Week 31, 2025 security incident report
Hacking and data breach incidents newly reported 2025.07.28 ~ 08.03
New cyber-security incidents recorded between 28 July and 3 August 2025 numbered one in South Korea and 30 overseas, with the only South Korean entry being a single article on the 7 July DDoS crisis. Across all types, personal data leaks were the most common at 18, followed by hacking/intrusion (7), ransomware (5) and DDoS (1). Overseas, the ransomware attack on the city of St Paul in the US, the most covered incident with 26 articles, caused the suspension of some administrative services and incident costs of $2.5 million, whilst a data theft attack affecting hundreds of Salesforce customers and damage that spread to telecoms, aviation and welfare services were also prominent.
By type
- Data breach17
- Hacking & intrusion7
- Ransomware5
- DDoS1
Key incidents in South Korea
The 7 July DDoS attacks
The 7 July DDoS attacks took place. The specific organisations affected, the scale of the damage, the year of occurrence and response measures have not been confirmed.
Read on 전자신문 ↗
Supply-chain breaches
Fallout continues from breach at AI chatbot firm Salesloft
A data breach occurred at AI chatbot company Salesloft. The fallout from the breach continues, and the specific scale of the damage, attack method and response measures have not been confirmed.
Read on Krebs on Security ↗
Also affected: 4- SalesforceData theft attacks targeting Salesforce customers spreadHundreds of customers affected; attackers claim theft of 1.5 billion records
- ZscalerZscaler customer data leaked in Salesloft Drift breachCustomer information leaked, scale unknown
- TaniumSome Tanium information compromised in Salesloft Drift hack falloutSome basic information
- QualysQualys Salesforce data leaked in Drift supply chain attackSalesforce data leaked, scale unknown
Key incidents in other countries
Ransomware attack disrupts council services in Saint Paul, US
Impact: Disruption of some city services; incident costs of $2.5 million
On 25 July 2025, the city of Saint Paul, Minnesota, in the US was hit by a ransomware attack that disrupted some city services. The state declared an emergency and deployed the National Guard, and the city moved to reset the passwords of 3,500 employees and restore its online systems. The attackers claimed to have published 43GB of stolen data, and the city's costs from the incident totalled $2.5 million.
Related reports: 26 · last report →Orange ransomware attack data published on dark web
Impact: Data published on the dark web
French telecoms company Orange disclosed that it had been hit by a cyber-attack. It later emerged that it had suffered a ransomware attack and that data had been published on the dark web.
Related reports: 7 · last report →Hackers claim attack and leak as Aeroflot flights are disrupted
Impact: Flight disruption
On 28 July 2025, as Aeroflot flights were disrupted, pro-Ukrainian hackers claimed to have carried out a cyber-attack. The hackers later claimed to have released Aeroflot data and the chief executive's flight history. The Russian side denied a breach.
Related reports: 5 · last report →Highlands Oncology Group ransomware affects over 110,000 people
113.6kImpact: 113,575 people affected
US cancer care provider Highlands Oncology Group discovered a ransomware attack in June 2025 and reported that 113,575 people were affected. An investigation found that the attackers had accessed its systems since January, and the Medusa group claimed to have stolen data. It subsequently became the subject of a law firm investigation into the leak of patient records.
Related reports: 3 · last report →Attack on food assistance call centre in US state of Georgia disrupts benefit access
Impact: Some SNAP households unable to access benefits for about a month
The call centre for SNAP, a food assistance programme in the US state of Georgia, was hit by a cyber-attack. About a month after the attack, some households were still unable to access their SNAP benefits.
Related reports: 3 · last report →