Major Cybersecurity Trends and Incidents in 2025
The cybersecurity landscape in 2025 was marked by a series of high-impact incidents and evolving threat trends, with identity-driven intrusions, large-scale breaches, and record-breaking DDoS attacks dominating the year. Notable breaches at organizations such as Ingram Micro, Conduent, and Kettering Health resulted in hundreds of millions of dollars in losses, with regulatory filings and industry analyses highlighting the significant operational and financial impacts. Attackers increasingly exploited known vulnerabilities, with the CISA Known Exploited Vulnerabilities (KEV) catalog serving as a critical indicator of attacker intent, and legacy flaws resurfacing as major risk factors. The year also saw a strategic shift in security operations, with organizations prioritizing risk-based decision-making over exhaustive control coverage, and automation and real-time intelligence becoming essential for defense.
DDoS attacks reached unprecedented scales, with Cloudflare reporting attacks peaking at 31 Tbps and the emergence of massive botnets like Aisuru. These attacks were often used as smokescreens for deeper intrusions, and the growing sophistication and speed of DDoS campaigns rendered traditional scrubbing-center defenses increasingly obsolete. Geopolitical tensions further shaped the threat landscape, with critical infrastructure and sectors such as gaming and gambling frequently targeted. The industry’s response emphasized the need for adaptive, globally distributed mitigation strategies and highlighted the importance of governance, consent management, and just-in-time administration to separate resilient organizations from those more vulnerable to systemic risk.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Industry year-end assessments identify identity and known flaws as top 2025 risks
By the end of 2025, cybersecurity retrospectives concluded that identity had become the dominant attack vector and that long-known, heavily exploited vulnerabilities caused the most significant damage. Analysts also noted ransomware fragmentation, AI-assisted phishing, and a shift toward risk-based resilience over comprehensive prevention.
Record DDoS attacks peak at 31.4 Tbps during 2025
During 2025, DDoS activity reached unprecedented scale, with attacks reportedly peaking at 31.4 Tbps. Large botnets such as Aisuru, said to involve more than 4 million infected hosts, enabled increasingly powerful and sophisticated attacks.
Identity-led SaaS and MSP breaches drive major U.S. losses in 2025
Throughout 2025, several major U.S. breaches targeting SaaS, cloud, and managed service provider environments caused the year's largest direct financial losses. Public disclosures and regulatory filings tied the biggest impacts to incidents at Ingram Micro, Conduent, Kettering Health, and UnitedHealth/Change Healthcare.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
CyberSecurity 2025: TheCyberThrone YearEnd Consolidated Intelligence
thecyberthrone.in
Open sourceToken Factory: The 5 Costliest US Breaches of 2025
blog.alphahunt.io
Open sourceRecord-Breaking DDoS Attacks & the Security Landscape Heading Into 2026
securitysenses.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Major Cybersecurity Incidents and Threat Trends of 2025
The cybersecurity landscape in 2025 was marked by a series of high-profile breaches, advanced persistent threat (APT) campaigns, and evolving tactics by both cybercriminals and state-linked actors. Notable incidents included the PornHub data breach, where the ShinyHunters group exfiltrated and extorted sensitive user activity data, and the Knownsec leak, which exposed the espionage tools and global targeting strategies of a major Chinese cybersecurity firm. Supply-chain attacks continued to proliferate, with attackers compromising widely used software libraries and cloud services, impacting thousands of organizations and individuals. The year also saw a surge in sophisticated social engineering campaigns, such as ClickFix attacks, and a significant number of APT operations targeting government and military institutions, particularly in South and East Asia. Cloud service outages, such as the prolonged AWS disruption, highlighted the dependency of IoT and critical infrastructure on cloud reliability, causing widespread operational impacts. The threat actor ecosystem became more industrialized, leveraging AI, ransomware-as-a-service, and multi-stage attacks to increase scale and efficiency. Cryptocurrency platforms suffered major heists, and new vulnerabilities like MongoBleed were rapidly exploited in the wild. The cumulative effect of these incidents underscored the need for robust supply-chain security, improved cloud resilience, and enhanced detection and response capabilities against both opportunistic and targeted attacks.
Mar 21, 2026
Major Cyber Threat Trends and Shifts in 2025
Cybersecurity research throughout 2025 revealed significant changes in the threat landscape, with both SentinelLABS and KrakenLabs reporting a marked evolution in attacker tactics and the professionalization of cybercrime. Threat actors increasingly leveraged artificial intelligence to automate attacks, generate convincing social engineering content, and bypass security controls, making AI a practical tool for both sophisticated and commodity threats. The exploitation of legitimate infrastructure, such as free-tier publishing platforms and commercial AI APIs, became commonplace, while adversaries also began monitoring defender intelligence-sharing platforms to stay ahead of detection. The rise of crimeware-as-a-service (CaaS) further industrialized cybercrime, enabling a broader range of actors to access advanced capabilities and monetize initial access to corporate networks. Geopolitical tensions and the convergence of organized cybercrime with emerging technologies accelerated the pace and scale of attacks, with threat actors blending ideological motives with financially driven ransomware and extortion campaigns. Traditional carding fraud declined due to regulatory and law enforcement efforts, but attackers shifted focus to abusing trusted third-party platforms and exploiting identity and access management weaknesses. These developments defined the cyber threat environment in 2025 and set the stage for ongoing risks into 2026, as organizations faced increasingly sophisticated and industrialized adversaries.
Mar 21, 2026
Major Data Breaches and Attack Trends in 2025
The year 2025 saw a significant escalation in the scale and sophistication of data breaches worldwide, with attackers leveraging advanced tools such as AI-driven phishing, deepfakes, and automated intrusions. High-profile incidents included the compromise of billions of credentials from tech giants, targeted attacks on airlines and telecoms, and the exposure of sensitive customer data from major insurance companies like Aflac. Attack vectors evolved, with phishing, social engineering, supply-chain breaches, and cloud misconfigurations becoming increasingly prevalent. The financial impact of these breaches was substantial, with average costs per incident rising and global cybercrime losses projected to exceed $10 trillion. Notably, the Aflac breach in June 2025 exposed personal and health data of over 22 million individuals, attributed to the Scattered Spider group, prompting the company to enhance security measures and offer extended identity protection services to affected parties. Industry analysis highlighted the dual use of AI by both attackers and defenders, the growing threat of supply-chain and cloud-based attacks, and the persistent challenge of credential theft. The insurance sector, in particular, faced coordinated campaigns, with similar breaches reported at other firms. Organizations responded by resetting credentials, increasing monitoring, and providing support to victims, while regulatory scrutiny and legal actions intensified. The events of 2025 underscored the urgent need for robust security practices, rapid incident response, and proactive threat intelligence to mitigate the evolving risks posed by increasingly resourceful adversaries.
Mar 21, 2026