Data breaches in 2025
60 tracked incidents from 2025
University of Pennsylvania
In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand , largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online...
APOIA.se
In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum . In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical...
CodeStepByStep
In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online . The following month, a further corpus of data was released bringing the total to 103k. The impacted...
ADDA
In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum . The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes.
International Kiteboarding Organization
In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records . The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's...
Beckett Collectibles
In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement . The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating...
Eurofiber
In November 2025, Eurofiber France disclosed a data breach of its ticket management platform . Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the...
Spyic
In February 2025, the spyware service Spyic suffered a data breach along with sibling spyware service, Cocospy . The Spyic breach alone exposed almost 876k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access...
Cocospy
In February 2025, the spyware service Cocospy suffered a data breach along with sibling spyware service, Spyic . The Cocospy breach alone exposed almost 1.8M customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access...
Stealer Logs, Jan 2025
In January 2025, stealer logs with 71M email addresses were added to HIBP . Consisting of email address, password and the website the credentials were entered against, this breach marks the launch of a new HIBP feature enabling the retrieval of the specific...
Scholastic
In January 2025, a data breach of the publishing company Scholastic surfaced . The breach contained 4.2M unique email addresses with many of the records also including name, phone number and physical address.