Global Data Breaches and Cyber Attacks in June 2025: Over 16 billion records exposed

Summary

• Total number of incidents disclosed: 33
• Total number of known breached records: 16,023,217,882
• Total number of known breached records excluding the mass credential leak: 23,217,882

Welcome to another monthly round-up of monthly cyber attack and data breach news. In June 2025, IT Governance found 33 publicly disclosed cyber security incidents, including the leak of 16 billion user credentials compiled from years of infostealer malware and previous breaches. Although this was, strictly speaking, not a new data breach, we include it in this month’s round-up as it featured in the news in June and still requires individuals and organisations to take action to secure their accounts.

Excluding this mass credential dump, more than 23 million records were compromised in newly revealed attacks, reflecting the persistent threat of ransomware, phishing and third-party compromise across all sectors.

Although no single new breach matched the scale of previous mega-incidents, June was notable for a surge in ransomware disruption across the healthcare and government sectors, a dramatic hacktivist-led assault on Iran’s financial infrastructure, and a spike in supply-chain and credential-based attacks.

Top three sources of breached data

1. Aggregated credential dumps – over 16 billion username/password combinations
2. Healthcare service providers and suppliers – over 7.8 million records
3. Retail and consumer services – over 2.2 million records

Top 5 incidents by number of records affected

The following are the largest incidents publicly disclosed in June 2025, ranked by known/claimed impact:

1. Mass credential leak – 16 billion records

• Records affected: 16 billion.
• Data: Usernames and password combinations.
• Cause: Aggregation of credentials stolen over many years.
• Status: Discovered in June 2025 across approximately 30 datasets. Not a new data breach, but many major platforms have advised users to reset their credentials and adopt MFA (multifactor authentication).

2. Episource LLC – 5.4 million records

• Records affected: 5,418,866.
• Data: Names, dates of birth, contact information, Medicaid IDs, insurance data, diagnoses, test results and treatment details.
• Cause: Ransomware attack and unauthorised network access between January and February 2025.
• Status: Breach investigation concluded in spring. Public disclosure and victim notification began in June. Credit monitoring is being provided.

3. McLaren Health Care – 743,000 records

• Records affected: 743,000.
• Data: Patient contact information, and insurance and health records, potentially including Social Security numbers.
• Cause: July 2024 ransomware attack by INC Ransom, undisclosed until forensic analysis was completed.
• Status: Victims notified in June 2025, 11 months after the breach. Free identity protection is now offered.

4. Kettering Health – approximately 730,000 records

• Records affected: Approximately 730,000.
• Data: Patient health records and internal financial or operational documents.
• Cause: Ransomware attack by the Interlock gang in May 2025.
• Status: Breach disclosed in June. Internal systems have been recovered and affected individuals are being notified. Class-action lawsuits have begun.

5. Ahold Delhaize (USA operations) – 2.24 million records

• Records affected: 2,242,521.
• Data: Names, contact information, dates of birth, government ID numbers, bank account details and workers’ compensation data.
• Cause: Ransomware attack by INC Ransom in November 2024. Data breach confirmed in 2025.
• Status: Data breach notifications issued in June 2025. Internal and customer payment systems were not affected.

Trends in June 2025

• Hacktivist activity intensified
  Iran saw coordinated attacks from the pro-Israel hacktivist group Predatory Sparrow, which disrupted banking services and destroyed $90 million in cryptocurrency by targeting Nobitex and Bank Sepah.
• Healthcare remained the most targeted sector
  High-impact ransomware incidents affected healthcare providers and suppliers in Ohio, Michigan and across the USA, compromising millions of patient records.
• Credential stuffing and supply-chain abuse persisted
  Attacks on The North Face and Gluestack demonstrated how credential reuse and malicious code injection remain active and dangerous vectors.
• Public sector services were disrupted globally
  City and state-level governments in the USA and UK experienced ransomware attacks and outages, and often lacked the resilience or backups needed for rapid recovery.
• Ransomware groups continued to use double extortion
  Double-extortion tactics remained standard, with threat actors stealing and leaking data whether or not a ransom was paid.

Key vulnerabilities exploited

Several high-profile incidents in June 2025 highlight the continued exploitation of well-known vulnerabilities and attack surfaces:

• Supply-chain compromise
  Gluestack’s popular JavaScript packages were injected with malware and downloaded nearly a million times before discovery.
• Credential harvesting malware
  The 16 billion-record credential dump was built from infostealer logs collected via trojans on compromised devices.
• Phishing and social engineering
  Targeted impersonation and spear-phishing led to breaches at organisations including Aflac and Illinois HFS.
• Third-party access risks
  Scania’s data breach occurred after attackers used credentials stolen from a service provider, emphasising the risk of poorly secured partner systems.

List of data breaches and cyber attacks disclosed in June 2025

Discover your vulnerabilities before attackers do

To avoid falling victim to cyber attacks, it’s critical to understand where you are most vulnerable to attack. Then you can close any security gaps before it’s too late.

Don’t leave your vulnerabilities to chance. Collaborate with a team that understands your risks and delivers actionable solutions.

Contact our penetration testing experts today to discuss your security needs.