2025 has produced a steady stream of major cyber incidents across household name organisations. In most cases the root cause was not a cutting edge attack but familiar issues like weak identity controls third party access and basic misconfiguration. Below is a snapshot of some of the most significant breaches this year and the patterns they continue to expose.
Google Apple Facebook
16 billion credentials
Credential dump compiled from malware infostealers and historic breaches exposing mass password reuse across major consumer platforms
SK Telecom
27 million users
Advanced malware enabled long term access to SIM and subscriber authentication data
Red Hat
570GB across 28000 repositories
Internal GitLab data including API keys credentials and customer infrastructure details exfiltrated
Qantas
5.7 million records
Third party Salesforce integration exploited to steal customer personal data
Allianz Life
2.8 million records
Social engineering led to abuse of CRM admin functions and mass PII extraction
TransUnion
4.4 million records
Misconfigured Salesforce APIs exposed highly sensitive credit and identity data
Farmers Insurance
1.1 million records
Overprivileged third party access enabled large scale customer data exfiltration
Yale New Haven Health
5.5 million records
Third party file transfer vulnerability exposed protected health information
Blue Shield of California
4.7 million records
Google Analytics misconfiguration leaked customer data without a direct breach
Marks and Spencer
300 million pounds lost
Ransomware attack crippled operations following third party social engineering
Most of these incidents did not begin with sophisticated hacking techniques. Instead, they stemmed from reused passwords, excessive access, weak third party controls, or simple misconfigurations.
The common thread is identity and trust not technology. As organisations add more tools platforms and partners the attack surface quietly expands. Security failures are rarely one big mistake but the result of many small gaps lining up at the same time. The basics still matter and they are still being missed.