Global Data Breaches and Cyber Attacks in July 2025: over 14.9 million records exposed

Summary

Total number of incidents disclosed: 29

Total number of known breached records: 14.9 million

Welcome to another monthly round-up of monthly cyber attack and data breach news. At least 29 publicly disclosed incidents were reported worldwide in July 2025, spanning sectors from retail and travel to telecoms, healthcare, government and cryptocurrency. Based on confirmed figures, a minimum of 14.9 million records were breached this month. This is a lower-bound figure, as several major incidents did not provide confirmed counts but likely involved significant volumes of personal data.

Top 5 incidents by number of records affected

1. Co-op (update)

• Records affected: 6.5 million (confirmed)
• Data: Names, addresses, emails and phone numbers of loyalty members
• Cause: Supply-chain breach of loyalty programme provider Azpiral in April; public disclosure in July
• Status: Confirmed update – initial public claim in May, formal disclosure in July; arrests made in connection with a wider retail hacking spree

2. Qantas

• Records affected: Up to 6 million
• Data: Names, contact details, dates of birth, frequent-flyer numbers; no passwords or payment data
• Cause: Criminal access to a third-party contact-centre system; suspected Scattered Spider involvement
• Status: Confirmed; investigation ongoing; regulators and customers notified

3. Allianz Life

• Records affected: Majority of 1.4 million
• Data: Customer and agent contact details and other PII; no passwords or financial data
• Cause: Breach of a cloud-based contract management/CRM platform on 16 July; ShinyHunters suspected
• Status: Confirmed; FBI notified; customer notifications under way

4. Tea

• Records affected: 72,000 images (including 13,000 ID/selfie verifications) and 1.1 million messages
• Data: Sensitive personal images, verification ID documents, private chat content
• Cause: Misconfigured cloud storage and exposed Firebase database exploited by attackers
• Status: Confirmed; FBI engaged; app taken offline; identity protection offered

5. Kelly Benefits

• Records affected: 553,660
• Data: Names, Social Security numbers, dates of birth, and medical and financial information
• Cause: Network intrusion in December 2024; revised impact disclosed July 2025
• Status: Confirmed; affected individuals offered credit monitoring

Trends in July 2025

• Third-party exposure dominates large breaches
  Qantas, Allianz Life and Co-op all suffered incidents rooted in vendor or partner systems.
• Retail and consumer brands remain prime targets
  Multiple global-brand breaches underscore retail’s continued risk profile.
• Data theft without encryption persists
  Several attacks, including those on Dell and Louis Vuitton, involved pure exfiltration with no ransomware deployment.
• Supply-chain and developer ecosystem compromises
  Toptal’s GitHub breach and malicious NPM package uploads highlight software-supply-chain risks.
• Cloud misconfiguration still costly
  Tea’s exposure of highly sensitive images and messages shows that mismanaged cloud storage can be as damaging as deliberate hacking.

Key vulnerabilities exploited

• Third-party system weaknesses
  Compromises at loyalty providers, contact-centre platforms and CRM tools facilitated the largest confirmed breaches.
• Supply-chain compromises
  Incidents like Toptal’s NPM poisoning demonstrate how developer platforms can be leveraged to reach downstream targets.
• Credential abuse/social engineering
  Likely entry vector in cases such as Ingram Micro’s SafePay ransomware attack.
• Cloud misconfiguration
  Tea’s unsecured storage and database access enabled mass extraction of highly sensitive user data.
• Zero-day exploitation
  MOVEit-style file-transfer vulnerabilities remain in play, as suspected in the Allianz Life breach.

List of data breaches and cyber attacks disclosed in June 2025

Discover your vulnerabilities before attackers do

To avoid falling victim to cyber attacks, it’s critical to understand where you are most vulnerable to attack. Then you can close any security gaps before it’s too late.

Don’t leave your vulnerabilities to chance. Collaborate with a team that understands your risks and delivers actionable solutions.

Contact our penetration testing experts today to discuss your security needs.