Jaguar Land Rover cyberattack deepens, with prolonged production outage, supply chain fallout

Jaguar Land Rover (JLR), the U.K.-based automaker owned by Tata Motors, has extended production shutdowns after a cyberattack that disrupted global operations, halted manufacturing, and sent ripples across its supply chain. The company has shut down its IT networks in response to the attack. Industry sources have, in the meantime, warned that the disruption could last into November. A hacker group known for social-engineering campaigns has claimed responsibility. 

“Today we have informed colleagues, suppliers and partners that we have extended the current pause in our production until Wednesday 24th September 2025,” according to a Tuesday statement from Jaguar Land Rover. “We have taken this decision as our forensic investigation of the cyber incident continues, and as we consider the different stages of the controlled restart of our global operations, which will take time.” 

The statement added, “We are very sorry for the continued disruption this incident is causing and we will continue to update as the investigation progresses.”

Volvo Group Discloses Data Breach After Ransomware Attack on HR Supplier

Volvo Group North America has begun notifying employees and associates about a data breach that exposed their personal information, including names and Social Security numbers.

The security incident did not originate within Volvo’s own networks but was the result of a ransomware attack on one of its third-party human resources software suppliers, a company named Miljdata. The breach highlights the persistent and growing risks associated with supply chain vulnerabilities.

According to the data breach notification letter, the initial security incident targeting Miljdata occurred on August 20, 2025. The HR software provider first became aware of the ransomware attack three days later, on August 23.

It wasn’t until September 2, 2025, that Miljdata determined that data belonging to Volvo Group personnel had been compromised in the attack. Miljdata informed Volvo Group of the exposure on the same day.

Volvo has emphasized that its own internal systems were not compromised as part of this event and that the breach was contained within the environment of its supplier.

Tenable Data Breach Confirmed -Customer Contact Details Compromised

Tenable, a well-known cybersecurity company, has confirmed that it was affected by a recent large-scale data theft campaign. The attack targeted Salesforce and Salesloft Drift integrations, and Tenable was one of the organizations caught up in the incident.

The company stressed that while customer contact details were accessed, Tenable products and the data inside those products were not impacted.

According to Tenable, the breach involved unauthorized access to its Salesforce system. The exposed information included subject lines and short descriptions submitted by customers when opening support cases.

Additionally, standard business contact information, such as customer names, email addresses, phone numbers, and location details, was also accessed. At this point, the company stated there is no evidence that this information has been misused.

Wealthsimple Data Breach – User Information Leaked Online

Canadian financial technology company Wealthsimple disclosed a data security incident on September 5, 2025, revealing that personal information belonging to less than one percent of its clients was accessed without authorization.

The breach, which was detected on August 30, has prompted the company to implement enhanced security measures and offer comprehensive support to affected customers.

Wealthsimple’s security team acted quickly after discovering the incident, containing the issue within a few hours of detection.

The breach originated from a compromised software package developed by a trusted third-party vendor, which allowed unauthorized access to client data for a brief period.

• Incident detected and contained within hours on August 30, 2025.
• External security experts brought in for thorough investigation.
• All client accounts remained secure throughout the incident.
• No passwords compromised or funds accessed during breach.

Despite the security incident, the company emphasized that all client accounts remain secure and fully protected. No passwords were compromised, and crucially, no funds were accessed or stolen during the breach.

The financial platform’s core security infrastructure remained intact, ensuring that only affected clients could access their own accounts.

Cornwell Quality Tools Suffers Data Breach, 100,000 User Records Exposed

Cornwell Quality Tools, a leading automotive and industrial tool supplier, has confirmed a significant data breach that compromised the personal information of 103,782 individuals.

The cybersecurity incident occurred on December 12, 2024, when unauthorized attackers gained access to the company’s computer network, exposing sensitive customer data including names, Social Security numbers, medical information, and financial account details.

The unauthorized intrusion into Cornwell’s systems resulted in the exposure of both personally identifiable information (PII) and protected health information (PHI).

The compromised data encompassed a wide range of sensitive information that could potentially be used for identity theft and financial fraud.

The breach affected over 100,000 individuals who had their personal data stored within Cornwell’s network infrastructure.

Following the discovery of the security incident, Cornwell initiated an investigation to determine the scope and impact of the breach.

The company worked to secure their systems and assess what information was accessed during the unauthorized intrusion.

