Week in Breach Special Edition: What major 2025 cyber incidents taught us Jan 7, 2026

In one of the most significant cyberthreats of 2025, the Salesforce ecosystem was targeted in a sweeping third-party data breach, sending shockwaves across industries worldwide. The breach exposed more than 1 billion records across dozens of global enterprises. The campaign unfolded in multiple stages, deliberately targeting the weakest links in the ecosystem: human users and third-party integrations.

Crucially, this was not a direct breach of Salesforce’s core infrastructure. Instead, cybercriminals exploited human error and trusted third-party access to compromise individual customer Salesforce instances. The attack followed a clear, repeatable pattern:

• First, attackers used social engineering and voice phishing (vishing) to impersonate IT staff and trick employees into granting access.
• Next, victims were misled into authorizing malicious Connected Apps — such as fake versions of Salesforce Data Loader — or exposing OAuth tokens tied to legitimate tools like Salesloft, Drift and Gainsight. These tokens gave attackers persistent application programming interface (API) access and often bypassed multifactor authentication (MFA).
• Finally, attackers used Salesforce APIs to export large volumes of data, hunting for credentials, account records and sensitive personal information.

The attack’s impact was extensive. Affected organizations included aviation companies such as Air France–KLM, Qantas and Vietnam Airlines, retail brands like IKEA, Adidas and Chanel, and other major corporations, including Google, TransUnion, Toyota and Disney.

The breach was claimed by a hacker group known as Scattered LAPSUS$ Hunters, which launched a dark website to publish samples of stolen data. The group threatened Salesforce and its customers with further data releases unless ransom payments were made. Salesforce publicly refused to comply with any ransom demands, drawing a clear line against extortion.

In late August 2025, Jaguar Land Rover was hit by a cyberattack that became the most economically damaging cyber incident in U.K. history, forcing a shutdown of systems across its global manufacturing operations and leading to estimated losses of £1.9 billion.

The breach began on August 31 and quickly escalated into a major operational crisis. Production across JLR's plants halted for nearly five weeks, and more than 5,000 supply chain partners were affected, with some suppliers facing up to six months of credit strain.

The attack was linked to Scattered LAPSUS$ Hunters, the same group connected to the Salesforce ecosystem breach and other 2025 incidents.

Cyberattacks on U.S. educational institutions accelerated in 2025, affecting major universities including the University of Pennsylvania and Princeton University, and exposing millions of records tied to students, alumni, staff and community affiliates.

At Penn, the attack surfaced on October 31 through emails that appeared to come from the Graduate School of Education, with systems linked to development and alumni activities compromised, including some banking details. Princeton's separate breach, disclosed weeks later, was limited to names, contact information, addresses and donation histories.

Beyond broad network intrusions, attackers also ran targeted campaigns against university staff, including a "payroll pirate" campaign uncovered by Microsoft in which threat actors broke into HR platforms like Workday to hijack employee salaries.

Western Sydney University experienced a series of cyber incidents in 2025, among the most serious breaches reported in the education sector that year.

The university identified unusual activity on August 6 and August 11 involving a student management system hosted by a third-party cloud provider. Investigation revealed the attacker had exploited a chain of connected suppliers, gaining access through third- and fourth-party systems to exfiltrate data.

Stolen information included tax file numbers, passport details and private health and disability data. In December, a former Western Sydney University student was charged in connection with the attacks.

On October 2, Red Hat confirmed a cyberattack involving its consulting GitLab instance, allegedly affecting data tied to more than 800 organizations. A day earlier, a group calling itself Crimson Collective publicly disclosed the breach, claiming it exfiltrated 570 GB of compressed data from more than 28,000 repositories, including sensitive customer engagement reports.

Red Hat confirmed unauthorized access to a self-hosted GitLab instance used for internal Red Hat Consulting collaboration, containing project specifications, example code snippets, internal communications and limited business contact information. The company said the incident did not impact its core products or production systems, though reports suggest the stolen data included nearly 3.5 million files related to banking, telecom and government sector networks.