Loading story…
A Barracuda report revealed that 78% of organizations experienced an email breach in the past year, with phishing, impersonation, and account takeover attacks leading to significant business disruption, data loss, and reputational harm. The report highlights that smaller firms bear a higher per-employee cost for breach recovery, and slow detection of email-based threats is closely linked to increased ransomware risk, with 71% of breached organizations also suffering ransomware attacks. The average cost of recovery varies by company size, but the consequences—ranging from lost business to prolonged reputational damage—are widespread across industries.
In a notable example, Volvo Group North America was affected by a data breach originating from its third-party HR software provider, Miljödata. Sensitive employee data, including Social Security numbers, was exfiltrated, and the incident exposed delays in detection and notification, raising concerns about forensic readiness and incident response maturity. Volvo responded by offering identity protection services to affected employees, but the breach underscores the critical need for rapid, integrated forensic response and robust communication protocols, especially when third-party vendors are involved.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Help Net Security published coverage of a Barracuda report describing email breaches as a major threat to business growth and emphasizing breach response. The reference appears to discuss general findings rather than a specific newly disclosed incident.
CSO Online reported on Volvo's recent security breach in an article focused on incident response and preserving forensic integrity. The reference indicates the breach had already occurred by the publication date, but provides no specific incident date or additional factual details.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations face increasing pressure to respond rapidly and effectively to cyberattacks, as adversaries are moving from initial access to lateral movement faster than ever before. Research highlights that the average breakout time for attackers has decreased, with some breaches escalating in under half an hour, while the average time to detect and contain a breach remains over 200 days. Effective incident response, including preparation and clear protocols, can significantly reduce the financial and operational impact of a breach, with costs dropping when incidents are contained quickly. Key steps in the first 24 to 48 hours after discovering a breach are critical to minimizing damage and ensuring a swift recovery. When a third-party vendor or supplier suffers a data breach, the consequences can cascade throughout the affected organization's ecosystem, threatening operational integrity, data security, and regulatory compliance. A structured and methodical response to third-party breaches is essential for mitigating damage and maintaining stakeholder trust. Both direct and third-party incidents require organizations to have robust incident response plans and to act decisively to limit exposure and fulfill regulatory obligations.
Jul 12, 2026
Several US organizations have reported significant data breaches affecting thousands of individuals. Pearlman Aesthetic Surgery in New York disclosed a hacking incident compromising the protected health information of nearly 12,000 patients, though specific details remain undisclosed. Methodist Homes of Alabama and Northwest Florida notified residents and employees of a second breach within seven months, involving unauthorized access to an employee email account containing sensitive personal and medical information. Gulshan Management Services, which operates over 150 gas stations and convenience stores, confirmed a breach that exposed the personal data of more than 377,000 people, including Social Security numbers and financial information, with delayed notification to affected individuals. Community First Medical Center in Chicago reached a $1 million preliminary settlement following a 2023 breach that exposed the data of approximately 216,000 patients, with allegations of inadequate cybersecurity measures and delayed response. These incidents have led to regulatory filings, class action lawsuits, and increased scrutiny over the timeliness and adequacy of breach notifications. The breaches highlight ongoing challenges in protecting sensitive data across healthcare and retail sectors, with attackers exploiting both network vulnerabilities and email accounts. Organizations are facing legal and reputational consequences, emphasizing the need for robust cybersecurity practices and prompt communication with affected individuals.
Jun 29, 2026
Volvo North America reported a data breach affecting its employees after a ransomware attack targeted its third-party human resources software provider, Miljödata. The incident began on August 20, 2025, when Miljödata was compromised by the ransomware group DataCarry, which later claimed responsibility and published stolen data on its Tor leak site. Miljödata discovered the attack on August 23, 2025, and after an internal investigation, determined on September 2, 2025, that Volvo Group North America employee data had been impacted. The breach exposed sensitive personal information, including names and Social Security numbers, of current and former Volvo employees. According to notifications sent to affected individuals, Volvo’s own systems were not directly compromised; the breach was limited to data managed by Miljödata. The affected HR systems are used for managing medical certificates, rehabilitation, and work-related injury reporting, and the attack impacted at least 25 organizations, including major companies and hundreds of Swedish municipalities. The total number of affected Volvo employees has not been officially disclosed, but reports suggest it could be several thousand. The data breach notification service Have I Been Pwned indicated that the overall leak from Miljödata involved data from 870,000 accounts, though not all were necessarily Volvo employees. Impacted individuals are at risk of identity theft or fraud due to the exposure of their Social Security numbers. In response, Miljödata engaged cybersecurity experts, enhanced its hosted environment’s security, and is working to prevent future incidents. Volvo notified the Massachusetts Attorney General about the breach, fulfilling regulatory requirements. The breach highlights the risks associated with third-party vendors and the potential for widespread impact when such providers are compromised. Other organizations affected by the Miljödata attack include Scandinavian airline SAS and mining company Boliden. The incident underscores the importance of robust vendor risk management and timely breach notification procedures. DataCarry’s publication of the stolen data increases the urgency for affected individuals to monitor for misuse of their personal information. The breach has drawn attention to the need for improved security controls in HR software platforms used by large enterprises. Volvo’s transparency in communicating the breach to employees and authorities is a critical component of its incident response. The event serves as a reminder of the cascading effects a single ransomware attack on a service provider can have across multiple industries and organizations.
Jun 29, 2026