Arctic Wolf Presents
The Most Impactful Breaches of 2025
Our annual recap of the most noteworthy, high-profile, and damaging cybercrimes of the year.
Top Data Breaches of 2025
Explore the most significant developments in modern cyber threats via an exploration of nine of the biggest breaches of 2025, what makes them so dangerous, and how to fortify your defenses against similar attacks.
A Zero-Day Targets Over 100 Global Companies
A massive compromise of Oracle E-Business Suite (EBS) environments resulted in organizations across the globe suffering data breaches and follow-on extortion attempts.
Data Breach At A Glance
Threat Actor:CI0p
Industry Impacted:Tech
Impacted Org:Over 100 companies via Oracle EBS
Region:Global
A Zero-Day Targets Over 100 Global Companies
Explore the most significant developments in modern cyber threats via an exploration of nine of the biggest breaches of 2025, what makes them so dangerous, and how to fortify your defenses against similar attacks.
Data Breach at a Glance
Threat Actor:
CI0p
Industry Impacted:
Tech
Impacted Org:
Over 100 companies via Oracle EBS
Region:
Global
Attack Details:
Cl0p’s campaign centered on exploiting CVE‑2025‑61882, a critical pre‑authentication remote code execution flaw in Oracle E‑Business Suite’s BI Publisher Integration component. Multiple sources confirm that the group began abusing the zero‑day as early as August 9, 2025, weeks before Oracle issued an emergency patch in early October. The vulnerability allowed unauthenticated HTTP‑based execution inside the Concurrent Processing module, giving attackers immediate system‑level control in affected environments. Analysis indicates that the exploit chain involved several bugs, including some which had been patched months earlier.
Once inside enterprise EBS environments, Cl0p operators executed large‑scale data theft operations rather than deploying ransomware payloads. The group infiltrated multiple global enterprises — including automotive, media, technology, and higher‑education institutions — by leveraging the same underlying vulnerability. In several cases, victims did not detect intrusions until weeks after the initial exploitation window, illustrating the attacker’s ability to operate quietly within Oracle EBS infrastructures.
Fallout:
Organizations reported receiving extortion emails beginning in late September, with Cl0p asserting that substantial volumes of corporate and sensitive information had been exfiltrated. Some victim entries were later removed from Cl0p’s leak site, suggesting potential ransom negotiations or efforts to suppress public visibility. Intelligence analysts also noted that exploit files eventually circulated publicly, increasing the likelihood of additional threat groups using the same vector.
Major enterprises reported delays in breach discovery, large‑scale data exposure, and prolonged extortion pressure. Nearly 30 organizations appeared on Cl0p’s leak site as alleged victims, including high‑profile entities such as Logitech, Envoy Air, and The Washington Post, many of which faced public scrutiny before completing internal investigations. The volume of leaked material — sometimes hundreds of gigabytes or more — indicated that the attackers had achieved deep access and long dwell time within EBS environments, complicating remediation efforts and increasing the cost and duration of forensics and containment.
Arctic Wolf Insight:
Modern attacks — especially those involving zero‑days — cannot be mitigated by periodic security checks or annual penetration tests. Because Cl0p operated quietly for weeks inside Oracle EBS environments, behavior‑based detection (e.g., anomalous data exfiltration patterns, suspicious EBS process invocation, irregular service account activity) is essential for catching early‑stage intrusions even when the exploit is not yet known. Organizations need 24×7 monitoring, detection, and response operations backed by human expertise that can spot anomalous behavior long before extortion emails start arriving.
Sources
- Bleeping Computer: https://www.bleepingcomputer.com/news/security/cox-enterprises-discloses-oracle-e-business-suite-data-breach/
- HIPAA Journal: https://www.hipaajournal.com/oracle-health-data-breach/
- Wall Street Journal : https://www.wsj.com/articles/oracle-hack-still-generating-ransom-demands-06887763?reflink=desktopwebshare_permalink
- SOC Radar: https://socradar.io/blog/cl0p-oracle-ebs-zeroday-campaign/
The Most Economically Damaging Cyber Event in UK History
A coordinated attack on an automotive titan serves as a stark reminder that one stolen credential can unravel an entire global manufacturing empire.
