Many breaches are unnecessary. Four structural controls would have prevented or significantly mitigated 49 of the 76 we analyzed.

JADEPUFFER Agentic Ransomware Campaign via Langflow CVE-2025-3248 (2026)

Contained by: PEC, EGR

JADEPUFFER exploited an internet-exposed Langflow deployment vulnerable to CVE-2025-3248, then accessed MinIO, PostgreSQL, MySQL, and Alibaba Nacos environments. The operation encrypted exactly 1,342 Nacos configuration items, deleted original tables, and attempted additional database destruction; a later ENCFORGE payload targeted AI and machine-learning files. No victim organization or affected-person count was publicly reported, and the degree of human involvement in the agentic campaign remains unresolved.

Allianz Life Insurance Company of North America Data Breach (July 2025)

A threat actor used social engineering to access a third-party cloud-based CRM used by Allianz Life Insurance Company of North America and exfiltrated sensitive personal information. The incident affected approximately 1.5 million customers, financial professionals, and select employees, with exposed data potentially including names, addresses, dates of birth, Social Security numbers, email addresses, and phone numbers. The responsible threat actor or group was not confirmed, although the breach was linked in reporting to a broader campaign associated with ShinyHunters, Scattered Spider, and UNC6040.

Qantas Airways Customer Data Breach (June 2025)

An attacker socially engineered an overseas contact-centre agent into authorizing an attacker-controlled data-extraction application against the agent’s legitimate CRM access. Approximately 5.7 million unique Qantas customer records were affected, including names, email addresses, Frequent Flyer information and, for subsets, addresses, dates of birth, phone numbers, gender and meal preferences. Qantas said passwords, PINs, payment, financial, passport and Frequent Flyer login data were not accessed. The initial intruder attribution was not confirmed; later reporting identified Scattered Lapsus$ Hunters as the collective that reportedly published some records after extortion activity.

Conduent Business Services Data Breach (January 2025)

Contained by: EGR

Conduent Business Services discovered unauthorized access to a limited portion of its environment on January 13, 2025, after access that began on October 21, 2024. The actor exfiltrated client-associated files containing personal, medical, health-insurance, claims, and Social Security information; SafePay claimed responsibility and alleged theft of 8.5 terabytes, but the role and volume were not independently confirmed. Publicly reported impact reached at least 25 million people, while later HHS OCR figures and state reports remained inconsistent and unresolved.