We are only as strong as the weakest link in the chain.
This age old proverb never seems to fade out and specially now days when applied to ‘Cybersecurity in the Age of AI’. When the threat surface area and the ways of digital exploitation are on the rise.
It just takes a small weak link to bring the whole house down.
The pace of change of technological advancements in last few year have been never like before specially after launch of chat GPT in 2022. The pace of change is too fast to be adapted by any one specially Big Elephants – government, organization’s and large corporations.
In this blog I will delve into top 5 Cybersecurity incidents of 2025 and will categorize them on below areas.
- What happened?
- Why it happened?
- Business impact and cost implications?
& lastly could they have been avoided? share some best practices.
Some Stat’s and Trends for context setting:
- Estimated cost of Cyber crime in 2025 was 10 Trillion USD.1 This is 6 times larger than the annual GDP of Australia in 2025 ca. 1.75 trillion USD.
- Globally, over 300 billion passwords are currently in use and open for sale on dark web. More than 30% of the world’s population is still offline and will immediately become vulnerable when they connect to the internet.
- A survey done by world economic forum reported advancement of adversarial capabilities due to AGI, concerns the fortune 500 organizations the most.2
1. Jaguar Land Rover (JLR) targeted by cattered Spider cybercrime group – Sept’25.3
What happened: The British automotive giant was targeted by the Scattered Spider cybercrime group. Instead of a standard background data leak, this attack hit JLR’s operational technology (OT) and production systems.
Root cause:
Attackers exploited a known zero day vulnerability in SAP NetWeaver software. This allowed threat actors to move laterally to production ecosystem.
Business impact
The breach is largest in UK history and caused ca. 2.5 bn Euros and dropped UK GDP as 2 major production facilities were shutdown for 5 weeks.
How it could have been avoided:
- Rigorous patch management specially for zero day vulnerabilities on business critical infrastructure.
- Network segmentation by isolating corporate IT network into DMZ and placing critical production systems into different isolated network.
2. Bybit – Dubai based cryptocurrency exchange suffered 1.5 bn USD theft of ETH currency – Feb’25
What happened: North korean state sponsored threat actor Lazarus group siphoned away 1.5 bn usd worth ETH coins from their exchange.
Root cause:
Attackers injected malicious Java script into a free 3rd party storage pool used by Bybit. During routine backend jobs the silent code subtly manipulated multi signature transactions signing process.
Business impact
Ca. 1.5 bn USD of stolen crypto currency.
How it could have been avoided:
- Zero trust vendor governance of 3rd party open source and careful usage of free software utilities.
- Using trusted Human in the loop approvals for high value asset transfer jobs to confirm the recipients address is not tampered with.
3. Salesforce – OAuth and drift integration compromised causing data leakage of 700 Global organizations – Mid 2025.
What happened: Attackers targeted security vulnerabilities to Drift OAuth integrations tied to Sales force. They managed to hijack active oauth and refresh tokens.
Root cause:
Access permission to different integrations were not renewed and had sudo privileges then they should had.
Business impact
Customer data from ca. 700 Global, mostly fortune 500 customers data was stolen and up for sales on dark web.
How it could have been avoided:
- Tightening OAuth governance process and enforcing short lived session lifetimes for API integrations.
- Periodic SAAS posture management i.e actively monitoring the access permission of all 3rd party integrations.
4. South korean Telecom suffered massive infrastructure data breach – dec’25
What happened: Hackers managed to breach the critical infra. of a major south korean telco and stole Home subscriber server (HSS) and USIM data or ca. 23 mn customers exposing cellular routing and data protocols.
Root cause:
Weak segment control of critical infra system and combined with delayed incident detection. i.e delayed MTTR.
Further threat actors stayed inside the infra for long time and harvested telemetry data.
Business impact
ca. 23 mn customers data was stolen causing SKT with largest fine ever in SK of ca. 100 mn USD for lax security architecture and delayed detection/notificaiton to customers.
How it could have been avoided:
- Continuos Behavioral analytics i.e deploying user and entity behaviour analytics systems to immediately flag massive unauth access.
- Robust incident management process can help in timely notificaiton to legal and strict compliance with regulations.
5. Marks & Spencer suffer massive consumer and market value disruption – April’25
What happened: Scattered spider and dragon force orchestrated a massive Ransomware campaign on M&S. It knocked their online ordering systems, mobile applications, and many other sales services.
Root cause:
A failure of identity security and human defence systems. Hackers used SIM swapping and help desk impersonation to trick IT services personnel into resetting primary credentials.
Later they escalated privileges to steal AD credentials and encrypted core business data.
Business impact
This ransomware caused an drop in market valuation by ca. 1 bn Euro after disclosure and a loss of estimated 500 mn Euro in profits to firm.
How it could have been avoided:
- Strict Helpdesk Authentication: Implementing un-phishable verification methods (like physical security keys or biometric push apps) for internal employees requesting password or MFA resets.
- MFA for Active Directory Access: Restricting identity management systems behind tight conditional-access policies.
What next?
If any thing we can learn from the last 4 years since chatGPT was first launched, is this will only accelerate – For good or bad :)
A simulation (see below) on possible scenarios AI can branch out by end of this decade is nicely shown below. 4
Will US centralize compute and it Slows down or Race further?
Will ASI help solve the cybersecurity issues or will end the humanity?
Only time will tell, till then be merry and enjoy life :)
Love & Peace,
/Chakshu Arora
References:
- https://www.jerichosecurity.com/blog/cost-of-cybercrime-to-reach-10.5-trillion-by-2025 ↩︎
- https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2025.pdf ↩︎
- https://www.cm-alliance.com/cybersecurity-blog/biggest-cyber-attacks-of-2025-their-impact-on-global-cybersecurity#:~:text=What%20began%20as%20a%20security,JLR’s%20production%20lines%20remained%20suspended. ↩︎
- https://ai-2027.com/summary ↩︎
1 Quote and 1 Book recommendation.
🏛️ Wisdom from the Archives
We are like butterflies who flutter for a day and think it is forever — Carl sagan.
📖 Book i am reading this week
If there is one book you can read this year – Look no further then this one.
Looking for more reading suggestions?
Dive into my full 👉 [2026 Reading List & Curation Guide].
Leave a Reply