Data Breach At A Glance
Threat Actor:Scattered Lapsus$ Hunters / HELLCAT
Industry Impacted:Automotive
Impacted Org:Jaguar Land Rover (JLR)
Region:EMEA
The Most Economically Damaging Cyber Event in UK History
A coordinated attack on an automotive titan serves as a stark reminder that one stolen credential can unravel an entire global manufacturing empire.
Data Breach at a Glance
Threat Actor:
Scattered Lapsus$ Hunters / HELLCAT
Industry Impacted:
Automotive
Impacted Org:
Jaguar Land Rover (JLR)
Region:
EMEA
Attack Details:
One of the largest data breaches of the year didn’t require advanced tactics, techniques, and procedures (TTPs), or an escalating chain of successful attacks. It simply required purchasing credentials on the dark web and using them to log in and steal data, once again highlighting the vital need for MFA and proper password hygiene.
Threat actors were able to traverse JLR’s interconnected digital estate, which included modernized manufacturing systems, cloud‑linked operational tools, and legacy enterprise applications — an attack surface broad enough to accommodate credential reuse, token theft, and lateral movement tactics associated with Scattered Lapsus$ Hunters’ federated model.
The operational disruption began in early September when attackers triggered simultaneous failures in production environments across multiple facilities. JLR’s global manufacturing plants were forced offline after attackers deployed ransomware‑style payloads and disrupted internal IT networks, prompting an emergency shutdown to contain further spread.
Fallout:
The company’s production lines remained offline for weeks, stalling vehicle output and disrupting the broader automotive supply chain. Losses mounted rapidly: quarterly financials reflected a hit of over $442 million USD tied directly to the outage, and broader estimates suggest the incident cost the company more than $890 million USD once prolonged downtime and global delivery delays were factored in. The supply‑chain impact was equally damaging, with suppliers and dealers forced into emergency workarounds as JLR’s IT systems remained dark.
Beyond the operational and financial blow, the breach triggered a significant privacy and regulatory fallout as forensic analysis confirmed that attackers had accessed HR systems, compromising detailed personal and employment records of current and former staff. Exposed data included names, home addresses, salary information, National Insurance numbers, and even dependent details, creating a long‑tail risk scenario involving identity theft, targeted social‑engineering attempts, and employee‑focused cyber extortion.
Arctic Wolf Insight:
The JLR incident underscores how long‑dwell adversaries exploit credential theft, legacy systems, and sprawling IT–OT connectivity. Organizations need to prioritize identity‑centric zero trust controls, strict segmentation of manufacturing and enterprise environments, and robust exposure management to eliminate overlooked weaknesses before attackers find them. Equally critical is investing in behavioral detection capable of spotting subtle anomalies — like unusual authentication patterns or privilege escalation — weeks before an attacker launches their destructive phase.
Sources
APAC’s Most High-Profile Breach Since 2022 Stems From Social Engineering
An attack on a major Australian airline stemmed from a single compromise in their third‑party call‑center ecosystem, raising urgent questions about supply‑chain trust in aviation.
Data Breach At A Glance
Threat Actor:Scattered LAPSUS$ Hunters
Industry Impacted:Transportation, Aviation
Impacted Org:Qantas
Region:APAC / Global
APAC’s Most High-Profile Breach Since 2022 Stems From Social Engineering
An attack on a major Australian airline stemmed from a single compromise in their third‑party call‑center ecosystem, raising urgent questions about supply‑chain trust in aviation.
Data Breach at a Glance
Threat Actor:
Scattered LAPSUS$ Hunters
Industry Impacted:
Transportation, Aviation
Impacted Org:
Qantas
Region:
APAC / Global
Attack Details:
Qantas detected unusual activity on June 30, 2025, and quickly traced it to an attacker who had targeted the external platform rather than Qantas’ internal infrastructure, enabling unauthorized access to datasets containing customer names, email addresses, phone numbers, birth dates, and frequent‑flyer numbers.
Qantas confirmed that the adversary’s tactics bore similarities to groups known for high‑fidelity social engineering, including threat actors who specialize in impersonating employees and contractors to bypass help‑desk controls and circumvent multi‑factor authentication flows. The attack vector leveraged weaknesses common in outsourced service environments, where identity‑validation processes and cross‑tenant access privileges can be inconsistently enforced.