Harrods Cyberattack Exposes 430,000 Customer Records in Latest Data Breach

Luxury department store Harrods recently disclosed a data breach, in which, hackers stole information linked to approximately 430,000 customer records. The Harrods data breach has prompted the retailer to inform affected individuals and relevant authorities while stressing that no payment details or passwords were compromised during the incident.

According to a statement from the retailer, the Harrods data breach involved data accessed through a third-party provider, not the store’s own systems. The stolen information primarily consisted of basic personal details such as names and contact information provided by customers.

Additional data related to marketing preferences, loyalty cards, and partnerships with other companies, including Harrods’ co-branded cards, was also taken. However, the company emphasized that this information is unlikely to be correctly interpreted by unauthorized parties.

Harrods confirmed it would not engage with the threat actors behind the breach. “Our focus remains on informing and supporting our customers,” a spokesperson said. “We have informed all relevant authorities and will continue to cooperate with them.”

Intel Internal Data Breach for 270k Workers

Heads-up to my Intel and former Intel colleagues — a data breach has been discovered that exposed information on 270k workers. The good news, is that the data was probably not very sensitive as it was the internal system used to order business cards. 

Other sites that were compromised were a project listing, vendor supplier, and hierarchy management site. Insights about who is working on which projects and their reporting structures could offer focused attackers’ information to assist with targeting of people for social engineering attacks.

What is embarrassing is the security researchers found that Intel was using hardcoded passwords to protect these sites and misconfigured encryption that was easily bypassed.

The vulnerability researcher, Eaton, followed ethical standards and reported these to Intel last year. Intel closed the vulnerabilities this year.

Qualys Confirms Data Breach – Hackers Accessed Salesforce Data in Supply Chain Attack

Qualys has confirmed it was impacted by a widespread supply chain attack that targeted the Salesloft Drift marketing platform, resulting in unauthorized access to a portion of its Salesforce data.

The breach originated from a sophisticated cyberattack campaign targeting Salesloft Drift, a third-party Software-as-a-Service (SaaS) application used by Qualys to automate sales workflows and manage marketing leads.

According to the company, the attackers successfully stole OAuth authentication tokens that connected the Drift application to Qualys’s Salesforce instance. The malicious actors then used these tokens to gain unauthorized access.

Qualys specified that the access was limited to some information within its Salesforce environment, which is primarily used for managing leads and contact information.

The company confirmed in its statement that the attack did not compromise its foundational security infrastructure. There was no impact on the Qualys production environments, including its shared and private platforms, codebase, or any customer data hosted on the Qualys Cloud Platform. Furthermore, all Qualys platforms, agents, and scanners remained fully functional with no operational disruptions.

Cyberattack hits European airports: Heathrow delays, 50% Brussels flights to be cancelled, Delhi issues advisory

Travellers across Europe faced a weekend of disruption on Friday, 19 September, after airports including London Heathrow, Berlin Brandenburg and Brussels were hit by flight delays and cancellations following a cyber-attack.

The attack, believed to be a ransomware strike on aviation IT provider Collins Aerospace, targeted its widely used check-in technology. The failure forced several airports to revert to manual systems, leaving thousands of passengers stranded, resulting in queues and backlogs. While travel has largely returned to normal, the incident underlines the importance of building cyber resilience into our critical infrastructure.

Airports, in particular, pose significant cyber risks due to their complexity and highly digitized processes. As a critical part of a nation’s infrastructure, the approach to securing them must reflect the reality that no system is entirely secure – a point acknowledged in the World Economic Forum’s report, The Cyber Resilience Compass. This means that the focus cannot solely be on preventing attacks. It is equally vital to build resilience to ensure that when attacks do happen, their impact is minimized and critical services are maintained. This dual approach is crucial for safeguarding passenger safety, maintaining public trust and enabling long-term growth.

SABC hacked

The South African Broadcasting Corporation (SABC) has confirmed that it was the victim of a business email compromise that affected some of its staff’s email accounts.

The state-owned broadcaster’s head of communications, Mmoni Ngubane, told MyBroadband that its IT team has secured the compromised mailboxes.

“The SABC is aware of a recent email compromise affecting a small number of employee accounts,” she said.

“Our IT Security team responded immediately, securing the affected mailboxes and containing the incident. Preliminary investigations indicate that the matter was isolated and quickly resolved.”

Ngubane said the SABC continues strengthening its cybersecurity measures and educating staff on cybersecurity.

“We encourage vigilance against suspicious emails to our staff and external partners,” she added.

