The week in breach news Jul 9, 2025

The Centers for Medicare and Medicaid Services (CMS) is notifying roughly 103,000 Medicare beneficiaries about a breach tied to unauthorized Medicare.gov account activity.

CMS found that between 2023 and 2025, attackers used valid beneficiary details, such as names, birthdates and Medicare ID numbers, to set up fraudulent online accounts. Once active, those accounts may have exposed provider information, diagnoses and premium data.

Affected accounts have been deactivated, and CMS is notifying impacted individuals by mail.

Medical device and testing product maker Surmodics is continuing to recover from a cyberattack identified on June 5, 2025.

The Minnesota-based company kept operations running through backup systems, so customer orders and shipments were not interrupted. Surmodics says it has found no evidence that stolen data, including any belonging to third parties, has been leaked or misused.

Containment and recovery work are ongoing as the company continues to assess how much data was affected.

Air carrier Qantas confirmed a major data breach affecting up to 6 million customers. Attackers targeted an offshore IT call center, enabling them to access a third-party system.

The breach exposed names, email addresses, phone numbers, birthdates and frequent flyer numbers. No financial data, passports, passwords or login credentials were compromised, the airline said.

The attack is linked to the threat group Scattered Spider, which recently hit WestJet and Hawaiian Airlines.

Deutsche Welthungerhilfe (WHH), a German aid group that provides food assistance in crisis zones, was hit by ransomware. The attackers claim to have stolen sensitive data and are demanding roughly 20 bitcoin (about $2.1 million) in ransom. WHH shut down the affected systems, notified relevant authorities and says it will not pay.

The charity says its humanitarian work has not been disrupted; it reported reaching 4 million people directly in 2024 and continues to deliver aid in Gaza, Ukraine and Sudan.

LVMH confirmed a cyberattack against its Louis Vuitton Korea division. An intrusion on June 8 led to the leak of some customer contact information, though the company says financial data such as credit card or bank details were not affected. The breach has since been contained.

This is the second cyber incident to hit LVMH in recent months; sister luxury brands Christian Dior Couture, Tiffany and Cartier have also recently been targeted.

Global IT distributor Ingram Micro suffered a major ransomware attack on July 3 that forced it to shut down key platforms, including Xvantage and Impulse, across Europe, the U.S. and Asia. The SafePay ransomware group claimed responsibility, saying it got in through compromised VPN credentials and misconfigured systems.

The outage has disrupted resellers, MSPs and enterprise customers, with some large clients reportedly shifting purchases to competitors amid criticism of Ingram's communication during the incident. Analysts estimate the company could be losing as much as $136 million a day in revenue while the disruption continues.

C&M Software, which provides services to Brazil's Central Bank and six other banks, was breached on June 30, 2025, resulting in the theft of about $140 million. The Central Bank immediately suspended the vendor's platform access, and investigators quickly concluded the incident was not a random attack.

On July 4, Brazilian media reported the arrest of C&M Software employee João Nazareno Roque. Investigators allege the backend IT worker sold his login credentials to criminals for around $2,700, giving them access to critical systems, and that he helped build the mechanism used to divert funds while frequently swapping cell phones to avoid detection.