Once inside the third‑party system, the attacker exfiltrated customer datasets at scale, prompting Qantas to immediately isolate the affected platform, lock down integrations, and deploy enhanced monitoring to prevent lateral movement into core flight operations, reservation systems, or internal enterprise networks. The airline emphasized that operational systems remained uncompromised—a critical indicator that segmentation and boundary controls between customer‑service infrastructure and mission‑critical aviation systems were functioning as intended.
Fallout:
The fallout from the Qantas breach quickly escalated into one of the most consequential data‑exposure events in Australian aviation history, with attackers exfiltrating personal information tied to as many as six million customers. Although the system did not store financial data, passports, or authentication credentials, the breadth of exposed identifiers provided attackers with a foundation for downstream exploitation, including account‑reset impersonation and credential‑harvesting attacks, a concern repeatedly emphasized by cybersecurity experts evaluating the breach.
Qantas also faced sustained pressure both operationally and reputationally. The airline activated a dedicated hotline, identity‑protection resources, and ongoing breach‑impact notifications, all while securing a court injunction to restrict the distribution of stolen data as criminal forums began circulating leaked information.
Arctic Wolf Insight:
The Qantas breach underscores how modern enterprises must treat third‑party service platforms as extensions of their own attack surface, enforcing the same visibility, logging, and identity‑hardening standards they apply internally. Most critically, the breach highlights the importance of proactive exposure management: regularly validating vendor risk, minimizing retained customer data, and ensuring that every integration — no matter how operationally routine — is continuously evaluated for compromise pathways that determined adversaries can exploit.
Sources
- Qantas: https://www.qantas.com/au/en/support/information-for-customers-on-cyber-incident.html
- The Guardian: https://www.theguardian.com/business/2025/jul/02/qantas-confirms-cyber-attack-exposes-records-of-up-to-6-million-customers
- Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/qantas-airlines-breached-6m-customers
AI-Enhanced Vishing Strikes Storied Educational Institutions
Two of the nation’s most elite universities were breached through simple voice‑phishing and social‑engineering tactics, proving that prestige is no defense against persistent, data‑hungry adversaries.
Data Breach At A Glance
Threat Actor:Unknown
Industry Impacted:Education
Impacted Org:Harvard and Princeton
Region:North America
AI-Enhanced Vishing Strikes Storied Educational Institutions
Two of the nation’s most elite universities were breached through simple voice‑phishing and social‑engineering tactics, proving that prestige is no defense against persistent, data‑hungry adversaries.
Data Breach at a Glance
Threat Actor:
Unknown
Industry Impacted:
Education
Impacted Org:
Harvard and Princeton
Region:
North America
Attack Details:
At Harvard, attackers impersonated trusted parties over the phone to deceive an employee into granting access to the university’s Alumni Affairs and Development systems, allowing the threat actor to enter an environment containing extensive donor, alumni, and engagement records.
Princeton’s breach followed a remarkably similar pattern: a phone phishing attack targeting an Advancement Office employee with routine access to donor and alumni records allowed attackers to infiltrate a database that stored names, email addresses, phone numbers, physical addresses, and donation‑related metadata for alumni, donors, students, faculty, parents, and other community members.
The precision of the social engineering, along with the attacker’s ability to identify a non‑technical but privileged entry point, underscores how attackers can leverage human‑centric vulnerabilities to bypass otherwise mature institutional security programs. From a broader threat‑landscape perspective, these coordinated attacks exemplify why Ivy League institutions have become prime targets: they sit at the intersection of wealth, influence, and massive historical data holdings, making their donor and alumni ecosystems exceptionally lucrative for criminal groups.
Fallout:
Harvard faced heightened scrutiny as investigators confirmed that extensive personal and biographical data had been accessed—information valuable for targeted fraud, influence operations, and follow‑on phishing campaigns. Administrators began issuing security advisories urging the community to treat any communication requesting sensitive information as suspicious, signaling a shift from containment to long‑term vigilance across a wide population of high‑value individuals.
Meanwhile, Princeton confronted similar consequences, even though its breach lasted under 24 hours. The nature of the exposed donor and advancement data prompted warnings about future phishing and impersonation risks, as attackers now possessed enough contextual detail to craft highly tailored social‑engineering operations.
