Week 33, 2025 security incident report
Hacking and data breach incidents newly reported 2025.08.11 ~ 08.17
Between 11 and 17 August 2025, the key incident in South Korea was a major ticketing company suffering its second ransomware attack in two months, which disrupted its operations. Newly recorded incidents numbered one in South Korea and 38 overseas, and by type, personal data leaks were the most common at 28, followed by ransomware (8) and hacking/intrusion (3). Knock-on damage via Salesforce, spreading to Chanel, Pandora, Google, Allianz Life Insurance and Cloudflare, was also notable. Overseas, a hack of a Dutch laboratory that leaked the data of 941,000 people had the largest number of victims among the cases presented, and data leaks and ransomware damage occurred across various sectors, including telecoms, recruitment services and finance.
By type
- Data breach28
- Ransomware8
- Hacking & intrusion2
Key incidents in South Korea
Major South Korean ticketing firm hit by second ransomware attack in two months
Impact: Operational disruptions at the ticketing company
A major South Korean ticketing company suffered operational disruptions due to a ransomware attack. It was the second ransomware attack on the company in two months.
Read on The Record from Recorded Future News ↗
Supply-chain breaches
Data theft attacks targeting Salesforce customers spread
↳ Knock-on damage from the Salesloft incident · View original incident1.5bnImpact: Hundreds of customers affected; attackers claim theft of 1.5 billion records
Data theft attacks targeting Salesforce customers continued, with several companies including Google confirming they were affected. The attacks involved voice phishing and the abuse of stolen OAuth tokens from Salesloft Drift. Drift was taken offline, and ShinyHunters claimed to have stolen 1.5 billion records through the Drift hack.
Related reports: 15 · last report →
Key incidents in other countries
Dutch lab hack exposes data of 941,000 people, including cancer screening participants
941kImpact: Data of 941,000 people leaked
A Dutch laboratory was hacked, exposing the data of women who took part in cervical cancer screening and women staying in domestic violence refuges, among others. The number of victims grew from an initial 485,000 women to 941,000, and warnings were later sent to about 1 million women. The attackers demanded about €1.1 million to prevent further disclosure, and the regulator launched an investigation into the laboratory.
Related reports: 9 · last report →UK telecoms firm Colt has customer data stolen in ransomware attack
Impact: Theft of customer information and service outages lasting several days
UK telecoms company Colt was hit by a ransomware attack and suffered service outages for several days. The Warlock ransomware group claimed the attack and put files up for auction. Colt later confirmed that customer information had been stolen.
Related reports: 9 · last report →Manpower ransomware attack leaks data of 144,180 people
144.2kImpact: Information of 144,180 people
A data breach resulting from a ransomware attack occurred at recruitment company Manpower. The company disclosed the breach, and the most recently confirmed number of people affected is 144,180. The date of the incident and specific recovery and protection measures have not been confirmed.
Related reports: 5 · last report →Connex Credit Union data breach affects 172,000 members
172kImpact: Information of 172,000 members
Member information was leaked at Connex Credit Union, based in North Haven, Connecticut, in the US. The credit union disclosed the breach, which affected 172,000 members.
Related reports: 4 · last report →Data on Afghans linked to UK resettlement leaked
Impact: Information on Afghans and resettlement programme participants
Information on Afghans held in the UK was leaked, and data on participants in a resettlement programme was also exposed in a cyber-attack on a contractor linked to the Ministry of Defence. The son of a data breach victim voiced fears that his family could be killed if they were deported. Dozens more cases of leaks of information on Afghans subsequently came to light.
Related reports: 4 · last report →