Global Data Breaches and Cyber Attacks in May 2025 – More Than 1.4 Billion Records Breached

Summary

• Total number of incidents disclosed: 44
• Total number of known breached records: 1,443,150,467

Sources of breached data

• Scraped or leaked from public APIs:
  • Facebook (1.2 billion records)

  • Credential dump compiled via infostealers (184 million+ credentials)

• Vendor/Cloud breaches exposing customer/employee data

  • Ascension Health (via third-party file tool): 437,000
  • Spyware apps (stalkerware): 3.2 million

• Direct or insider breaches involving client data:

  • AT&T (unconfirmed): 31 million
  • Coinbase (insider at call centre): 69,461
  • Co-op UK (ransomware gang): claimed 20 million

Top 5 incidents by number of records affected

The following are the largest incidents publicly disclosed in May 2025, ranked by known/claimed impact:

1. Facebook (Meta)

• Records affected: 1.2 billion.
• Data: Full names, Facebook IDs, email addresses, phone numbers, locations, birthdates and gender.
• Cause: Scraped via a vulnerable Facebook API.
• Status: Yet to be verified – Meta claims it relates to a historic breach.

2. Unknown credentials database

• Records affected: 184,162,718 email/password pairs
• Data: Plaintext credentials tied to Google, Microsoft and Meta, and banking logins
• Cause: Likely compiled from infostealer malware and left exposed online
• Status: Removed after discovery, source undetermined

3. AT&T (unverified)

• Records affected: 31 million (claimed).
• Data: Names, birthdates, addresses, phone numbers, tax IDs, device and cookie data.
• Cause: Posted to a hacking forum.
• Status: So far unverified but sample data was provided. AT&T is investigating.

4. Co-op UK

• Records affected: ~20 million (claimed by attackers).
• Data: Names, dates of birth, contact details of current and former members.
• Cause: Ransomware gang DragonForce (linked to Scattered Spider).
• Status: Under investigation.

5. LexisNexis Risk Solutions

• Records affected: 364,000 individuals.
• Data: Full names, home addresses, dates of birth, Social Security numbers, and potentially employment/salary information.
• Cause: Data breach stemming from a hacking incident in December 2024, when attackers infiltrated internal systems and accessed personal records.
• Status: Breach discovered in January 2025 and disclosed in May 2025 after investigation. Affected individuals were offered credit monitoring.

Trends in May 2025

• Significant rise in scraped/mass-exposed data
  Two of the five largest leaks came from large-scale scraping or credential aggregation (Facebook and infostealer dumps), rather than direct intrusions.
• Vendor risk and insider breaches rising
  Incidents at Ascension Health, Adidas, and Coinbase all stemmed from third parties – either contractors or software dependencies.
• Retail and tech remain prime targets
  Retailers including Co-op, Harrods, Adidas, Dior, and Victoria’s Secret were targeted or affected this month. Cloud services (TeleMessage, spyware vendors) and edtech (Pearson) also saw notable activity.
• UK particularly affected
  More than 5 major incidents involved UK organisations, including Co-op, Marks & Spencer, Harrods, the Legal Aid Agency and Pearson.

Key vulnerabilities exploited

• GitLab personal access token (Pearson)
  A misconfigured or exposed token gave attackers source code access and credentials to internal services.
• Infostealer malware (unknown credentials database)
  Though not tied to a single software flaw, this dataset was likely gathered silently over months from infected devices lacking endpoint protection.
• AWS misconfiguration (TeleMessage)
  An unsecured S3-like store enabled unauthorised access to archived, plaintext versions of government messages.

List of data breaches and cyber attacks disclosed in May 2025

Discover your vulnerabilities before attackers do

To avoid falling victim to cyber attacks, it’s critical to understand where you are most vulnerable to attack. Then you can close any security gaps before it’s too late.

Don’t leave your vulnerabilities to chance. Collaborate with a team that understands your risks and delivers actionable solutions.

Contact our penetration testing experts today to discuss your security needs.