Arctic Wolf Insight:
Attackers are relying more on high‑fidelity social engineering rather than technical exploitation because universities often maintain expansive, decentralized administrative structures that create uneven security maturity across departments. As a result, adversaries can strike at the soft spots—human‑operated help desks, advancement offices, or alumni‑relations units—where verification processes are more discretionary and trust‑based. In both the Harvard and Princeton breaches, the attackers bypassed technical controls not by defeating them, but by persuading an insider to open the door—demonstrating once again that identity‑driven, socially engineered intrusions remain one of the most effective attack strategies against large, data‑rich academic institutions.
Sources
- Security Week: https://www.securityweek.com/alumni-student-and-staff-information-stolen-from-harvard-university/
- Inside Higher Ed: https://www.insidehighered.com/news/tech-innovation/administrative-tech/2025/11/20/why-hackers-are-targeting-ivy-league
- Bleeping Computer: https://www.bleepingcomputer.com/news/security/princeton-university-discloses-data-breach-affecting-donors-alumni/
Legion of Novice Attackers Doxx, Harass, and Stalk Women
A simple misconfiguration led to a terrifying hack that exposed tens of thousands of women’s private photos, IDs, and even direct messages.
Data Breach At A Glance
Threat Actor:Unknown
Industry Impacted:Tech
Impacted Org:Tea Dating App
Region:North America
Legion of Novice Attackers Doxx, Harass, and Stalk Women
A simple misconfiguration led to a terrifying hack that exposed tens of thousands of women’s private photos, IDs, and even direct messages.
Data Breach at a Glance
Threat Actor:
Unknown
Industry Impacted:
Tech
Impacted Org:
Tea Dating App
Region:
North America
Attack Details:
The Tea app breach unfolded just as it reached the top spot in the Apple App Store. Attackers exploited a misconfigured Google Firebase Storage bucket that Tea had been using to store verification selfies and government ID images. The bucket had been left fully exposed to the public internet, permitting unrestricted downloads, directory enumeration, and bulk scraping of sensitive archival data. Hackers discovered the open bucket and pulled roughly 13,000 verification images alongside tens of thousands of additional photos tied to user posts and comments, all of which were eventually disseminated on internet forums. The exposed data belonged largely to users who had submitted verification material prior to Tea’s 2024 system migration, revealing that legacy assets had not been properly secured or retired.
What began as a straightforward misconfiguration incident quickly escalated into a real‑world safety crisis for victims, many of whom experienced doxxing, harassment, and credible stalking risks once their selfies and ID photos began circulating on hostile platforms. Attackers also accessed and leaked direct messages, some containing personal details that allowed individuals to be identified despite the app’s promise of anonymity.
Fallout:
As the breach grew more visible online, cybersecurity analysts noted that the nature of the stolen data, particularly verification IDs, created an elevated risk of identity theft, long‑tail impersonation attacks, and cross‑platform account compromise, including a Google map reportedly showing home addresses of breached users.
For Tea as an organization, the breach triggered a reputational and regulatory crisis that included multiple class‑action lawsuits, removal from the Apple App Store, and public condemnation for failing to safeguard highly sensitive PII. The company was forced to take systems offline and hire third‑party incident‑response teams. Trust erosion among the user base was immediate, with many questioning whether a platform intended to protect women from harm could ever be safe again.
Arctic Wolf Insight:
The Tea breach is a textbook case of how basic cloud‑security misconfigurations can escalate into full‑scale human‑impact crises, especially when identity documents and biometric‑adjacent data are involved. The incident underscores the need for private‑by‑default storage, strict IAM scoping, and continuous configuration monitoring — not just at launch, but throughout the lifecycle of every system, including legacy environments. Safeguarding high‑risk PII requires persistent vigilance and human‑led detection, because attackers routinely seek out the simplest misconfiguration rather than the most sophisticated exploit.
Sources
Ransomware Campaigns Derail Multiple Major UK Retailers
A single crack in Marks & Spencer’s defenses spiraled into a cyber crisis that left the retail industry rattled.
Data Breach At A Glance
Threat Actor:DragonForce / Scattered Spider
Industry Impacted:Retail
Impacted Org:Marks & Spencer (M&S)
Region:North America
Ransomware Campaigns Derail Multiple Major UK Retailers
A single crack in Marks & Spencer’s defenses spiraled into a cyber crisis that left the retail industry rattled.
