The week in breach news Oct 15, 2025

SonicWall's disclosure last month of a data breach on its cloud backup service appears to be far more serious than initially believed.

On October 8, following a full investigation conducted with Google's Mandiant, SonicWall announced that an unauthorized party accessed firewall configuration backup files for all customers who have used SonicWall's cloud backup service. This is a significant escalation from the company's earlier assessment on September 17, when it believed only 5% of its firewall install base was affected. Meanwhile, SonicWall reaffirmed that the exposed files contain encrypted credentials and configuration data.

The company urges all customers to log in and review their devices immediately. It has also started notifying partners and users directly and released tools to help assess and remediate affected systems.

Microsoft has warned that hackers are breaking into human resources SaaS platforms like Workday to target employees at U.S. universities and divert their salaries to attacker-controlled accounts.

Dubbed "payroll pirate," Microsoft Threat Intelligence observed a financially motivated scam by a threat actor called Storm-2657, compromising university employee accounts to access HR profiles and redirect payments. Since March 2025, the group has used social engineering tactics and the lack of multifactor authentication (MFA) to break into 11 email accounts across three universities. From there, they sent nearly 6,000 phishing emails to 25 universities, using lures such as campus illness alerts and faculty misconduct reports to steal login credentials through adversary-in-the-middle (AiTM) attacks.

Microsoft said this is yet another variation of the business email compromise (BEC) scam. The attacks don't exploit flaws in HR platforms themselves but rather take advantage of poor MFA adoption and weak authentication practices.

On October 12, 2025, Qantas Airways confirmed that hackers had released the personal data of more than 5.7 million customers on the dark web.

Qantas is among many global companies — including Toyota, Disney, Ikea, Air France and KLM — targeted by the hacker collective Scattered Lapsus$ Hunters. The group reportedly stole nearly 1 billion records in July by targeting customers of cloud technology giant. While the hackers did not breach Salesforce itself, they instead impersonated legitimate Salesforce employees in calls to IT helpdesks of the affected companies to gain access. In Qantas' case, a call center in the Philippines was reportedly exploited to obtain access.

The exposed passenger data includes dates of birth, phone numbers, addresses, emails and frequent flyer numbers. Qantas confirmed that no credit card, financial or passport details were compromised and that frequent flyer accounts remain secure.

In a troubling new development, threat actors are abusing a digital forensics and incident response (DFIR) tool to carry out ransomware attacks.

Velociraptor is an open-source DFIR platform used by security teams to monitor endpoints across Windows, Linux and macOS environments. It allows for continuous data collection and rapid response to security events. According to researchers at Cisco Talos, in an attack observed in mid-August 2025, the attackers used the tool to drop ransomware families Warlock, LockBit and Babuk. During the attack, attackers exploited on-premises SharePoint vulnerabilities, known as ToolShell, to gain initial access and deploy an outdated version of Velociraptor (version 0.73.4.0). This version contained a privilege escalation flaw (CVE-2025-6264) that allowed arbitrary command execution and full endpoint compromise.

Researchers say this marks yet another example of how ransomware groups are expanding their arsenals by turning legitimate tools — both commercial and open source — into weapons for more sophisticated attacks.

Shuffle, a leading crypto betting platform, has confirmed a data breach after its third-party customer service provider was compromised, exposing the data of most of its users.

On October 10, Shuffle announced that its customer relationship management (CRM) service provider, Fast Track, suffered a data breach that exposed user information. The company used Fast Track for programmatic email sending and other user communications, which means email addresses and messages were believed to be among the compromised data. Shuffle said its specialists are investigating how the leak occurred and where the stolen data may have ended up.

The exposed information includes full names, email addresses, home addresses, phone numbers and complete transaction histories. The breach also revealed betting patterns and customer support message logs, raising concerns about user privacy and potential misuse of sensitive behavioral data.