Hello and welcome back to The Breach Report!
July brought a wave of big breaches hitting insurers, airlines, courts, luxury brands, and even a dating app - most traced back to familiar weak spots like vendor lapses, unpatched zero-days, and outdated systems. The takeaway? If you don’t know where your blind spots are, attackers will find them for you.
Follow along and subscribe to keep up-to-date on key data breaches each month.
🚨 Top 7 Data Breaches of July 2025
Tea App Data Leak (multiple breaches, global)
What happened: Two major leaks from the women's app Tea. The first exposed ~72,000 images (selfies, IDs), and the second released ~1.1 million private messages. Hackers exploited a completely unsecured backend database.
Impact: Highly sensitive personal data - including biometric verification and intimate messages - was publicly accessible, prompting class-action lawsuits.
Lesson: Apps must secure sensitive user data behind proper authentication, even if marketed as “safe.”
Source: Read More
2. Allianz Life Cyberattack (USA)
What happened: A social-engineering attack exploited a third-party cloud CRM on July 16, breaching the personal data of the majority of its 1.4M U.S. customers. Allianz contained the incident and notified the FBI.
Impact: Names, DOBs, addresses of customers and professionals compromised; victims offered identity protection services.
Lesson: Third-party vendor security and social engineering hygiene are non‐negotiable.
Source: Read More
3. Air France / KLM Third‑Party Supply Chain Breach (France / Netherlands)
What happened: During the week of July 28, attackers gained access to customer data via a third-party platform used in contact centers.
Impact: Names, contact info, Flying Blue membership and inquiry details were exposed. No passwords, travel, or payment data compromised.
Lesson: Supply-chain platforms require scrutiny equal to your core systems.
Source: Read More
What happened: Exploits like CVE‑2025‑53770 and 53771 - nicknamed “ToolShell” - were leveraged in July to infiltrate orgs across federal, energy, academic, and telecom sectors.
Impact: Sensitive documents and communication platforms were breached globally; emergency patches issued.
Lesson: Zero-day patching and proactive monitoring are imperative for widely used enterprise tools.
Source: Read More
5. Venice Film Festival Data Breach (Italy)
What happened: On July 7, hackers accessed attendee data—journalists and participants—including names, emails, tax codes, phone numbers, and addresses.
Impact: While payment systems were unaffected, exposed personal data risks fraud and misinformation.
Lesson: Even event sectors need strong data protection and rapid incident response.
Source: Read More
6. U.S. Federal Judiciary PACER/CM‑ECF Intrusion (USA)
What happened: A breach of PACER and CM/ECF systems was discovered around July 4, exposing sensitive legal documents and possibly sealed filings. The Judiciary is ramping up security across federal courts.
Impact: Potential compromise of sealed filings, informant identities, and case data.
Lesson: Legacy legal infrastructure needs urgent modernization and defense-in-depth.
Source: Read More
7. Louis Vuitton / Co‑op UK Data Breaches (Europe)
What happened: Louis Vuitton customer data in the UK, Italy, Sweden, and other regions was exposed via a third-party vendor breach. No payment details were compromised. Co-op UK, a vendor handling its loyalty program platform, suffered a breach affecting data of ~6.5 million members.
Impact: Personally identifiable information (PII) such as names and contact details were leaked, creating risk for phishing and identity fraud.
Lesson: Even when core systems are secure, vendor weaknesses can open the door to large-scale data exposure. Supply chain security must be treated as mission-critical.
Source: Read More
🖥️ Industry Highlights: What’s in the Hot Seat
Apps targeting vulnerable groups faced severe backlash — Tea reminds us that safety-focused platforms need security above all else.
Old platforms, new threats — SharePoint zero-days and PACER hacks demonstrate that outdated systems remain prime attack surfaces.
Third-party and supply-chain weak links — From airlines to insurers, breaches reveal that external dependencies are often the path of least resistance.
🛡️ Pro Tips & Tools
Vet third-party systems rigorously — especially cloud CRMs and contact-center platforms.
Harden zero-day response — automated patch tools, immediate mitigation protocols, and layered defense strategies.
Secure event attendee data — deploy encryption, MFA, and prompt anomaly detection.
Modernize legacy systems — incremental upgrades for systems like PACER and CM/ECF are overdue.
Limit vendor control — ensure operational sovereignty when privatizing critical infrastructure.
⚠️ Emerging Threats to Watch
Deepfake-ready data dumps — Tea leaks highlight the risks posed by biometric and intimate data exposure.
Persistent exploitation of widely used tools — SharePoint tools remain a consistent vector.
Legal system vulnerabilities — Courts may become prime targets for strategic cyber influence if not protected.
Insider-assisted sabotage — the data center breach in Bengal signals how trusted access can be weaponized.
📊 Poll
What’s Your Organization’s Biggest Blind Spot This Year?
🔲 Third-Party Vendor Security Audits
🔲 Zero-Day Patch Readiness
🔲 Legacy System Modernization
🔲 Sensitive Data Encryption & Storage
🔲 Employee Social Engineering Training
💡Final Thoughts
What a month.
From unsecured dating app databases spilling millions of private messages to third-party vendors leaking airline and luxury brand customer data, July proved that attackers will take the easiest way in - whether that’s an outdated court system, an unpatched zero-day, or a poorly secured partner platform.
The big takeaway?
Cybersecurity isn’t just about locking your own doors - it’s making sure your neighbors, vendors, and tools are locked too. Whether you’re in insurance, travel, retail, or the public sector, your weakest link could be anywhere in your ecosystem. The threats aren’t slowing down, and neither can your defenses.
Thanks for reading, and we’ll see you in next month’s edition with the latest headlines, breakdowns, and lessons learned.
Until then, stay alert, stay informed, and stay secure. 🔐