Massive Data Exposure Wave Hits Transport, Crypto, and Government Sectors

Summary

Today's threat landscape is defined by a high-volume, multi-sector data exposure event, with over 80 critical incidents reported. The pattern is not a single sophisticated attack, but a broad, opportunistic wave targeting everything from national railways and major retailers to cryptocurrency exchanges and municipal governments. Defenders should be alert to the sheer noise level, which can obscure targeted operations, and the increasing frequency of data being offered for sale on dark web forums, indicating a mature and active criminal marketplace.

Today's developments

The volume of alleged data breaches and leaks today is significant, with several high-profile claims demanding immediate attention. A threat actor claims to have breached Amtrak, the U.S. national railway operator, while another alleges a breach of GameStop involving 56 million records. In the financial technology sector, a breach of Mercado Bitcoin in Brazil is alleged to involve 820,000 records, and a separate actor claims to have compromised the cryptocurrency exchange ExWallets. The identity and access management giant Okta is also named in an alleged breach of 3.3 million records.

• A threat actor claims to have breached Amtrak (United States / Transportation).
• An alleged breach of GameStop (United States / Retail) is reported with 56 million records.
• Mercado Bitcoin (Brazil / Financial Services) is allegedly compromised with 820,000 records.
• The cryptocurrency exchange ExWallets is allegedly leaked.
• Okta, Inc. (United States / Technology) is named in an alleged breach of 3.3 million records.

Government and public sector entities are heavily targeted. In Europe, actors claim breaches of French municipal police data and a judicial database in Mexico. In Latin America, an actor claims to have breached the SAMARITAN API, allegedly containing citizen data from Uruguay, Argentina, Peru, and Chile. A separate incident involves a claimed breach of the Brazilian government's RAIS database. In Asia, multiple Indonesian government and education institutions are allegedly compromised, including the Pemerintah Kota Kediri and SMAN 1 Margahayu.

• A threat actor claims to have breached the SAMARITAN API, allegedly impacting Uruguay, Argentina, Peru, and Chile.
• The Brazilian government's RAIS database is allegedly breached.
• Multiple Indonesian government and education entities, including Pemerintah Kota Kediri, are claimed as victims.
• French municipal police data and a Mexican judicial database are also allegedly compromised.

The healthcare sector is not spared, with claims against Outro Health (United States / Mental Health Care) and Akbar Niazi Teaching Hospital (Pakistan). A threat actor also alleges a breach of the Thai Medical Women's Association. Industry reporting today highlights a broader context of evolving threats. Researchers at Google Threat Intelligence published a deep analysis of the pro-Russia influence ecosystem, noting its pivot from a near-singular focus on Ukraine back to global strategic objectives, including targeting the U.S. and Europe. Separately, Microsoft reported on a malicious Chrome extension that posed as the AI search engine Perplexity to redirect browser searches, demonstrating the continued use of AI branding for social engineering.

• Alleged breaches in healthcare include Outro Health (U.S.) and Akbar Niazi Teaching Hospital (Pakistan).
• Google Threat Intelligence analysis details the evolution of the pro-Russia influence ecosystem and its global targeting.
• Microsoft warns of a malicious Chrome extension spoofing the AI search engine Perplexity to hijack browser searches.

Threat landscape signals

Today's data reveals a highly active and dispersed threat landscape. The top actor by event count, BABAYO EROR SYSTEM, is responsible for 26 events, primarily focused on defacement and initial access, suggesting a low-sophistication, high-volume operation. In contrast, actors like FreeCity (Amtrak) and dumper (GameStop) are making singular, high-impact breach claims. This bifurcation between noisy, low-impact activity and targeted, high-value breaches is a key signal for defenders.

Geographically, the United States remains the top victim country with 35 events, followed by India (23) and Iran (21). The concentration of breaches in the U.S. and Brazil (with multiple government and financial sector hits) suggests these are priority targets for financially motivated actors. The significant number of events targeting Indonesian government and education systems (12 events) points to a regional campaign by actors like DigitalStormSec and KNOK666X. The sale of databases on dark web forums, such as the alleged sale of U.S. personal information and UAE KYC documents, confirms a mature data brokerage market that fuels further fraud and targeted attacks.