SecureFact – Cyber Security News – Week of April 14, 2025

The Laboratory Services Cooperative (LSC), a Seattle-based nonprofit, suffered a data breach affecting approximately 1.6 million individuals.
The stolen data includes personal identifiers (e.g., full names, Social Security numbers, and government IDs), medical information (e.g., diagnoses and lab results), insurance details, and financial data (e.g., billing and payment card information).
The breach occurred in October 2024, with LSC promptly engaging cybersecurity specialists and notifying federal law enforcement.
To mitigate the impact, LSC is offering free credit monitoring and medical identity protection services for up to 24 months. Additionally, external experts are monitoring the dark web for potential leaks, though no exposure has been reported so far.

Western Sydney University (WSU) has disclosed multiple cybersecurity breaches over the past two years, with the most recent incidents affecting thousands of students and staff.
Between January and February 2025, a compromised single sign-on (SSO) system exposed demographic, enrollment, and academic progression data of approximately 10,000 individuals.
Additionally, personal information was leaked on the dark web in November 2024, though WSU became aware of it only in March 2025. Earlier breaches in 2023 impacted 7,500 individuals, exposing sensitive data like health records and government IDs.
In response, WSU has apologized publicly, launched investigations, and implemented measures to strengthen its digital security environment.

A significant data breach on X (formerly Twitter) exposed over 200 million user records, including names, email addresses, and profile data. The leaked data, stemming from breaches in January 2025 and 2023, poses a risk of phishing and social engineering attacks.
The 34 GB CSV file contains 201,186,753 entries with information such as X screen names, user IDs, full names, locations, email addresses (from the 2023 breach), follower counts, time zones and profile images.
While X has not officially acknowledged this specific breach, users are advised to use strong antivirus software, change their X password, enable two-factor authentication, and monitor for potential identity theft.
The breach traces back to a vulnerability identified in January 2022, highlighting ongoing security challenges for the platform.

A recent report revealed that spammers exploited OpenAI’s GPT model to generate and distribute over 80,000 spam messages, many of which successfully bypassed traditional email filters.
The incident highlights how generative AI can be misused to craft highly convincing and human-like spam, making it harder for detection systems to flag malicious content.
The spam messages were part of a large-scale campaign designed to promote scams and phishing links. In response, OpenAI collaborated with security researchers to trace the abuse and refine its abuse detection systems to prevent similar misuse in the future. This case underscores the emerging security challenges posed by AI-powered tools in the hands of cybercriminals.

Oracle has confirmed a security breach involving two obsolete servers that were compromised and used to steal credentials.
The breach was identified during an internal investigation, and Oracle emphasized that its Oracle Cloud Infrastructure (OCI) and customer systems were not affected.
While the company did not specify the total volume of data compromised, the stolen credentials posed a potential risk for unauthorized access to related services.
Once the breach was detected, Oracle swiftly decommissioned the compromised servers, reset impacted credentials, and enhanced its security monitoring to prevent similar incidents. The company also notified customers and is cooperating with authorities as part of the ongoing investigation

Berkshire Hathaway’s private jet subsidiary, NetJets, has confirmed a data breach after hackers gained unauthorized access to its systems and stole sensitive client information.
The breach exposed data belonging to high-net-worth individuals, including names, contact details, and flight itineraries — raising concerns over both privacy and personal security.
While the exact volume of affected data hasn’t been disclosed, the incident highlights the risks associated with handling exclusive client information in the luxury aviation sector. Following the breach, NetJets launched an investigation, engaged cybersecurity experts, and notified law enforcement agencies. The company also implemented additional security measures to secure its systems and is in the process of notifying impacted clients.

WK Kellogg Co, a US food giant, experienced a data breach in December 2024 linked to the Clop ransomware gang’s exploitation of Cleo file transfer software vulnerabilities.
The breach, discovered on February 27, 2025, involved unauthorized access to servers used for transferring employee files to human resources vendors. Exposed data includes individuals’ names and Social Security numbers.
WK Kellogg is offering affected individuals one year of free identity monitoring and fraud protection services through Kroll. The company is working with Cleo to implement security measures to prevent similar incidents. WK Kellogg is among many companies affected by Clop’s attacks on Cleo zero-day vulnerabilities.