Massive Data Breaches Expose Billions, as Critical Zero-Days in Apple and Google Products See Active Exploitation
Summary
This cybersecurity brief for December 15, 2025, covers a series of high-impact incidents. A colossal 16TB unsecured MongoDB database exposed 4.3 billion professional records, creating a massive risk for social engineering. Concurrently, a data breach at fintech firm 700Credit impacted 5.6 million individuals, exposing sensitive PII including Social Security numbers. Tech giants Apple and Google are racing to patch actively exploited zero-day vulnerabilities, with CISA adding one to its KEV catalog. Other critical threats include a newly discovered ransomware group named 'Gentlemen', an actively exploited flaw in Sierra Wireless routers affecting critical infrastructure, and a CVSS 10.0 vulnerability in an Apache Tika dependency impacting numerous Atlassian products.
Today New Articles
700Credit Data Breach Exposes PII of 5.6 Million Individuals
The U.S. fintech company 700Credit, a major provider of credit reports and data services to the automotive industry, has disclosed a data breach affecting at least 5.6 million individuals. The incident, which occurred in October 2025, resulted in an unauthoriz...
New 'Gentlemen' Ransomware Group Deploys Advanced GPO and BYOVD Attacks
A new ransomware operation, identifying itself as the "Gentlemen" group, has been observed conducting double-extortion attacks against corporate networks. The group employs sophisticated techniques to achieve its objectives, including the manipulation of Group...
CVSS 10.0: Atlassian Patches Critical RCE Flaw in Apache Tika Dependency
Atlassian has issued security updates for a critical vulnerability, CVE-2025-66516, in the Apache Tika parser library, a third-party dependency used in many of its products. The flaw, which carries a perfect CVSS score of 10.0, is an XML External Entity (XXE)...
xHunt Espionage Group Returns, Targeting Kuwait with New PowerShell Backdoors
The cyber-espionage threat actor known as xHunt has resumed operations with a new campaign targeting organizations in Kuwait. Active since at least 2018, the group is focusing its latest attacks on the shipping, transportation, and government sectors. Research...
New '01flip' Ransomware, Written in Rust, Targets Critical Infrastructure in APAC
A new and stealthy cross-platform ransomware strain named "01flip" has been discovered targeting critical infrastructure organizations in the Asia-Pacific region. The malware is written in the Rust programming language, enabling it to be compiled for both Wind...
LastPass Fined £1.2M by UK Regulator Over 2022 Security Failures
The UK's Information Commissioner's Office (ICO) has fined password manager provider LastPass £1.2 million (approximately $1.6 million) for significant security failures that led to a major data breach in 2022. The regulator found that LastPass failed to imple...
India Confirms GPS Spoofing Attacks Targeted Seven Major Airports
The Indian government has officially confirmed that a series of cyber incidents involving GPS spoofing have occurred at seven of the nation's major airports. The attacks, which targeted airports in Delhi, Mumbai, Kolkata, and Bengaluru among others, disrupted...