State of (in)security - Week 26, 2025
Take action: Infostealers are a nightmare, especially if they stumble on a computer with system accounts. Suddenly the entire country's data can be at risk. Work both on technical prevention and on very diligent awareness of people to persuade them not to be optimists and download crap, click on links and save passwords in browsers.
Learn More
In the week between June 23, 2025, midnight and June 30, 2025, midnight we witnessed a total of:
- 16 advisory/vulnerability events
- 14 incident/data breach events
Week over Week comparison of week 26 2025 vs week 25 2025:
- Advisories remain the same as the previous week, and incidents are down from the previous week. Advisories remain 16 in both week 24 and week 25 2025. Incidents are down from 17 in week 25 2025 to 14 in week 26 2025.
- The number of known impacted individuals is down - from 9.7 million in week 25 to 7.4 million in week 26 2025.
We also shared 4 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 7,480,357 impacted individuals across 3 incidents, with the largest breach being the Paraguay hit by catastrophic data breach as hacktivists leak personal data of entire population incident exposing 7,400,000 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Cause breakdown of incidents
| Cause | Number of incidents |
|---|---|
| Malware, Ransomware and Related Attacks | 6 |
| Third Party Compromise | 2 |
| Unauthorized access | 2 |
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| Government | 4 |
| Healthcare | 4 |
| Education | 3 |
| Aviation | 1 |
| Consulting/Professional Services | 1 |
| IT/Software/Technology | 1 |
Read the Event Details of the Week
Knowledge
- active attack | Citrix releases emergency patches for actively exploited vulnerability in NetScaler Products
- active exploit | Critical Citrix Netscaler "Citrix Bleed 2" flaw actively exploited
- active scam | Scammers use search forms to display fraudulent contact numbers on Apple, HP, Netflix and others
- active phishing | Threat group Educated Manticore targets academia and cybersecurity experts
Vulnerabilities
- ransomware | CISA warns that AMI MegaRAC Vulnerability that enables server takeover is actively exploited
- critical vulnerability | Cisco reports perfect 10 critical remote code execution flaws in Identity Services Engine (ISE)
- critical vulnerability | Critical build cache flaw exposes organizations to production code injection attacks
- critical vulnerability | Critical cryptographic flaw in Meshtastic Mesh Networking platform exposes private communications
- critical vulnerability | Critical flaw reported in Hunt Electronics DVR Systems exposes plaintext admin credentials
- critical vulnerability | Critical Gogs flaw enables complete code repository takeover
- critical vulnerability | Critical remote authentication bypass flaw reported in Teleport access management platform
- critical vulnerability | Critical vulnerabilities discovered in Citrix NetScaler ADC and Gateway products
- critical vulnerability | Critical vulnerability exposes Mitsubishi Electric Air Conditioning Controllers to remote takeover
- critical vulnerability | Directory traversal flaw in WinRAR enables remote code execution
- critical vulnerability | Multiple critical flaws reported in MICROSENS NMP Web+ Network Management Platform
- critical vulnerability | Multiple vulnerabilities reported in ControlID iDSecure vehicle access control systems
- critical vulnerability | Researchers report flaw in Open VSX Registry that can compromise VS Code extensions marketplace
- critical vulnerability | Security vulnerabilities reported in Kaleris Navis N4 terminal Operating System
- awareness | U.S. House bans WhatsApp on their devices due to data security and transparency concerns
- critical vulnerability | Vulnerabilities reported in Brother printers and other vendors, at least one critical
Incidents
- data breach | Horizon Healthcare RCM hit by ransomware attack exposing patient data
- data breach | Glasgow City Council hit by cyberattack, potential data theft
- data breach | Paraguay hit by catastrophic data breach as hacktivists leak personal data of entire population
- data breach | Hawaiian Airlines hit by major cyberattack affecting IT systems, flights not disrupted
- data breach | Texas Centers for Infectious Disease Associates reports third party data breach
- data breach | WorldLeaks claims data breach of Myrtue Medical Center
- data breach | Iran-Linked hacktivists leak records of thousands of Saudi Games athletes and visitors
- data breach | Upper Dublin Family Dentistry reports ransomware attack exposing data of 5,000 patients
- data breach | University of Massachusetts Dartmouth data breach exposes data of 75 Kpeople
- data breach | Northern Light Health patient data exposed in ransomware attack on third-party vendor
- ransomware | Ransomware attack on college admission system exposes student data, scams applicants
- ransomware | Columbia University investigates suspected cyberattack after widespread system outages
- ransomware | City of Green River, Wyoming hit by ransomware, affecting municipal systems
- ransomware | Interboro School District hit by cyberattack, exposing student and staff data
