Summary

• Total number of incidents disclosed: 49
• Total number of confirmed breached records: over 1.98 million
• Total number of unconfirmed breached records: 1.5 billion

Welcome to another monthly round-up of monthly cyber attack and data breach news. September 2025 saw 49 publicly reported cyber attacks and data breaches around the globe.

In total, at least 1.98 million records were confirmed to have breached, while attacker claims – particularly those linked to the ongoing Salesforce/Salesloft Drift breach – suggest the true figure may exceed 1.5 billion.

The month’s five largest incidents

Salesforce/Salesloft Drift campaign (multiple organisations)

• Records affected: 1.5 billion (unconfirmed)
• Data: Contact records, support case contents, internal files, OAuth tokens and API credentials
• Cause: Compromise of Salesloft Drift integrations used with Salesforce; stolen tokens leveraged by ShinyHunters
• Status: Confirmed by multiple victims; ongoing investigation across global enterprises and SaaS providers

Stellantis

• Records affected: 18 million (unconfirmed)
• Data: Employee, dealer, and customer details; internal documents and communications
• Cause: OAuth compromise via Salesforce/Salesloft Drift campaign
• Status: Confirmed; investigation ongoing; no financial or highly sensitive data reportedly exposed

FinWise Bank/American First Finance

• Records affected: 689,000
• Data: Full names, personal identifiers and financial account data
• Cause: Insider access – a former employee improperly accessed and exported sensitive data over two years
• Status: Confirmed; class-action lawsuit filed; affected individuals offered credit monitoring

Harrods

• Records affected: 430,000
• Data: Customer names, contact details, loyalty information and co-branded card identifiers
• Cause: Breach of a third-party e-commerce service provider used by Harrods
• Status: Confirmed; no payment card data or passwords exposed. Harrods refused to pay the attackers’ ransom demands and notified the ICO and affected customers.

Kido International (UK)

• Records affected: 8,000 children
• Data: Names, photos, home addresses and family contact details
• Cause: Ransomware data theft by the Radiant group
• Status: Confirmed; law enforcement investigation ongoing; attackers partially withdrew stolen photos following public backlash

Trends in September 2025

• Supply-chain attacks intensified – The Salesforce OAuth compromise expanded its impact across cybersecurity vendors, Cloud providers and major enterprises.
• Operational ransomware returned – Manufacturing and aviation sectors saw renewed disruption attacks, echoing pre-2024 trends.
• Public-sector targeting increased – Government offices in the USA, Panama and the UK faced ransomware or data-theft incidents.
• Child data and education breaches – The Kido International attack highlighted growing risks to childcare and education providers, both in data sensitivity and reputational harm.
• Insider risk resurgence – The FinWise insider case shows that internal access remains a persistent data protection challenge.

Key vulnerabilities exploited

• OAuth token misuse – Attackers exploited token reuse and over-permissioned integrations in third-party CRM connectors (Salesforce/Salesloft Drift).
• Compromised CI/CD pipelines – Attacks like GhostAction and Shai-Hulud demonstrated the persistent risk of automated credential theft and malware propagation through developer ecosystems.
• Unpatched public systems – Ransomware groups continued to exploit exposed RDP servers and outdated VPN appliances in sectors such as government and manufacturing.
• Weak third-party controls – Breaches at vendors such as Harrods’ supplier and Wealthsimple’s software provider underscored the importance of rigorous supplier risk management.

List of data breaches and cyber attacks disclosed in September 2025

Discover your vulnerabilities before attackers do

To avoid falling victim to cyber attacks, it’s critical to understand where you are most vulnerable to attack. Then you can close any security gaps before it’s too late.

Don’t leave your vulnerabilities to chance. Collaborate with a team that understands your risks and delivers actionable solutions.

Contact our penetration testing experts today to discuss your security needs.