Data Breach at a Glance
Threat Actor:
DragonForce / Scattered Spider
Industry Impacted:
Retail
Impacted Org:
Marks & Spencer (M&S)
Region:
North America
Attack Details:
Initial intrusion activity traced back to early-year unauthorized access, during which attackers exfiltrated the Windows Active Directory credential store, giving them the ability to crack password hashes offline and escalate privileges across the corporate network. Once they had established persistence, the attackers moved laterally into VMware infrastructure and deployed DragonForce ransomware, encrypting ESXi hosts that supported warehouse operations, payment systems, and M&S’s ecommerce platform.
This operational disruption aligned with evidence gathered by external investigators, who confirmed that Scattered Spider — known for high‑fidelity social‑engineering attacks and help‑desk impersonation — likely served as the intrusion arm, while DragonForce supplied and operated the encryptor. Their collaboration reflects a broader trend of threat‑actor alliances leveraging both human‑driven intrusion tradecraft and ransomware‑as‑a‑service tooling to maximize impact across retailers running similar SAP‑integrated environments.
Fallout:
Online orders were suspended for nearly a week in late April, with M&S warning customers that normal operations would not resume until July. The attack cascaded across the retail ecosystem, with slowed deliveries and empty shelves due to logistics system outages, while Harrods was also forced to shut down internal systems after detecting similar intrusion attempts, though it managed to contain the attack before customer impact occurred.
As attackers continued to taunt executives, DragonForce sent CEO Stuart Machin an email gloating over the infiltration and demanding ransom, using violent rhetoric reported by the BBC. Despite this pressure, M&S refused to engage and instead escalated the incident to NCSC and the FBI.
Arctic Wolf Insight:
Identity‑centric attack paths can bypass even mature technical controls, granting attackers privileged access to deploy ransomware and encrypt critical infrastructure. Given that many retailers operate within shared technology ecosystems, where a single compromised access workflow can be reused across multiple organizations, true resilience depends on proactive threat hunting, strict verification of help‑desk and third‑party access requests, segmentation of critical operational systems, and constant monitoring for lateral‑movement indicators, ensuring that a single human‑layer lapse cannot escalate into sector‑wide operational disruption.
Sources
- BBC:https://www.bbc.com/news/articles/cr58pqjlnjlo
- The Guardian: https://www.theguardian.com/business/2025/may/01/harrods-latest-retailer-hit-cyber-attack-website-shops
- The Independent: https://www.the-independent.com/news/uk/home-news/m-s-cyberattack-dragonforce-scattered-spider-hackers-b2765010.html
Cyber Attack Targets Major US University's Non-Profit Health System
A network intrusion escalated into one of the year’s largest healthcare data breaches, revealing how a single foothold in a clinical environment can expose millions of patient records.
Data Breach At A Glance
Threat Actor:Unknown
Industry Impacted:Healthcare
Impacted Org:Yale New Haven Health System
Region:North America
Cyber Attack Targets Major US University’s Non-Profit Health System
A network intrusion escalated into one of the year’s largest healthcare data breaches, revealing how a single foothold in a clinical environment can expose millions of patient records.
Data Breach at a Glance
Threat Actor:
Unknown
Industry Impacted:
Healthcare
Impacted Org:
Yale New Haven Health System
Region:
North America
Attack Details:
Yale New Haven Health System (YNHHS) first detected the intrusion on March 8, 2025, when security teams observed abnormal network activity and immediately initiated containment protocols while bringing in external incident‑response partners. Subsequent forensic analysis confirmed that an unauthorized third party had successfully accessed the network and exfiltrated copies of sensitive patient files on the same day, indicating a high degree of preparation and a deliberate focus on stealth rather than disruption.
The threat actors infiltrated, harvested data at scale, and exited without deploying ransomware or attempting operational sabotage, underscoring the increasing profitability of pure data‑theft campaigns within the healthcare sector. This approach aligns with a broader trend in which attackers prioritize PII‑rich repositories — such as demographic datasets and Social Security numbers — because they deliver faster returns on dark‑web markets compared to the complexities of negotiating ransom payments. The breach has already triggered multiple class‑action lawsuits, with plaintiffs alleging inadequate safeguards, insufficient encryption, and delayed or incomplete notifications.