Microsoft restores services to Russia-backed Nayara Energy

Microsoft suspended service after the EU introduced its fresh round of sanctions on July 18 against Russia and its energy sector that also cover Nayara, majority owned by Russian entities.

Nayara had approached a New Delhi court to order restoration of Microsoft’s services, saying its employees were unable to access official emails and company data needed for day-to-day operations.

On Wednesday, Nayara’s lawyer told the judge that the “matter has been resolved” as Microsoft has restored services to the company.

In a statement to Reuters, Microsoft confirmed it has restored services for Nayara Energy.

Cyberattack hits France’s third-largest mobile operator, millions of customers affected

Bouygues Telecom, one of France’s largest telecom companies and its third-largest mobile operator, announced on Wednesday being hit by a cyberattack that compromised the data of millions of customers.

The nature of the attack was not disclosed, and the company said the “situation was resolved as quickly as possible” by its technical teams, and that “all necessary measures were put in place.”

According to its corporate statement, the attack “allowed unauthorized access to certain personal data from 6.4 million customer accounts.”

Bouygues reported having 18.3 million mobile customers in its annual results for 2024, as well as 4.2 million fiber-to-the-home customers. It is not clear from the announcement which customer segment was affected.

The company stated those who were impacted “have received or will receive an email or text message to inform them, and our teams remain fully mobilized to support them.”

A report regarding the data breach has been filed with France’s data protection regulator, the CNIL, and a complaint has been submitted to France’s judicial authorities.

Global Jewellery Brand Pandora Suffers Hacked

Danish jewellery giant Pandora has disclosed a significant data breach that compromised customer information through a third-party vendor platform. 

The company has begun notifying affected customers, starting with Italian markets, about the cybersecurity incident that resulted in unauthorized access to personal data.

Key Takeaways

1. Supply-chain breach via third-party vendor exposed customer names, phone numbers, and emails.

2. No passwords or payment data accessed.

3. No signs of data leaks, but customers warned to watch for phishing.

Third-Party Vendor Vulnerability Exploited

According to the RansomNews report on X, the breach occurred through a supply chain attack, where threat actors gained access to customer data via a third-party service provider’s platform rather than directly targeting Pandora’s primary systems. 

This attack vector has become increasingly common as cybercriminals exploit the attack surface created by vendor relationships and interconnected digital ecosystems.

Cisco Discloses Data Breach Exposed User Profiles from Cisco.com

Cisco Systems has disclosed a data breach that compromised basic profile information of users registered on Cisco.com following a successful voice phishing attack targeting one of the company’s representatives.

The incident resulted in unauthorized access to a third-party cloud-based Customer Relationship Management (CRM) system used by the networking giant.

The breach occurred when a malicious actor executed a vishing attack against a Cisco employee, ultimately gaining access to export a subset of user data from the compromised CRM instance.

According to Cisco’s official disclosure, the exported information primarily consisted of basic account profile details including names, organization names, addresses, Cisco-assigned user IDs, email addresses, phone numbers, and account metadata such as creation dates.

Google hit by cyberattack targeting Salesforce data

Hackers stole user credentials from Salesforce customers in a widespread campaign earlier this month, according to researchers at Google Threat Intelligence Group, who warned that the thefts could lead to follow-up attacks.

A threat actor that Google tracks as UNC6395 targeted Salesforce instances using compromised OAuth tokens that were associated with the customer engagement vendor Salesloft’s Drift AI chat agent.

Researchers believe the hackers’ primary goal was to harvest credentials, as they stole large amounts of data from numerous Salesforce instances.

TransUnion says 4.4 million consumers’ data compromised in hack

Credit bureau TransUnion said Thursday that more than 4 million people’s data was exposed in a recent hack involving an unidentified third party. The company said it had “recently experienced a cyber incident involving a third-party application serving our U.S. consumer support operations.”

In a statement, TransUnion said it had “quickly contained the issue, which did not involve our core credit database or include credit reports.”

Maine legally requires disclosures for certain kinds of breaches affecting its residents. The name of the third party application was not disclosed, but U.S. corporations have recently seen waves of compromises as hackers trick employees into opening up their respective employers’ Salesforce databases.

A Salesforce representative did not immediately return a message seeking comment.

Manpower franchise discloses data theft after RansomHub posts alleged stolen data

Global staffing firm Manpower confirmed ransomware criminals broke into its Lansing, Michigan franchise’s network and stole personal information belonging to 144,189 people, months after the extortionists claimed that they pilfered “all of [the company’s] confidential data.” 

