No Sector Left Untouched
December 2025 was a brutal month for data security. From misconfigured software settings exposing millions of Social Security numbers, to ransomware gangs hitting critical infrastructure on Christmas Day, the final month of the year made one thing clear: no sector, size, or geography offers immunity. A pet retail giant, a music streaming platform, a for-profit university, a space agency, and a national energy grid all found themselves in the breach roundup – each incident a reminder that the attack surface keeps expanding while security fundamentals keep getting missed. Here’s what happened.
Petco: A Misconfigured Setting, Maximum Damage
Petco quietly confirmed a data breach in early December 2025 that exposed some of the most sensitive customer data imaginable – Social Security numbers, driver’s licenses, financial account details, and dates of birth. The root cause wasn’t a sophisticated cyberattack; it was a misconfigured software setting that left customer files publicly accessible online. While legally required filings in Texas, California, Massachusetts, and Montana brought the breach to light, Petco stayed conspicuously tight-lipped about the total number of victims – a telling silence given the company serves over 24 million customers. The California filing alone implies at least 500 affected residents in the state, but the real number is likely far higher. Petco says it corrected the setting and added “additional security measures,” and is offering credit monitoring to victims in select states – but only after regulators forced their hand.
SoundCloud: 28 Million Accounts, One Extortion Gang
SoundCloud confirmed a security breach in mid-December 2025 after users reported days of VPN-related outages and 403 errors – the kind of disruption that tells you something’s wrong before any official statement does. A threat actor gained unauthorized access to an ancillary service dashboard and walked away with a database containing user email addresses and public profile information. While SoundCloud downplayed the scope, the numbers tell a different story: the breach is estimated to affect roughly 28 million accounts – about 20% of its user base. The notorious ShinyHunters extortion gang has been fingered as responsible, and they’re now reportedly leveraging the stolen data to extort the company. SoundCloud’s remediation efforts – including tightening access controls and bringing in third-party security experts – inadvertently broke VPN access for legitimate users, adding operational disruption on top of the breach itself.
University of Phoenix: 3.5 Million Records, Courtesy of Clop
The Clop ransomware gang claimed another major victim in December 2025, with the University of Phoenix confirming that 3.5 million students, staff, and suppliers had their data stolen in an attack dating back to August. The entry point was a zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882) – the same flaw Clop weaponized across a broader campaign that also hit Harvard and the University of Pennsylvania. The exposed data is about as sensitive as it gets: names, dates of birth, Social Security numbers, and bank account and routing numbers. UoPX only became aware of the breach on November 21, after Clop had already listed them on its public leak site – a reminder of how often victims learn about their own breaches from the attacker. The university is now offering affected individuals 12 months of credit monitoring, dark web surveillance, and a $1 million fraud reimbursement policy, but with 3.5 million people in the blast radius, the damage is already done.
European Space Agency: 200GB Gone, Credentials Included
To close out December 2025, the European Space Agency confirmed that attackers had breached servers outside its corporate network – systems used for collaborative engineering activities within the scientific community. A threat actor posted claims on BreachForums backed by screenshots showing a week-long presence inside ESA’s JIRA and Bitbucket servers, and alleges to have walked away with over 200GB of data including source code, API tokens, hardcoded credentials, CI/CD pipelines, and private repositories. ESA was quick to frame the affected servers as “external” and the data as “unclassified,” but that framing does little to soften the reality of exposed infrastructure credentials and internal configuration files. A forensic investigation was launched and stakeholders were notified, but ESA has yet to confirm or deny the full scope of the threat actor’s claims. Notably, this isn’t ESA’s first rodeo – just a year prior, their official web shop was compromised with card-skimming malware, raising real questions about whether the agency’s security posture is keeping pace with its €7.68 billion budget.
Oltenia Energy Complex: Ransomware Hits Romania’s Power Grid on Christmas
On the second day of Christmas, Romania’s largest coal-based energy producer Oltenia Energy Complex found itself battling a ransomware attack from the Gentlemen gang – a group that’s only been active since August 2025 but has already racked up nearly four dozen victims. The attack encrypted files and knocked out critical systems including ERP platforms, document management tools, email, and the company’s website, though energy production to the national grid was reportedly maintained. Gentlemen gains initial access through compromised credentials and exposed internet-facing services – a tried-and-true playbook that continues to work against critical infrastructure at an alarming rate. The company immediately began rebuilding on fresh infrastructure using existing backups, while simultaneously filing reports with Romania’s National Cyber Security Directorate, the Ministry of Energy, and law enforcement agency DIICOT. What makes this particularly concerning is the pattern: this attack followed a ransomware hit on Romania’s national water authority just two weeks prior, and comes a year after both Electrica Group and over 100 Romanian hospitals suffered separate ransomware incidents – suggesting Romania’s critical infrastructure sector has a systemic exposure problem that goes well beyond any single attack.
The Takeaway: The Door Was Already Open
Five breaches. Five completely different industries. One consistent thread: attackers didn’t need to be sophisticated – they needed organizations to leave a door open. A misconfigured setting at Petco, compromised credentials at a Romanian power plant, an unpatched zero-day at a university, a vulnerable dashboard at SoundCloud – the entry points were mundane, but the blast radius was anything but. As we head into 2026, the question isn’t whether your organization will be targeted. It’s whether you’ll know about it before the attacker posts it on a forum.