Hacks, thefts and disruption: The worst data breaches of 2025

Every year, TechCrunch takes a look at the cybersecurity horror shows of the past 12 months — from the biggest data breaches to hacks that led to weeks of disruption — to see what we can learn. This year, data breaches were like nothing we’d seen before.

Here’s a look at some of the biggest security incidents of 2025, starting with:

The US government has remained one of the biggest targets in cyberspace. The year began with a bold cyberattack by Chinese hackers on the US Treasury Department, followed by the hacking of several federal agencies, including The agency responsible for protecting US nuclear weaponsThanks to a vulnerability in SharePoint.

And all the while, Russian hackers were stealing Sealed records from the US court filing systemWhich set off alarm bells across the federal judiciary.

But nothing quite comes close to DOGE hacking into what became federal government departments and databases The largest raid on US government data in its history.

The Trump administration’s Department of Government Efficiency, or DOGE as it was widely known, was led by Elon Musk and his band of private sector henchmen. Violated federal protocols and It challenged common security practices. they Looting federal databases for citizens’ dataDespite the warnings National security risks And conflicts of interest regarding Musk’s business dealings abroad. Legal experts say DOGE employees are “personally liable” under US hacking laws, though a court would also have to agree.

Musk’s subsequent public spat with President Trump led to the billionaire’s departure from DOGE, leaving employees fearing… They may face federal charges Without protecting him.

In late September, he met with senior executives from giant American companies I started receiving threatening emails From the prolific ransomware and extortion group called Clop. The emails included an attached copy of their personal information – and a multi-million dollar ransom demand not to publish it.

Months ago, the Clop gang quietly exploited a never-before-seen vulnerability in Oracle’s e-business software, a suite of applications used to host a company’s core business information, such as financial and human resources records, supply chain data, and customer databases. The vulnerability allowed Clop to steal large amounts of sensitive employee data, including that of executives Dozens of organizations Which depends on Oracle programs.

Oracle had no idea until it was discovered in October that it was what it was Scrambling to patch the vulnerability. However, it is too late: hackers have already stolen large amounts of data from… Universities, Hospitals and health systems, Media organizationsAnd more.

This was Klopp’s latest mass hacking campaign. The group had previously exploited flaws in enterprise file transfer services, e.g Go anywhere, MOVEitand Cleo programsWhich technology giants use to share large amounts of information online.

Salesforce customers faced a difficult year after two separate data breaches at downstream technology companies allowed hackers to steal a billion records of customer data stored in the Salesforce cloud.

The hackers targeted at least two companies, Cellloft and stupidityBoth allow their customers to process and analyze the data they store in Salesforce.

By hacking into these companies directly, the hackers were able to access all of the data through their customers’ connections to Salesforce. Some of the biggest tech giants had their data stolen in the breach, including Bugcrowd, Cloudflare, Google, Proofpoint, Docusign, GitLab, Linkedin, SonicWall, and Verizon.

A hacking group known as Scattered Lapsus$ Hunters, made up of members from various hacking groups, including ShinyHunters, published a report Data leak site announces stolen records In exchange for a ransom paid by the victims. And new victims keep coming.

Hackers tore apart the UK retail sector earlier this year, stealing data from it Marks & Spencer And at least 6.5 million customer records from Tawuniya. Successive hacks led to service outages and disruption across retailer networks, and some grocery shelves became empty as systems used to support retailers were disabled. Harrods luxury department store It was also later hacked.

But the major cyber attack targeting Jaguar Land Rover, one of the country’s largest employers, has left its mark on the UK economy. September Hacking and data breach I saw the JLR car factory Production stopped for several months The company worked to restore its systems and operate them.

The fallout has affected Jaguar Land Rover suppliers across the UK, with some going out of business altogether. The UK government is over Securing a £1.5 billion bailout To ensure that Jaguar Land Rover employees and suppliers receive their salaries during the closure period.

British security experts said The hack was the most economically damaging cyberattack to hit the UK in history, showing that disruption may be more valuable to financially motivated hackers than stolen data.

South Korea has seen a major data breach every month this year, and the personal data of millions of its citizens has been put at risk thanks to security vulnerabilities and poor data practices at the country’s largest technology and phone providers.

The largest telephone company in the country, SK Telecom was hacked and 23 million customers were registered exposed; Several cyber attacks were attributed to its hostile neighbor, North Korea. And a Massive fire in the data center Erase years of Korean government data that has not been backed up.

But the icing on the data breach cake was the theft of the personal information of about 33 million customers over a period of months from Coupang, the country’s retail giant that some call the Amazon of Asia. the The data theft began in Junebut it was not discovered until November, and eventually led to CEO of the company Resignation.