Back in January, notorious extortion crew RansomHub listed Manpower on its data leak site and claimed to have swiped 500GB of data before posting screenshots of the allegedly stolen files. These images included people’s social security cards, driver’s licenses, and passports, a lawsuit filed against Manpower, corporate bank statements, spreadsheets detailing employees’ hours and worksites, and customer lists.

“Unfortunately, all of your confidential data is on our servers,” the miscreants crowed, adding that they stole financial statements, HR data analytics, passports, ID cards, names and addresses, confidential contracts, and non-disclosure agreements. 

“We are waiting for you to return in the chatroom,” the RansomHub affiliate added. “Otherwise, I believe your competitors would like it very much!!!!!”

WestJet confirms passport details stolen in cyber attack

WestJet has admitted that a cyberattack on its systems earlier this year resulted in the theft of personal details from some passengers, including information drawn from travel documents such as passports. Payment card details and user passwords, however, were not taken.

The airline said the compromised data differs from person to person but may include names, dates of birth, contact information, gender, and recent booking records, including reservation numbers. Details from government-issued identification used for travel were also among the data taken.

In correspondence to those affected, WestJet warned that the stolen information could be used for identity theft or fraud, and said it would provide two years of free identity monitoring. The intrusion was detected on June 13, when the airline found that criminals had temporarily accessed some systems. The Office of the Privacy Commissioner of Canada has opened an inquiry.

Workday Data Breach Exposes HR Records via Third-Party CRM Hack

Enterprise software giant Workday has disclosed a security incident involving unauthorized access to employee information through a compromised third-party customer relationship management (CRM) platform.

The breach, discovered as part of a broader social engineering campaign targeting multiple large organizations, has raised concerns about supply chain security risks in the enterprise software sector.

Incident Details and Scope

According to Workday’s official statement, threat actors successfully infiltrated the company’s third-party CRM system following a sophisticated social engineering campaign.

The attackers contacted employees through text messages and phone calls, impersonating human resources and IT personnel to trick staff into surrendering account credentials and personal information.

The compromised data primarily consisted of standard business contact information, including employee names, email addresses, and phone numbers.

Workday emphasized that customer tenant data remained secure, with no evidence suggesting unauthorized access to client information or the core Workday platform infrastructure.

“There is no indication of access to customer tenants or the data within them,” the company stated, highlighting the limited scope of the security incident.

This distinction is crucial for Workday’s extensive client base, which includes numerous Fortune 500 companies relying on the platform for critical HR and financial operations.

Workday moved swiftly to contain the breach upon discovery, immediately terminating the attackers’ access to the compromised CRM system.

The company has implemented additional security safeguards designed to prevent similar incidents in the future, though specific details about these enhanced measures were not disclosed.

The incident underscores the persistent threat of social engineering attacks, which have become increasingly sophisticated in targeting enterprise environments.

Cybersecurity experts note that attackers often leverage stolen contact information to enhance the credibility of subsequent phishing campaigns and social engineering attempts.

This breach highlights the inherent risks associated with third-party integrations in enterprise environments.

Columbia University Confirms Data Breach Affecting Nearly 870,000 Individuals

Columbia University disclosed a significant cybersecurity incident that compromised personal information of 868,969 individuals nationwide, including 2,026 Maine residents, marking one of the largest higher education data breaches in recent years.

The breach notification, filed through outside counsel Debevoise & Plimpton LLP, reveals that hackers gained unauthorized access to the university’s external systems between May 16 and June 6, 2025.

The prestigious Ivy League institution discovered the security incident on July 8, 2025, nearly two months after the breach period concluded.

The university has classified this as an “external system breach (hacking),” indicating that cybercriminals successfully penetrated Columbia’s network infrastructure from outside the organization.

The compromised data included names and other personal identifiers, though specific details about additional sensitive information have not been fully disclosed in the initial notification.

1.1M Impacted by Farmers Insurance Data Breach, Security Leaders Discuss

Farmers Insurance has revealed it experienced a data breach that may be connected to the ongoing Salesforce social engineering campaign. According to a security incident notice sent out by the organization, a third-party vendor experienced a cyber incident that compromised a database of the insurance company’s customers. Affected data includes: 

• Names 
• Addresses 
• Birth dates
• Driver’s license numbers
• Last four digits of Social Security Numbers 

Approximately 1.1 million customers are impacted by this breach. Below, security leaders share their insights. 

