The week in breach news Jul 16, 2025

Bitcoin Depot, a major U.S. bitcoin ATM operator, is notifying customers of a data breach that exposed personal information collected during cryptocurrency transactions. Exposed data may include names, phone numbers, driver's license numbers, home addresses, birthdates and email addresses, depending on the individual.

The company detected suspicious activity on June 23, 2023, and completed its internal investigation on July 18, 2024. However, an ongoing police investigation prevented it from notifying customers until July 2025.

The Texas Department of Transportation (TxDOT) confirmed a data breach on May 12, 2025, affecting nearly 300,000 crash report records after a hacker gained access through a single personal TxDOT account.

Exposed information includes names, addresses, driver's license and license plate numbers, insurance policy details and other crash-related data. The agency began notifying affected individuals by mail on July 9 and set up a dedicated hotline for those impacted.

Flutter Entertainment, owner of gambling brands including Betfair and Paddy Power, disclosed a data breach affecting up to 800,000 of its 4.2 million average monthly players across its U.K. and Ireland brands. The company pointed to a breach at an unnamed service provider as the source of the incident.

Exposed data may include customers' IP addresses, email addresses and limited betting account information. Flutter says it has contained the incident and is working with cybersecurity experts to strengthen its defenses.

Cybersecurity researchers discovered an unsecured archive traced to Rockerbox, a Texas-based consultancy specializing in tax credits. The exposed trove contained 287 GB of data and nearly 246,000 records, since secured.

Compromised records include names, addresses, emails, dates of birth, Social Security numbers, driver's license/ID numbers and employment and salary information tied to Work Opportunity Tax Credit documents, along with sensitive files such as DD214 military discharge forms.

LVMH is in the spotlight for another cyberattack this week, this time on its Louis Vuitton UK operations. The retailer disclosed that this incident exposed customer names, contact details and purchase history. The brand was quick to reassure customers that no financial data was compromised.

The breach, which occurred on July 2, marks the third LVMH-related cyber incident in three months, following similar attacks on Louis Vuitton’s Korean arm last week and Christian Dior Couture.

Nippon Steel Solutions, a subsidiary of Nippon Steel, detected unauthorized activity on several servers. An investigation found that hackers exploited a zero-day flaw in the company's network equipment to access sensitive customer, partner and employee information.

Exposed customer data may include names, company affiliations, job titles, business email addresses, phone numbers and addresses; exposed partner data includes names and business emails. This follows a February 2025 attack on Nippon Steel USA by the BianLian ransomware group.

New Zealand grocery retailer Foodstuffs Ltd. detected attempts by scammers to access a limited number of its New World Clubcard accounts using automated password-guessing tools. The company says its systems remain secure and no payment card data was compromised.

As a precaution, Foodstuffs temporarily disabled the New World dollars redemption feature and removed stored payment tokens from affected accounts, and is asking impacted users to reset passwords with stronger passphrases.