Major Data Breaches and Leaks

• TransUnion (Salesforce Data Theft) – Credit bureau TransUnion disclosed a breach affecting 4.4 million U.S. individuals, exposing names, dates of birth, and Social Security numbers via a third-party support platform. The incident, tied to a wave of Salesforce-related data theft by the ShinyHunters extortion group, did not compromise credit reports or core databases. Impacted customers were offered 24 months of free credit monitoring.

• Zscaler (Customer Support Data Breach) – Cloud security firm Zscaler warned that attackers gained access to its Salesforce instance via stolen OAuth tokens from a breached chatbot integration, stealing customer contact information and support case content. Exposed data includes customer names, business emails, phone numbers, job titles, and support case details. Zscaler revoked the vulnerable integration, rotated tokens, and urged customers to beware of phishing attempts using the stolen info.

• Healthcare Services Group (Delayed Disclosure) – U.S. contractor Healthcare Services Group began notifying 624,000 individuals of a previously unreported data breach. Hackers had accessed its systems in late 2024 and copied files containing personal information (names, Social Security numbers, driver’s license and state IDs, financial account details, etc.). The incident – only now made public through state filings – prompted the company to offer 12 months of credit monitoring, though no evidence of fraud has surfaced to date.

Significant Cyberattacks and Incidents

• Nevada State Cyberattack – A “network incident” on Sunday disrupted multiple Nevada state government systems, forcing closure of state offices on Monday and Tuesday. State websites and phone lines went offline, though emergency services remained unaffected and no indication of personal data compromise has been found. A criminal investigation is underway, with officials working with federal partners to restore services. (Long outages of this nature are often ransomware-related, though no group has claimed responsibility.)

• “Fake NDA” Phishing Malware – Security researchers exposed a sophisticated phishing campaign targeting U.S. manufacturing and tech firms via their own websites. Posing as potential clients, attackers engaged companies through Contact Us forms over weeks and eventually sent malware-laced files disguised as NDAs (non-disclosure agreements). The malicious “contract” (hosted on a legitimate cloud platform) contained a custom backdoor called MixShell. The long-con approach – using established domains and extended conversation – made the ruse more credible, and several industrial sectors (machinery, semiconductors, biotech, aerospace, etc.) were targeted in this social engineering scheme.

• Additional Notables – No major new ransomware catastrophes were reported this week, but threat activity remained high. For instance, Spanish police arrested a student for hacking a school’s system to change grades, illustrating how even minor actors can misuse cyber means. Meanwhile, security teams at tech companies like Amazon and Cloudflare quietly thwarted several attempted intrusions (see below), underscoring the ongoing, if less public, battle against cyber threats.

Critical Vulnerabilities and Patches

• Citrix NetScaler (CVE-2025-7775) – A critical remote code execution flaw in Citrix NetScaler ADC and Gateway appliances (CVE-2025-7775) was disclosed and patched after active exploitation as a zero-day. Over 28,000 internet-facing Citrix instances were found vulnerable worldwide, with ~10k in the U.S. alone. Citrix and CISA urged immediate firmware updates, as no workarounds exist and attackers have been exploiting unpatched systems.

• FreePBX VoIP Zero-Day – The Sangoma FreePBX team warned of an actively exploited zero-day in the FreePBX phone system’s admin interface (ACP) exposed to the internet. Since August 21, hackers used this unknown vulnerability to breach VoIP servers, with reports of thousands of SIP extensions and trunks compromised on some systems. An emergency module patch (EDGE update) was released and a full security update followed within 36 hours. Admins were urged to restrict ACP access and check for indicators like rogue scripts or modified configs. Affected organizations have been restoring from backups and rotating credentials.

• WhatsApp/Apple Zero-Click – WhatsApp released emergency patches for a zero-click vulnerability (CVE-2025-55177) in its iOS and macOS clients that was exploited in targeted attacks. The flaw allowed an attacker to trigger malicious code execution via a specially crafted message, potentially linked with an underlying Apple iOS vulnerability (CVE-2025-43300) in a sophisticated spyware campaign. WhatsApp alerted select users about the threat and advised them to factory-reset devices after patching. (Apple had issued fixes for the related iOS/macOS Image I/O bug earlier in August, noting it was used in an “extremely sophisticated” attack.)

• Other Patches – No Microsoft Patch Tuesday during this week, but users should note recent fixes for WinRAR (CVE-2025-8088, patched after exploits in phishing attacks) and Android (Qualcomm chip flaws under active attack). Organizations are reminded to apply August’s security updates from Microsoft, Adobe, VMware, and others addressing critical vulnerabilities disclosed earlier in the month.

Government and Industry Cyber Responses

• Global Advisory on Chinese Hacking – In an unprecedented joint action, the U.S. and 12 allied governments (Five Eyes plus several EU and Asian partners) issued a joint cybersecurity advisory warning of ongoing Chinese state-sponsored hacking campaigns. The advisory – released Aug. 27 – details tactics used by China-linked group “Salt Typhoon” to penetrate telecom providers, ISP backbones, and other critical infrastructure in 80+ countries. It urges network defenders worldwide to hunt for indicators of compromise and implement recommended mitigations. Officials emphasized how vast and indiscriminate the campaign has been, calling out multiple Chinese tech companies allegedly enabling the attacks.