Fallout:
The breach exposed PHI for up to 5,556,702 individuals, according to the HHS Office for Civil Rights filing, with impacted data varying by patient but commonly including names, dates of birth, contact information, race or ethnicity, Social Security numbers, patient type, and medical record numbers. The breach has already triggered multiple class‑action lawsuits, with plaintiffs alleging inadequate safeguards, insufficient encryption, and delayed or incomplete notifications.
Regulators and patient‑advocacy groups expressed concern that victims now face a lifetime risk of identity theft, given that the stolen data cannot be reissued or changed. Meanwhile, the health system was forced into extensive remediation efforts, including broad patient notification, free identity‑protection services, and accelerated modernization of legacy systems. The incident ultimately reinforced a sobering reality across the healthcare sector: attackers increasingly favor high‑volume data theft over disruptive ransomware, placing organizations with large patient populations at heightened risk of silent, large‑scale compromise.
Arctic Wolf Insight:
The incident highlights systemic risks facing large health systems: sprawling networks, legacy data stores, and the persistent challenge of detecting unauthorized access quickly enough to prevent mass exfiltration. Silent exfiltration campaigns succeed when organizations lack continuous telemetry across identity pathways, east–west traffic, and data‑store access patterns. The best way to defeat attacks of this type is to ensure your organization has a robust vulnerability management program, as well as 24×7 detection and respond coverage to immediate visibility into an attacker’s foothold and disrupted exfiltration before exposure.
Sources
- Yale New Haven Health Systems: https://www.ynhhs.org/news/yale-new-haven-health-notifies-patients-of-data-security-incident
- Bleeping Computer : https://www.bleepingcomputer.com/news/security/yale-new-haven-health-data-breach-affects-55-million-patients/
- HealthExec: https://healthexec.com/topics/health-it/cybersecurity/cyberattack-yale-new-haven-health-exposes-56m-patients
- Security Boulevard: https://securityboulevard.com/2025/05/connecticuts-largest-healthcare-provider-gets-breached/
Social Engineering Compromises Well-Known Crypto Broker
A low‑visibility compromise of contractor access rapidly spiraled into a large‑scale data breach, with a single weak authentication path unravelling critical customer protections.
Data Breach At A Glance
Threat Actor:Unknown
Industry Impacted:Financial / Crypto
Impacted Org:Coinbase
Region:North America
Social Engineering Compromises Well-Known Crypto Broker
A low‑visibility compromise of contractor access rapidly spiraled into a large‑scale data breach, with a single weak authentication path unravelling critical customer protections.
Data Breach at a Glance
Threat Actor:
Unknown
Industry Impacted:
Financial / Crypto
Impacted Org:
Coinbase
Region:
North America
Attack Details:
In this months‑long, insider‑enabled data‑exfiltration campaign, cybercriminals recruited and bribed overseas customer‑support contractors to quietly siphon sensitive account data from internal systems. Attackers operated with read‑only access obtained through compromised support workflows, enabling them to collect internal documentation and customer‑service metadata used to refine future impersonation attacks. The breach was ultimately exposed when the threat actor contacted Coinbase directly and demanded a $20 million ransom to delete the stolen data, prompting Coinbase to disclose the incident publicly and notify federal regulators, including via an SEC 8‑K filing.
Coinbase traced the activity back to a cluster of overseas support agents who abused legitimate toolsets to query internal systems, aggregate customer records, and exfiltrate data without triggering immediate alarms, a method consistent with recent social engineering campaigns seen across financial technology environments. The downstream risk of this breach escalated quickly: reporting highlighted a surge in kidnap and extortion attempts targeting wealthy crypto holders, with prominent industry voices warning that the exposure of identity documents, addresses, and balance histories “will lead to people dying” given the physical‑world leverage such data provides. Coinbase now estimates the breach will cost $180–$400 million in remediation, reimbursements, and potential legal or indemnification claims—a reminder that insider‑driven data theft remains one of the most financially and operationally consequential threat vectors in the modern crypto ecosystem.
Fallout:
Investigations and regulatory filings later confirmed that attackers gained access to datasets covering at least 69,461 customers, including names, email and physical addresses, phone numbers, government‑issued ID images, partial Social Security and bank details, account balances, and transaction histories — a depth of information far more alarming than typical credential‑phishing incidents.
Coinbase estimates the breach will cost between $180 and $400 million to fully remediate, including reimbursements and potential legal or indemnification claims; a costly reminder that malicious insider data theft remains one of the most financially and operationally consequential threat vectors in the modern crypto ecosystem.
