LeakWatch 2025 – Analysis of security incidents, data leaks and zero-day exploits in calendar week 49

The current calendar week was characterized by several incidents that revealed significant weaknesses in the handling of IT security, data protection and the integrity of digital services. It is striking that the incidents are once again spread across a broad spectrum of industries and in many cases can be traced back to problems in the management of sensitive data, faulty processes at third-party providers or inadequate security mechanisms. The cases make it clear that organizational structures and outdated control mechanisms continue to be key points of attack.

Massive data leak at Coupang due to access keys left behind

This week’s focus is on the large-scale data leak at the South Korean e-commerce provider Coupang. Apparently, a valid authentication key belonging to a former employee remained active for several months. The unauthorized access led to the compromise of around 33.7 million user accounts. The leaked data includes names, email addresses, telephone numbers, addresses and order histories. Payment data and passwords are not believed to have been affected. The incident sheds light on fundamental failures in identity and access management. Regulatory authorities are now investigating whether the relevant data protection requirements were complied with.

Numerous banks affected by data leak at fintech service provider Marquis

Another incident concerns the US fintech company Marquis, which provides various services for banks and credit unions. In recent days, the company has informed numerous institutions about a data leak as a result of a ransomware attack. It remains to be seen how many customer accounts have been affected. The case shows once again how vulnerable distributed financial infrastructures are when central service providers are inadequately secured. The discussion focuses on the question of whether the outsourced structures in the financial sector have been adequately audited.

Enea reports data outflow from non-productive environment

The Swedish IT security provider Enea reported a limited data outflow, which is said to have been restricted to non-productive systems. Although the incident is under control according to the company, it remains unclear which data types were specifically affected. The case shows that even security providers can have internally vulnerable areas, the importance of which is often underestimated. Discussions revolve around the question of why test and development environments were not separated more strictly from real customer data.

Ongoing warnings about state-controlled infrastructure access through Brickstorm

The analysis of a malware family known as Brickstorm continues to be present. It is said to have used vulnerabilities in VMware vSphere installations to gain access to the systems of government agencies and critical infrastructures. Investigating authorities in the USA and Canada assume that this was a state-controlled operation. The focus is on the question of how long the observed attacks remained undetected and whether other systems were equipped with long-term backdoors. The case shows how effective targeted attacks can be if basic virtualization environments are not updated promptly.

New investigations into problematic data transfers through analysis frameworks

Triggered by several incidents in recent months, the use of external analysis tools that collect extensive telemetry data is once again taking center stage. This week, too, there have been debates about which data from embedded frameworks is anonymized and which is not. Several service providers had to admit that internal guidelines were not consistently implemented and that data packages were insufficiently pseudonymized over a long period of time. The incident strengthens the demand for independent audits of the tracking mechanisms used.

Conclusion

The week confirms that organizational failures continue to be a significant risk factor. In several cases, the outflow of sensitive data was not due to complex zero-day exploits, but to inadequate processes in identity and authorization management and insufficient controls at third-party providers. The events also make it clear that security providers themselves are structurally at risk if internal data flows are imprecisely separated or external tools are incorrectly integrated. The reactions of the authorities point to growing regulatory pressure, which could have further consequences in the coming weeks.

Source overview

What is LeakWatch?
As part of this project, a specially created and trained ChatGPT-based bot is used for special Internet research, which takes over the automated analysis of relevant data sources and simultaneously creates translations and text excerpts. The aim is to use primary sources that are as unadulterated as possible, which is why all links are recorded in tabular form to enable optional in-depth research by the interested reader. The automated search and extraction would only be possible with disproportionate effort without AI support, but every evaluation is carried out editorially and everything is also checked in terms of content, as the AI cannot interpret or formulate all content completely reliably. LeakWatch is designed as a periodic security and leak analysis format that is created in the style of igor’sLAB and using specific specifications. The focus is on verifiable events from primary sources, technical classification and completely neutral evaluation without the influence of already filtered secondary information from third parties.