French Retailer Auchan Cyberattack  – Thousands of Customers Personal Data Exposed

Major French retail chain Auchan announced on August 21, 2025, that it suffered a significant cybersecurity incident resulting in the unauthorized access and theft of personal data from “several hundred thousand” customer loyalty accounts. 

The breach represents another critical example of retail sector vulnerabilities to Advanced Persistent Threats (APTs) targeting customer databases containing Personally Identifiable Information (PII).

Key Takeaways

1. Auchan confirmed a cyberattack exposing customer data.

2. Database attack stopped by segmentation.

3. Customers notified, CNIL alerted, phishing warning issued.

Customer Personal Data Compromised

Le Monde reports that the cyberattack compromised multiple data fields within Auchan’s customer relationship management system, including first and last names, email addresses, postal addresses, telephone numbers, and loyalty card numbers. 

Security analysts note that this data profile suggests attackers gained access to the retailer’s Customer Loyalty Management (CLM) database, likely through SQL injection vulnerabilities or privileged account compromise.

Notably, Auchan confirmed that financial data, authentication credentials (passwords), loyalty card PIN codes, and customer reward balances remained secure, indicating the breach was contained to specific database tables rather than achieving full system compromise. 

This suggests the implementation of a defense-in-depth architecture with data segmentation protocols that prevent lateral movement to more sensitive systems.

Ransomware attack on DaVita exposes data from 2.7M

• Data from 2.7 million people were exposed after a ransomware attack on kidney care provider DaVita this spring, according to a report to federal regulators.
• DaVita determined in April that an unauthorized user had gained access to its servers. Later that month, the attacker posted leaked data it claimed to have stolen from DaVita. The kidney care provider was able to obtain that information in June, which included sensitive personal information from its dialysis labs database. 
• The data breach is one of the largest healthcare incidents reported to the HHS’ Office for Civil Rights this year, following breaches at Yale New Haven Health, UnitedHealth-owned healthcare services firm Episource and Blue Shield of California. 

Bragg Confirms Cyberattack, Internal IT Systems Breached

Bragg Gaming Group (NASDAQ: BRAG, TSX: BRAG), a prominent content and technology provider in the online gaming industry, has disclosed a cybersecurity incident that compromised its internal computer systems over the weekend.

The company discovered the breach on August 16, 2025, and has immediately implemented containment measures while engaging independent cybersecurity experts to assist with the investigation.

Initial Assessment Shows Limited Scope

According to the company’s preliminary investigation, the cyberattack appears to be contained within Bragg’s internal computer environment. 

Crucially, there is currently no indication that any personal information has been compromised, which represents a significant relief for the gaming operator’s customers and partners.

The company emphasized that despite the security breach, its operations remain fully functional and unaffected.

Bragg’s response demonstrates adherence to industry best practices for incident response, with the immediate retention of additional independent cybersecurity experts to conduct a thorough investigation.

Telecom company Colt hit by cyber attack

Telecom company Colt Technology Services has been dealing with a cyber incident since August 12 that has taken important customer systems offline. The company is working around the clock to restore the affected infrastructure.

The disruption mainly affects customers who depend on number hosting and porting activities via the Voice API platform. Several other customer systems, including Colt Online, are also temporarily unavailable. Customers who use the Colt Online portal can only contact the company by email or phone for the time being. The company warns that response times may be longer than usual.

Colt Technology Services confirmed that it has detected a cyber incident on an internal system. The company emphasizes that this system is separate from its customer infrastructure. “We detected the cyber incident on an internal system. This system is separate from our customer infrastructure,” the company said in a status update.

As a precautionary measure, several systems were proactively taken offline, which led to the disruption of customer support services.

At Least 14,485 Individuals Known to be Affected by Oracle Health/Cerner Data Breach

The number of individuals affected by a data breach at Oracle Health (formerly Cerner Corporation) is becoming clearer. While the total number of affected individuals has yet to be disclosed, based on the breach notifications issued to state attorneys general, more than 14,480 individuals have been confirmed as affected, although the actual total is undoubtedly considerably larger.

While several states publish their breach notification letters, only a few disclose the number of affected individuals, such as Massachusetts, South Carolina, Texas, and Washington.  In addition to those states, California has published a breach notice from Oracle Health, but California has not stated how many individuals were affected.