Weekly Breach Roundup: 250M+ Records Exposed in 10 Days

The final week of 2025 and opening days of 2026 brought a relentless wave of security incidents — with over 250 million records exposed across more than 30 organizations globally. From cryptocurrency exchange panel access to government data exfiltration, here's what defenders need to know.

The Numbers at a Glance

Critical Incidents

Kraken Exchange: Admin Panel Access Sold

Date: January 2, 2026

Threat actors are selling read-only access to Kraken's internal admin panel — exposing complete KYC data, government IDs, selfies, and transaction histories. The listing includes phishing tooling priced from just $1.

Why it matters: Even "read-only" access enables devastating social engineering attacks. Attackers can reference real transaction details, generate support tickets, and target high-value accounts with inside knowledge.

Read our full analysis →

Experian: 20M+ Consumer Records

Date: December 30, 2025

Credit bureau giant Experian allegedly suffered a breach exposing over 20 million consumer records — potentially including credit scores, payment histories, and personal identifiers.

Impact: Credit bureau breaches are particularly dangerous because the data is designed to verify identity — making it perfect for identity theft.

France Mobile Database: 160M Phone Numbers

Date: December 25, 2025

A massive database containing 160 million French phone numbers appeared for sale on dark web forums — a significant portion of France's population.

Attack enablement:

• SIM swapping campaigns at scale
• SMS phishing (smishing) operations
• Voice phishing (vishing) targeting
• Account recovery exploitation

Solana Wallets: 171K Private Keys

Date: December 30, 2025

171,000 Solana wallet private keys were offered for sale — representing direct access to cryptocurrency holdings with no recovery possible for victims.

Private key compromise = Total loss
No 2FA · No recovery · No reversal

Root causes likely include:

• Malware-infected wallet generators
• Compromised browser extensions
• Phishing sites mimicking legitimate wallets
• Clipboard hijacking malware

European Space Agency: 200GB Data Leak

Date: December 27, 2025

ESA confirmed a breach after attackers claimed 200GB of data including source code, API tokens, Terraform configurations, and hardcoded credentials from collaboration servers.

Read our full analysis →

Ransomware Activity

Ransomware groups remained active through the holiday period, exploiting reduced staffing and delayed incident response.

SAFEPAY Operations (December 29)

PLAY Ransomware (December 29)

Individual Ransomware Victims

Holiday timing: Ransomware operators deliberately target holiday periods when IT teams are understaffed and response times are slower.

Corporate & Infrastructure Breaches

Massive Data Exposures

Industrial & Infrastructure Targets

Access Sales: The Growing Threat

Beyond data dumps, threat actors are increasingly selling persistent access to compromised systems — enabling future attacks.

Access Listings This Week

Credential & Financial Data

Forti VPN Credentials

December 30: Approximately 1,000 valid Fortinet VPN credentials sold globally — providing direct network access to enterprise environments.

Critical because:

• VPN credentials bypass perimeter security entirely
• Often grant internal network access immediately
• May remain valid for extended periods if not rotated

UK Credit Cards

December 30: 486 UK credit cards sold with claimed 70–90% validity rate — indicating recent theft from active payment systems.

Educational & Government Sector

Educational institutions remain prime targets due to:

• Large PII datasets (students, staff, alumni)
• Often underfunded security programs
• Complex, distributed IT environments
• Valuable research data

Regional Breakdown

By Geography

By Sector

Patterns & Takeaways

1. Holiday Exploitation

Threat actors aggressively targeted the Dec 24–Jan 2 period. Organizations should:

• Maintain security operations coverage during holidays
• Pre-position incident response capabilities
• Implement automated detection and response

2. Access-as-a-Service

The proliferation of access sales (VPN credentials, admin panels, API keys) indicates a maturing cybercrime ecosystem where initial access is commoditized.

3. Credential Exposure Remains Endemic

From hardcoded secrets in source code to VPN credentials for sale, credential management failures underpin most breaches. Solutions include:

• Secrets management platforms
• Automatic credential rotation
• Zero standing privileges
• Hardware security modules

4. Scale of Data Aggregation

When 160M phone numbers or 20M credit records are breached, the data enables attacks far beyond the original victims — fueling fraud, phishing, and identity theft for years.

Defensive Recommendations

Immediate Actions

1. Rotate credentials — especially VPN, admin panels, API keys
2. Audit external-facing systems — collaboration tools, development infrastructure
3. Enable MFA everywhere — particularly on privileged accounts
4. Monitor dark web — for mentions of your organization
5. Review holiday coverage — ensure security operations continuity

Strategic Improvements

• Implement zero-trust architecture — assume breach, verify everything
• Encrypt data at rest and in transit — limit breach impact
• Segment networks — prevent lateral movement
• Deploy endpoint detection — catch ransomware early
• Conduct tabletop exercises — prepare for incident response

Key Takeaways

• 250M+ records exposed across 30+ organizations in 10 days
• Holiday periods are prime attack windows — threat actors exploit reduced staffing
• Access sales are proliferating — credentials, panels, and API keys traded as commodities
• Ransomware remains active — SAFEPAY and PLAY groups claimed 14+ victims
• Credential failures underpin most breaches — from VPN access to hardcoded secrets

The velocity and scale of these incidents demonstrate that traditional security perimeters are insufficient. Organizations must assume breach and protect data at its source — ensuring that even when systems are compromised, sensitive information remains encrypted and unusable to attackers.

Want to ensure your data remains protected even when systems are breached? Learn how CIFER's encryption architecture keeps data safe regardless of infrastructure compromise.