• Amazon Thwarts APT29 (Midnight Blizzard) – Amazon’s Threat Intelligence team announced it disrupted an active operation by Midnight Blizzard (aka APT29, linked to Russia’s SVR) that targeted Microsoft 365 users. The hackers had compromised legitimate websites (watering holes) and were redirecting a portion of visitors to fake Cloudflare authentication pages to hijack account access tokens. Amazon analysts identified the malicious domains and worked to take down or block the infrastructure, effectively foiling the credential-stealing campaign. The incident highlights how cloud providers and tech firms are directly engaging adversaries to protect users.

• Tokyo Summit on North Korean IT Workers – On Aug. 26, officials from the U.S, Japan, and South Korea convened a multilateral forum in Tokyo with over 130 attendees from tech and finance companies. The focus: countering North Korea’s illicit scheme of placing covert IT contractors in global companies to earn revenue for Pyongyang’s missile programs. Participants – including freelance gig platforms, payment processors, crypto exchanges, and AI firms – shared intel and best practices for spotting fake freelancer identities and preventing hire of North Korean operatives. The meeting is part of a broader effort (including U.S. sanctions and arrests) to shut down this lucrative funding channel for the DPRK regime.

• Other Developments – Germany this week charged a suspect in the 2022 cyberattack on a Rosneft oil subsidiary, reflecting continued legal pursuit of past breaches. Meanwhile, a major U.S. license plate recognition firm suspended its federal contracts after privacy backlash (highlighting the growing tension between surveillance tech and public trust). And the U.S. Treasury’s new cybersecurity attaché program saw additional staff deployments in Europe, aiming to improve international coordination against ransomware groups. (These underscore a trend of governments using diplomacy, law enforcement, and policy levers in tandem to combat cyber threats.)

Miscellaneous

• Cloud Ransomware “No-Encryption” Tactics – Microsoft threat intelligence reported a notable shift in ransomware tactics: an actor tracked as Storm-0501 now skips traditional file encryption and instead focuses on cloud-native extortion. In recent attacks on a large enterprise, Storm-0501 rapidly exfiltrated data from cloud storage, wiped backups and destroyed cloud resources, then demanded ransom – effectively locking the victim out of their own cloud environment. Microsoft noted that the group (a former affiliate of various ransomware-as-a-service crews) leveraged stolen admin credentials to create backdoors in Azure AD/Entra ID, enabling mass deletion of data stores. Although some protections prevented complete data loss, this “cloud-only” ransom technique represents a dangerous evolution, as it can cripple organizations without deploying malware on endpoints.

• Cybersecurity Trends and Reports – Several new industry reports were released, shedding light on evolving threats. CrowdStrike’s mid-year threat hunting report pointed to increased use of generative AI by cybercriminals (both as a weapon for phishing/deepfakes and a target for abuse), as well as a surge in cloud attack paths. A report from Check Point highlighted how hack-for-hire groups are blending espionage and financial crime, and Cybersecurity Ventures forecasted global cybercrime costs to reach $10.5 trillion annually by 2025 – a reminder of the enormous scale of the challenge. Finally, the annual International Cybersecurity Conference took place virtually, focusing on supply-chain security and zero-trust architecture, with experts stressing that basic cyber hygiene (patching, backups, least privilege) remains as critical as the fancy new tools.

Conclusion

• Third-Party Risk is Real: This week’s breaches underscore the need for organizations to vet and monitor the security of vendors and cloud apps. Attacks on SaaS platforms and supply-chain partners can expose millions of customer records – a reminder that your security is only as strong as the weakest link.

• Patch Urgently, Patch Often: The emergence of multiple zero-day exploits (Citrix ADC, FreePBX, WhatsApp) shows how quickly attackers weaponize new vulnerabilities. Applying patches and firmware updates promptly – especially for internet-facing systems – is essential to thwarting opportunistic attacks. Organizations should also monitor threat advisories (e.g. CISA alerts) for any sign that a critical flaw is being actively exploited in the wild.

• Prepare for Disruption: From Nevada’s government outage to Storm-0501’s cloud rampage, cyber incidents can halt operations without warning. Every enterprise and agency should have robust incident response and business continuity plans. Regular backups (stored offline), simulated drills, and clear communication strategies can make the difference between a quick recovery and days of downtime when a breach or ransomware hits.

• Collaborate and Share Intelligence: This week illustrated the value of public-private cooperation – whether it’s Amazon takedowns of nation-state infrastructure or 13 countries joining forces to expose Chinese hacking. Information sharing across borders and industries can raise collective defenses. Security leaders should participate in threat intel exchanges, ISACs, and joint exercises to stay ahead of adversaries who themselves often operate as coordinated networks.

• Stay Vigilant Against New Tactics: Threat actors are constantly adapting – using novel lures (like fake NDAs), abusing cloud trust relationships, and seeking ways around traditional defenses. This means security awareness training for staff is as crucial as ever (to spot social engineering), and adopting a zero-trust mindset (never assume internal traffic or accounts are benign) is wise. As attackers innovate, so must defenders: keeping an eye on trends (AI misuse, supply-chain exploits, etc.) will help organizations prioritize the next set of risks on the horizon.

Sources

• BleepingComputer (Bill Toulas, Lawrence Abrams, Sergiu Gatlan – cybersecurity news articles, Aug 2025)
• SecurityWeek (Ionut Arghire – breach and incident reports, Aug 2025)* Cybersecurity Dive (Eric Geller – policy and threat intelligence coverage, Aug 2025)
• The Record – Recorded Future News (Jonathan Greig, Daryna Antoniuk – cybercrime briefs, Aug 2025)
• CrowdStrike Blog (Threat research updates, Aug 2025)
• Official Security Advisories (WhatsApp Security Advisory, CISA Alert on Citrix CVE-2025-7775)
• Check Point Research Report (Aug 2025)