{"id":10332,"date":"2025-12-01T17:19:08","date_gmt":"2025-12-01T14:19:08","guid":{"rendered":"https:\/\/cyberone.bg\/?p=10332"},"modified":"2025-12-01T17:19:08","modified_gmt":"2025-12-01T14:19:08","slug":"weekly-cybersecurity-report-week-48-2025","status":"publish","type":"post","link":"https:\/\/cyberone.bg\/en\/weekly-cybersecurity-report-week-48-2025","title":{"rendered":"Weekly Cybersecurity Report | Week 48, 2025"},"content":{"rendered":"

As your dedicated cybersecurity services provider,\u00a0CyberOne<\/a><\/strong>\u00a0equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.<\/p>\n

Weekly Cybersecurity Report | Week 48, 2025<\/h2>\n

Information security updates and events from the past we<\/u><\/strong>ek<\/u><\/strong><\/p>\n

1. Macy\u2019s \u2013 Cl0p Oracle E Business Suite Campaign<\/strong><\/a><\/h3>\n

Macy\u2019s disclosed a breach after attackers exploited a zero day in Oracle E Business Suite as part of a wider Cl0p ransomware\/data theft campaign targeting that platform.
\nPotentially exposed information spans customer records and transaction histories, POS and supply chain documentation, HR and payroll data, internal financials, and configuration details that could aid further compromise.<\/p>\n

2. SitusAMC \u2013 Financial Technology Vendor Breach<\/strong><\/a><\/h3>\n

SitusAMC, a major technology provider to commercial and real estate financiers, confirmed a November 12 breach that came to wider attention in this period.
\nWhile the exact dataset is still under review, exposed information may include client corporate records (accounting and legal documents) and consumer PII such as names, addresses, and Social Security numbers.<\/p>\n

3. Healthcare Therapy Services \u2013 Healthcare PII Exfiltration<\/strong><\/a><\/h3>\n

US provider Healthcare Therapy Services reported that an intruder accessed and copied data from its network around late April 2025, with notice and legal analysis appearing this week.
\nCompromised records may contain full names, Social Security numbers, financial account data, driver\u2019s license numbers, and medical information, creating high risk for identity theft and insurance fraud.<\/p>\n

4. GlobalLogic \u2013 Employee Data Compromise<\/strong><\/a><\/h3>\n

Engineering and IT services company GlobalLogic confirmed unauthorized access to internal systems, with attackers obtaining files on current and former employees.
\nThe data likely includes names, addresses, Social Security numbers, dates of birth, employment details, and payroll related financial data, making this primarily an HR\/insider data breach rather than a customer facing incident.<\/p>\n

5. Cl0p Oracle 0 day Campaign \u2013 Broader Impact<\/strong><\/a><\/h3>\n

Threat intel reporting this month shows the same Oracle E Business Suite zero day used against Macy\u2019s also impacting organizations such as The Washington Post, Logitech, Allianz UK, and GlobalLogic, with others listed but not yet fully confirmed.
\nThe campaign underlines how a single ERP zero day can drive multi sector compromise, combining data theft and extortion rather than classic encrypt and lock ransomware.<\/p>\n

6. Rising Ransomware and Access Trends<\/strong><\/a><\/h3>\n

Insurance and threat intel analyses in late November highlight continued growth in ransomware, with Akira, Qilin and INC responsible for a large share of recent cases and leak site postings up quarter on quarter.
\nRoughly half of initial access in recent incidents is now traced to hijacked VPN credentials, with external service exploits (e.g., Oracle, Fortinet, SonicWall) accounting for another significant slice, emphasizing weaknesses in remote access and perimeter services.<\/p>\n

7. Salesforce \/ Cloud & Vendor Breach Patterns in November<\/strong><\/a><\/h3>\n

Industry roundups of November 2025 breaches emphasize sustained attacker focus on high value SaaS and vendor environments, including Oracle cloud services, analytics platforms like Mixpanel, and logistics\/food delivery ecosystems such as DoorDash.
\nThe pattern is consistent: misconfigurations or third party compromises expose large volumes of customer and transaction data, often without any need for on premise intrusion at the victim organization itself.<\/p>\n

The cybersecurity attacks highlighted in this report aren’t just incidents, they’re blueprints of the adversary’s arsenal. To protect your business you need the right partner. Cyberone is here to help! Check out our services<\/a>.<\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

As your dedicated cybersecurity services provider,\u00a0CyberOne\u00a0equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape. Weekly Cybersecurity Report | Week 48, 2025 Information security updates and events from the past week 1. Macy\u2019s \u2013 Cl0p Oracle E Business […]<\/p>\n","protected":false},"author":6,"featured_media":8615,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[65],"class_list":["post-10332","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-weekly-cyber-updates","tag-weekly-cybersecurity-report"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts\/10332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/comments?post=10332"}],"version-history":[{"count":1,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts\/10332\/revisions"}],"predecessor-version":[{"id":10333,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts\/10332\/revisions\/10333"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/media\/8615"}],"wp:attachment":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/media?parent=10332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/categories?post=10332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/tags?post=10332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}