be very careful about messages with content that looks like AI prompt instructions to do something which makes little sense to you. If not needed, fully delete such messages and content and report it to your admins so it's possibly not loaded into the AI.
Learn More
In the week between June 9, 2025, midnight and June 16, 2025, midnight we witnessed a total of:
- 10 advisory/vulnerability events
- 21 incident/data breach events
Week over Week comparison of week 24 2025 vs week 23 2025:
- Both advisories and incidents are down from the previous week. Advisories are down from 14 in week 23 2025, to 10 in week 25 2025. Incidents are down from 23 week 23 2025 to 21 in week 24 2025.
- The number of known impacted individuals is significantly down - from over 212 million in week 23 to 3.355 million in week 24 2025.
We also shared 3 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 3,355,942 impacted individuals across 5 incidents, with the largest breach being the Healthcare data leak exposes 8.8 M patient records incident exposing 2,700,000 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Cause breakdown of incidents
| Cause | Number of incidents |
|---|---|
| Malware, Ransomware and Related Attacks | 9 |
| Unauthorized access | 3 |
| System Misconfiguration Exploits | 2 |
| Third Party Compromise | 1 |
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| IT/Software/Technology | 4 |
| Government | 4 |
| Consulting/Professional Services | 3 |
| Healthcare | 3 |
| Insurance | 3 |
| Transport/Logistics | 1 |
| Media | 1 |
| Retail | 1 |
| Aviation | 1 |
Read the Event Details of the Week
Knowledge
- active exploit | Mirai Botnet variant exploits TBK DVR Devices flaw
- awareness | Over 40,000 Internet-connected cameras stream live footage with NO protection
- active exploit | Paragon's Graphite Spyware targets European journalists through iPhone flaws
Vulnerabilities
- critical vulnerability | Adobe releases May 2025 patches, addressing 254 vulnerabilities across multiple products
- critical vulnerability | Critical account takeover flaw reported in WordPress PayU India plugin
- critical vulnerability | Critical vulnerability discovered in ManageEngine Exchange Reporter Plus
- data breach | Critical vulnerability in Microsoft 365 Copilot AI called EchoLeak enabled data exfiltration
- critical vulnerability | GitLab patches multiple account takeover and injection vulnerabilities
- critical vulnerability | Ivanti reports three high severity hardcoded keys flawa in Ivanti Workspace Control
- critical vulnerability | Microsoft releases June 2025 Patch, fixing actively exploited flaw and 65 additional vulnerabilities
- critical vulnerability | Multiple vulnerabilities reported in DataEase Platform exposing risk of system compromise
- data breach | Salesforce patches five vulnerabilities in Industry Cloud Components
- critical vulnerability | Trend Micro fixes 15 flaws, at least six critical across multiple products
Incidents
- data breach | OneGroup NY reports data breach caused by compromised email account
- data breach | United Natural Foods Inc hit by cyberattack, disrupting food supply chain
- data breach | Indian grocery startup KiranaPro hit by insider security incident affecting over 55,000 people
- data breach | Ransomware attack compromises eyecare software provider Ocuco
- data breach | Headero dating app leaks data exposing 4 million user records
- data breach | Green County, Wisconsin reports data breach exposing residents' information
- data breach | WestJet investigates cybersecurity incident affecting systems and mobile app
- data breach | Healthcare data leak exposes 8.8 M patient records
- data breach | Targeted cyberattack on Washington Post journalists' email accounts, foreign government suspected
- data breach | Thomasville municipal systems compromised in cyberattack
- data breach | Hacktivist groups hit Russian helicopter manufacturer, leaks stolen data
- data breach | Pennsylvania law firm Carpenter McCadden & Lane reports data breach affecting over 7,900 individuals
- ransomware | Qilin ransomware gang hits spanish insurer Asefa, exposing FC Barcelona stadium plans
- ransomware | INC Ransom ransomware gang breaches Virginia mental health provider Mount Rogers Community Services
- ransomware | Erie Insurance reports cybersecurity incident causing system outages
- ransomware | Korean online bookstore Yes24 hit by ransomware attack, offline for two days
- ransomware | Qilin Ransomware gang targets Philippine Coop hospital
- ransomware | Global ransomware group claims breach of Australian Epworth Healthcare, possibly breached third party vendor
- ransomware | Cyberattack forces five-day closure of Ogeechee Judicial Circuit District Attorney's office
- ransomware | Philadelphia Insurance Companies hit by ransomware attack
- ransomware | Australian financial services firm Skeggs Goldstien hit by Qilin Ransomware
