Cyber 2025: A Year Under Siege

By Esther George and the Zyber Global Research Team

The year 2025 has so far marked a decisive turning point in the global cyber threat landscape. Long-standing challenges of ransomware, supply-chain intrusions, and credential theft have not only persisted but intensified. What sets 2025 apart is the rapid integration of AI into offensive cyber activity. Cyber criminals now routinely deploy generative and agentic AI to scale and automate attacks in ways that outpaced many defensive capabilities.

At the same time, supply-chain and third-party compromises have surged, identity-based attacks and account takeovers rose sharply, and novel threats such as deepfake-enabled fraud and “harvest now, decrypt later” strategies linked to future quantum decryption capability has added new layers of complexity for governments and industry. Together, these shifts have made 2025 one of the most disruptive and strategically important years in recent cyber history.

As we say goodbye to 2025, listed below are a few of 2025’s notable and more interesting breaches and hacks. 

JANUARY: 

• TalkTalk Data Breach: TalkTalk initiated an investigation after a hacker, known as “b0nd,” claimed to be selling information from approximately 18.8 million current and former customers online. The exposed data included customer names, emails, last-used IP addresses, business phone numbers, and home phone numbers. Notably, no billing or financial information was compromised, as the breach targeted a third-party supplier’s system.

FEBRUARY: 

• The Bybit Breach: A group of hackers pulled off the largest cryptocurrency heist in history after stealing $1.5 billion in Ethereum tokens from the Dubai based cryptocurrency exchange ByBit. The hackers exploited a free storage software product that ByBit used to move Ethereum to another location, most likely coupled with phishing attacks to access control and download malware. It is estimated that at least $160 million of the funds stolen from ByBit were laundered within the first 48 hours of the attack.

MARCH: 

• Yale New Haven Health System Data Breach: Yale New Haven Health (YNHHS) was the target of a massive data breach in March 2025, which impacted over 5.5 million individuals and subsequently led to a class action lawsuit filed in April. The breach was traced to a third-party file transfer service vulnerability, allowing threat actors to gain unauthorized access to protected health information (PHI) stored within the organization’s systems, exposing sensitive patient data, including medical record numbers, treatment information, Social Security numbers, and insurance details. 

APRIL:

• SK Telecom Breach: The South Korean mobile giant SK Telecom’s internal network was successfully infiltrated by malware injected through a third-party vendor’s software. The malware impacted the data of over 23 million users. The attackers collected SIM management data, International Mobile Subscriber Identity (IMSI) numbers, and authentication keys. 

MAY: 

• Addias Breach: Adidas, a German sportswear giant disclosed a data breach where hackers accessed consumer data through a third-party customer service provider, exposing contact information of customers who had interacted with its helpdesk. The breach did not compromise financial data but raised concerns about phishing and identity theft risks. 

JUNE:

• The 16 Billion Passwords Leak: Over 16 billion passwords and login credentials were leaked from Google, Apple, and Facebook platforms, in what was described as one of the largest credential stuffing data dumps and breaches in history. The breach reportedly aggregated credentials from malware infostealers and multiple prior leaks, including reused passwords from third-party breaches, emphasizing the need to implement multi-factor authentication (MFA), enforce stronger password hygiene, and limit access privileges across platforms.  

JULY:

• TransUnion Data Breach: The TransUnion breach impacted the sensitive data of more than 4.4 million customers after attackers gained unauthorized access to a targeted Salesforce database. Attackers reportedly exploited misconfigured API permissions within a third-party integration connected to Salesforce, enabling data exfiltration without triggering standard access controls. The compromised environment contained Social Security numbers and credit-related data. 

AUGUST: 

• Google data breach: Google confirmed that one of its Salesforce databases had been compromised. The exposed data was limited to basic business contact information and internal notes from small and medium sized business (SMB) customers things like company names, email addresses, and phone numbers. Importantly, no Gmail passwords or email content were leaked. Google immediately cut off access and notified affected customers.

SEPTEMBER: 

• Harrods breach: The luxury retailer confirmed a data breach after cybercriminals gained unauthorized access to customer-related data. The incident targeted systems linked to customer services and loyalty programs via a third-party e-commerce service provider. The breach exposed customer records for approximately 430,000 individuals. 

