Every breach report in the live feed, curated and classified by what actually happened, who was hit, and how many records the reporting says were exposed. Unclassified open source only.
Every figure below is counted directly from the cited reports in this list. Nothing is estimated, and record counts are only shown when the source itself states one.
Bottom line: an extortion campaign linked to the CL0P ecosystem exploited an Oracle E-Business Suite zero-day for mass data theft across dozens of customers. Enterprise resource planning platforms are now a primary mass-exploitation target, not a back-office concern.
Automated analysis from cited open sources.
Source: Google Threat Intelligence Group / Mandiant · published 2025-10-09 13:00Z[1]
Bottom line: reporting on the Insikt Group findings identified further carrier compromises through Cisco devices left unpatched for over a year. Asset inventory gaps on network gear, not novel exploits, are carrying this campaign.
Automated analysis from cited open sources.
Source: BleepingComputer · published 2025-02-14 12:00Z[1]
Bottom line: the designations covered both the carrier campaign and an intrusion into Treasury systems through a third-party support provider. Third-party remote support tooling remains an unresolved federal exposure.
Automated analysis from cited open sources.
Source: Associated Press · published 2025-01-17 18:00Z[1]
Bottom line: international law enforcement took the leak site, recovered decryption keys and exposed the affiliate structure of the most active ransomware brand. Infrastructure seizure combined with public exposure now precedes arrests in United States practice.
Automated analysis from cited open sources.
Source: US Department of Justice · published 2024-02-20 13:00Z[1]