This past month has once again underscored the vulnerabilities organizations face across sectors, from healthcare and telecom to retail. This month’s breach roundup highlights notable incidents involving major players like Ascension, MTN Group, and Marks & Spencer. Each case not only reflects growing threats from third-party software flaws and unauthorized access, but also reveals the critical importance of continuous risk monitoring, regulatory compliance, and incident response readiness. Below, we break down the key developments, their impacts, and what they mean for your security posture.
Hertz Corporation has confirmed that a data breach affecting customers of its Hertz, Dollar, and Thrifty brands stemmed from the exploitation of two zero-day vulnerabilities (CVE-2024-50623 and CVE-2024-55956) in Cleo’s file transfer platform by the Cl0p ransomware group in October and December 2024. Although Hertz used the platform only for limited purposes, personal data such as names, contact details, birth dates, driver’s license numbers, credit card information, and in some cases, Social Security numbers and medical claim details, were stolen. While the company’s internal network was not compromised, data was exfiltrated from Cleo’s system. Hertz has begun notifying affected individuals and is offering two years of free identity or dark web monitoring. Although no misuse of the data has been reported so far, customers are advised to remain vigilant. The breach impacts at least 3,409 residents in Maine, with the total number of affected individuals not yet disclosed.
On April 11, 2025, Yale New Haven Health (YNHHS) began alerting patients of a data security incident that occurred on March 8, 2025, when unauthorized access to its IT systems resulted in the exfiltration of certain patient data. Although the electronic medical record system, financial information, and employee HR records were not affected, the compromised information may include names, birth dates, contact details, Social Security numbers, and medical record numbers, varying by individual. YNHHS promptly responded by containing the breach, launching an investigation with cybersecurity experts, notifying law enforcement, and initiating direct communication with affected patients. Those whose Social Security numbers were involved are being offered complimentary credit monitoring and identity protection. The health system emphasized that patient care was never disrupted and reaffirmed its commitment to data security, stating that ongoing improvements are being made to prevent future incidents.
On April 9, 2025, Blue Shield of California notified members of a potential data breach involving the improper sharing of protected health information (PHI) through Google Analytics. From April 2021 to January 2024, certain member data from Blue Shield websites may have been shared with Google Ads due to a misconfiguration. This data may have included plan details, location, gender, family size, online identifiers, provider search data, and medical service information. No Social Security numbers, financial account data, or driver’s license information were involved. The issue was discovered in February 2025, though the data connection had already been severed in January 2024. Blue Shield has asked Google to delete any retained information and has since reviewed its tracking systems to prevent similar incidents. While no malicious actors were involved, Blue Shield is notifying all potentially impacted members and encouraging them to monitor their financial accounts and credit reports as a precaution.
Ascension, one of the largest private healthcare providers in the U.S., notified patients in April 2025, of a data breach involving personal and health information stolen in December 2024. The breach stemmed from a vulnerability in software used by a former business partner, to whom Ascension had inadvertently disclosed patient data. On January 21, 2025, Ascension confirmed that attackers accessed sensitive data such as names, contact details, birthdates, race, gender, Social Security numbers, and medical information including diagnosis codes, medical record numbers, and insurance details. While the total number of affected individuals remains unclear, 114,692 patients in Texas and 96 in Massachusetts were confirmed to be impacted. Ascension is offering two years of free identity and credit monitoring to those affected. The breach may be linked to a wave of Clop ransomware attacks exploiting a flaw in Cleo file transfer software. This follows a previous incident in May 2024, when 5.6 million individuals were affected by a separate ransomware attack caused by an employee downloading a malicious file.
On April 22, 2025, Marks & Spencer Group PLC (M&S) notified through the London Stock Exchange Group of a cyber incident that required minor and temporary adjustments to store operations. Despite these changes, all stores remained open, and both the website and mobile app continued to function normally. The company engaged external cybersecurity experts to investigate and manage the situation, while also implementing additional measures to secure its network and maintain customer service. M&S reported the incident to relevant data protection authorities and the UK’s National Cyber Security Centre. The company emphasized its commitment to customer trust and stated that further updates would be provided if necessary.
MTN Group, Africa’s largest mobile network operator, confirmed that it had experienced a cybersecurity incident that resulted in unauthorized access to personal data belonging to customers in certain markets. However, the company emphasized that its critical infrastructure—including its core network, billing systems, and financial services platforms—remained secure and fully operational. While an unknown third party claimed to have accessed parts of MTN’s systems, the company stated there was no evidence that customer accounts or mobile wallets had been directly compromised. MTN promptly activated its cybersecurity response protocols, notified the South African Police Service and relevant authorities, and began informing affected customers in accordance with local laws. The company also urged customers to stay vigilant by updating their apps, using strong passwords, enabling multifactor authentication, and avoiding suspicious links. MTN reaffirmed its commitment to protecting customer data and maintaining the integrity of its systems.
These recent incidents reinforce a sobering truth: no organization, regardless of size or industry, is immune to cyber risk. Whether it’s a healthcare giant navigating third-party data exposure, a telecom leader containing unauthorized access, or a retail brand managing operational disruption, each case highlights the need for layered security, clear response protocols, and proactive compliance management. At Findings, we continue to support businesses in staying ahead of such threats with automated risk assessments, real-time visibility, and a unified platform that streamlines compliance across your entire ecosystem. Findings CloudVRM helps you view your vendors’ clouds in real time, 24/7, so you can spot threats before they impact your organization and act swiftly to protect your data and reputation. Stay informed, stay prepared, and stay secure.
This website uses cookies to enhance your browsing experience, analyze site traffic, and improve our services. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy. You can manage your cookie preferences at any time through your browser settings.