OCTOBER:  

• Red Hat GitLab Breach: A cyber threat group known as Crimson Collective claimed responsibility for exfiltrating approximately 570 GB of compressed data from over 28,000 internal repositories, including sensitive information from 800 Customer Engagement Reports (CERs), containing VPN settings, infrastructure configuration data, API keys, authentication tokens, and credentials associated with large enterprise clients, such as IBM, American Express, NSA, Cisco, and the Department of Defence.  

NOVEMBER:

• Pajemploi breach: The French social security service for parents and home-based childcare providers, has suffered a data breach that may have exposed personal information of 1.2 million individuals. The incident impacts registered professional caregivers working for private employers, typically parents using the Pajemploi service part of URSSAF - the French organization that collects social security contributions from employers and individuals.

Conclusion

The events of 2025 reveal a cyber threat landscape transforming faster than many organisations can keep up. Month after month, attackers pushed ahead, using generative and agentic AI to speed up intrusions, automate reconnaissance, and deliver highly convincing social engineering at scale. At the same time, third-party and supply-chain weaknesses emerged as the dominant attack vector, demonstrating how even the most mature enterprises remain exposed through the interconnected digital ecosystems they depend upon.

Identity compromise, massive credential leaks, deepfake-enabled fraud, and quantum-anticipatory strategies further expanded the threat surface, illustrating how cyber risk is no longer confined to traditional malware or ransomware deployment. Instead, it now encompasses complex, layered attacks that combine technical exploitation with psychological manipulation, data aggregation, and long-term planning.

Taken together, the breaches of 2025 remind us that cybersecurity is not merely a technical challenge but an organisational and societal one. Defenders must strengthen third-party oversight, adopt zero-trust principles, reinforce identity security, and prepare for adversaries who are rapidly enhancing their capabilities with AI. As we look ahead to 2026, the message is clear; those who invest proactively in intelligence-driven and AI-assisted defence will be best positioned to withstand what comes next.

And while it is a matter of perspective, there’s no doubt that for cybercriminals, 2025 has been a very profitable year. The cybercriminals of 2025 were bolder, faster, and more technologically enabled than ever before. The real question for 2026 is whether defenders can finally close the gap. ☺

Read more:

• Top 10 Data Breaches of 2025 - Guardz - https://guardz.com/blog/top-recent-data-breaches/
• Data Breaches 2025: Biggest Cybersecurity Incidents So Far - PKWARE - https://www.pkware.com/blog/recent-data-breaches#may2025
• Harrods warns customers their data may have been stolen in IT breach - https://www.theguardian.com/business/2025/sep/26/harrods-warns-customers-their-data-may-have-been-stolen-in-it-breach#:
• Red Hat GitLab Data Breach: The Crimson Collective's Attack - https://blog.gitguardian.com/red-hat-gitlab-breach-the-crimson-collectives-attack/
• French agency Pajemploi reports data breach affecting 1.2M people - https://prsol4.rssing.com/chan-80162072/article2920.html
• Gmail Panic? The Truth Behind the “2.5 Billion Account Leak” - https://www.keypasco.com/en/gmail-panic-the-truth-behind-the-2-5-billion-account-leak/
• TransUnion data breach impacts more than 4.4 million Americans — here’s how to spot identity theft - https://www.cnbc.com/select/transunion-data-breach-impacts-over-4-million/
• 16 Billion Stolen Logins for Apple, Google, Facebook and More: How to Stay Safe - https://www.mcafee.com/blogs/internet-security/16-billion-stolen-logins-for-apple-google-facebook-and-more-how-to-stay-safe/
• Adidas Data Breach: What Consumers Need to Know and How to Protect Yourself - https://www.mcafee.com/blogs/internet-security/adidas-data-breach-what-consumers-need-to-know-and-how-to-protect-yourself/
• SK Telecom Cyber Attack: What You Need to Know - https://hoploninfosec.com/sk-telecom-cyber-attack
• Yale New Haven Health Agrees to $18 Million Data Breach Settlement - https://www.hipaajournal.com/yale-new-haven-health-system-data-breach/
• Crypto analysts stunned by Lazarus Group’s capabilities in $1.46B Bybit theft - https://cyberscoop.com/bybit-lazarus-group-north-korea-ethereum/#:~:
• TalkTalk investigates ‘customer data breach’ after hacker puts private details for sale online - https://www.thesun.co.uk/tech/33021662/talktalk-data-breach-hacker-customer-details-for-sale/?