The week in breach news Dec 17, 2025

Apple and Google issued a new round of cyberthreat notifications, warning users worldwide about what they describe as unprecedented activity by state-linked mercenary spyware groups.

Google recently warned users about continued activity from a sanctioned spyware vendor known as Intellexa, which has remained active despite international crackdowns. Apple has now confirmed it also sent threat notifications to users. The company did not disclose details about the suspected hacking activity, the number of users affected or who may be behind the surveillance.

Apple said it has sent threat notifications to users in more than 150 countries since 2021 as part of its efforts to protect individuals from highly targeted digital surveillance.

The French Ministry of the Interior confirmed a cyberattack that compromised its email servers, raising concerns about the security of internal government communications.

The breach was detected overnight between December 11 and December 12, when threat actors accessed some document files stored on the email systems. The investigation is still ongoing, and authorities have not yet confirmed whether any data was stolen.

In response, the ministry said it has tightened security protocols and strengthened access controls across the information systems used by its personnel to reduce the risk of further intrusion.

New Zealand's National Cyber Security Centre warned approximately 26,000 people that their devices may have been infected with malicious software.

The cyber agency sent alert emails to roughly 26,000 addresses after identifying infections linked to the Lumma Stealer malware, which is designed to steal sensitive information, including email addresses and passwords. Some compromised credentials were linked to government agency systems and bank accounts, increasing the potential risk.

The agency said this was the first time it had contacted so many people about a single malware campaign. It added that it is working closely with government agencies and financial institutions to help protect affected users and limit further damage.

Ireland's Health Service Executive (HSE) confirmed that it suffered a second ransomware attack earlier this year, following the major cyberattack that disrupted the agency in 2021.

The HSE was already in the process of offering compensation to victims of the 2021 ransomware attack, which caused widespread disruption and cost an estimated €102 million. It has now emerged that another ransomware incident occurred in February, this time involving a third-party data processor. The attack resulted in a data breach, drawing renewed attention to the agency's cybersecurity challenges.

The HSE said its IT systems were fully restored after the incident and that there is no evidence data was exfiltrated during the attack.

The Bank of Cyprus Oncology Centre confirmed a cyberattack in which hackers breached patient and employee personal data and published some of the stolen information.

The organization said a malicious third party accessed its systems and illegally extracted sensitive data. The attackers have already released some of the stolen information and are threatening to publish more through media outlets and social media platforms. The exposed data includes personal information belonging to both patients and employees.

The center said it is working closely with state authorities as part of the investigation. It has also implemented additional security measures to strengthen system safety and reduce the risk of further unauthorized access.