State of (in)security - Week 27, 2025
Take action: This week malware code was reported to have a vulnerability that can be exploited against the owners of the malware. Obviously, we don't really care if the criminals patch their software. But this is a prime example that all software can be flawed, and that input validation IS ALWAYS A GREAT IDEA.
Learn More
In the week between June 30, 2025, midnight and July 7, 2025, midnight we witnessed a total of:
- 11 advisory/vulnerability events
- 14 incident/data breach events
Week over Week comparison of week 27 2025 vs week 26 2025:
- Advisories are down from the previous week, and incidents remain the same as the previous week. Advisories are down from 16 in week 26 to 11 in week 27. Incidents remain the same, 14 in both week 27 2025 and in week 26 2025.
- The number of known impacted individuals is down - from 7.4 million in week 26 to 6.7 million in week 27 2025.
We also shared 3 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 6,719,128 impacted individuals across 7 incidents, with the largest breach being the Australia's Qantas Airways suffers cyberattack affecting up to 6 million customers incident exposing 6,000,000 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Cause breakdown of incidents
| Cause | Number of incidents |
|---|---|
| Malware, Ransomware and Related Attacks | 6 |
| Software Vulnerability and SDLC Exploits | 2 |
| Social Engineering and Phishing | 1 |
| System Misconfiguration Exploits | 1 |
| Third Party Compromise | 1 |
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| Healthcare | 2 |
| Finance | 2 |
| Non-profit/Charity | 2 |
| Consulting/Professional Services | 2 |
| Retail | 1 |
| Government | 1 |
| IT/Software/Technology | 1 |
| Aviation | 1 |
Read the Event Details of the Week
Knowledge
- active attack | CISA warns of active attacks on Signal clone TeleMessage
- active exploit | Google patches actively exploited flaw in Chrome
- active scam | Parcel delivery scam using Android group messages
Vulnerabilities
- critical vulnerability | Cisco patches critical hardcoded credentials vulnerability in Unified Communications Manager
- critical vulnerability | Critical flaws reported in end-of-life D-Link DIR-816 routers
- critical vulnerability | Critical remote code execution flaw reported in Anthropic's MCP Inspector tool
- critical vulnerability | Critical Sudo vulnerabilities enable local privilege escalation to root
- critical vulnerability | Critical vulnerability in Wing FTP Server enables remote code execution, server takeover
- ransomware | Medical device manufacturer Surmodics hit by cyberattack, suspected ransomware
- critical vulnerability | Remote code execution flaw reported in HIKVISION Security Management Platforms
- critical vulnerability | Researchers report Bluetooth flaws that enable remote eavesdropping, device hijacking
- ransomware | Security flaw reported in Cl0p ransomware gang data theft tool
- data breach | Vulnerability in Synology Active Backup for Microsoft 365 exposes credentials, enables unauthorized access to Teams chats
- critical vulnerability | WordPress Plugin flaw exposes over 600,000 websites to potential remote takeover
Incidents
- data breach | Swiss government data compromised in ransomware attack on health foundation Radix
- data breach | Trade show management firm Nth Degree hit by data breach, exposing sensitive data
- data breach | Brazilian recruitment platform CIEE leaks 248 K records
- data breach | Technology startup incubator IdeaLab confirms ransomware attack
- data breach | Louis Vuitton Korea hit by cyberattack, customer data compromised
- data breach | Australia's Qantas Airways suffers cyberattack affecting up to 6 million customers
- data breach | Data breach at Integrated Oncology Network exposes patient information of cCARE cancer patients
- data breach | Virginia student loan administrator Southwood Financial hit by ransomware attack
- data breach | Centers for Medicare & Medicaid warn 103,000 beneficiaries of unauthorized Medicare.gov account creation
- data breach | Cyberattack in Missouri healthcare provider Esse Health exposes data of over 263,000 patients
- data breach | Catwatchful stalkerware platform vulnerable to SQL Injection exposes 62,000 customers
- ransomware | Global IT Distributor Ingram Micro suffers outage disrupting global operations, suspected ransomware
- ransomware | German aid organization Welthungerhilfe hit by ransomware attack
- ransomware | Ransomware attack on Gloucester County Virginia exposes employee personal data