Arctic Wolf Insight:
Technical forensics revealed that the attackers’ success derived not from breaking hardened infrastructure but from exploiting human‑layer and third‑party access dependencies. This mirrors a rising trend in 2025, where attackers bypass corporate defenses by infiltrating distributed contractor ecosystems. The attackers exploited read‑only permissions and weak identity governance to aggregate and export highly sensitive customer data over an extended period — exactly the kind of subtle activity that traditional alerting fails to catch.
Organizations need human experts on call around the clock to analyze identity events, privilege use, and data‑access anomalies to spot irregular query patterns, abnormal lookup volumes, and cross‑system correlation mismatches that indicate insider‑assisted exfiltration.
Sources
- Reuters: https://www.reuters.com/sustainability/boards-policy-regulation/coinbase-breach-linked-customer-data-leak-india-sources-say-2025-06-02/
- Maine.gov: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f61fae18-f669-499e-9a87-f4d323d281f8.html
- Decrypt: https://decrypt.co/321076/coinbase-data-breach-will-lead-to-people-dying-techcrunch-founder-says
- TechCrunch: https://techcrunch.com/2025/05/21/coinbase-says-its-data-breach-affects-at-least-69000-customers/
- U.S. Securities and Exchange Commission: https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm
- BBC: https://www.bbc.com/news/articles/c80k5plpx8do
- CM Alliance: https://www.cm-alliance.com/cybersecurity-blog/cracking-the-coinbase-breach-what-went-wrong-and-what-we-can-learn
Over 70 Million Records Stolen by a 19-Year-Old
A single compromised support credential opened the door to one of the largest K‑12 data breaches in U.S. history, exposing how fragile student information systems can be.
Data Breach At A Glance
Threat Actor:Matthew Lane, a 19-year-old hacker
Industry Impacted:Education
Impacted Org:PowerSchool
Region:North America
Over 70 Million Records Stolen by a 19-Year-Old
A single compromised support credential opened the door to one of the largest K‑12 data breaches in U.S. history, exposing how fragile student information systems can be.
Data Breach at a Glance
Threat Actor:
Matthew Lane, a 19-year-old hacker
Industry Impacted:
Education
Impacted Org:
PowerSchool
Region:
North America
Attack Details:
The intrusion began when a 19-year-old threat actor, Matthew Lane, used valid support credentials to access sensitive student and staff records across thousands of K‑12 institutions, exposing both current and historical datasets. Lane leveraged this foothold to exfiltrate information including names, addresses, birth dates, Social Security numbers, medical information, disciplinary notes, and other highly sensitive student metadata. Lane then attempted to extort PowerSchool and individual school districts using the stolen data.
PowerSchool’s post‑incident analysis confirmed that Lane had compromised and extracted data from the system for weeks, leveraging the lack of MFA and insufficient monitoring on high‑privilege support workflows. This breach highlights the catastrophic downstream risks when identity‑layer protections fail in environments that aggregate sensitive information for millions of minors.
Fallout:
Court filings and customer briefings revealed that PowerSchool ultimately paid a ransom after the attacker threatened to publish the data. Reports state the organization then received a video that purported to show deletion, but threat actors simply cannot be trusted. And, even after paying a ransom, the impact was still enormous: school districts reported that “all historical student and teacher data” had been accessed, in some cases stretching back over a decade.
Additionally, nationwide class‑action litigation and mandatory breach notifications further damaged both PowerSchool’s reputation and operational capabilities.
Arctic Wolf Insight:
Notably, internal discussions revealed that a breached account was not protected by multi‑factor authentication, a basic safeguard missing at a critical identity access point. This gap enabled broad, persistent access and allowed the attacker to move through the system undetected for an extended period. In environments holding decades of sensitive student data, security must be architected so that no single compromised credential can ever become a systemic failure point.
Sources
- K-12 Dive: https://www.k12dive.com/news/college-student-charged-in-connection-with-powerschool-data-breach/748747/
- PowerSchool: https://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/
- Education Week: https://www.edweek.org/technology/powerschool-paid-a-hackers-ransom-now-cyber-criminals-are-threatening-schools/2025/05
- Tech Target: https://www.techtarget.com/whatis/feature/PowerSchool-data-breach-Explaining-how-it-happened
On-Demand Webinar
