Loading story…
Ericsson Inc. (US) disclosed a data breach after attackers compromised an unnamed third-party service provider supporting its US operations, with the intrusion attributed to a voice-phishing (vishing) social-engineering incident against a vendor employee. Regulatory filings indicate the vendor detected suspicious activity on April 28, 2025, assessed that unauthorized access to certain files may have occurred between April 17–22, 2025, and engaged external cybersecurity specialists, notified the FBI, and implemented containment measures including password resets. Ericsson reported that the exposed information included personal data for employees and customers; one filing cited potential exposure of names and Social Security numbers, while another suggested a broader set of impacted data elements.
Ericsson stated it was notified by the service provider months later (reported as November 10, 2025), and that the company’s subsequent review to identify affected individuals and obtain contact details concluded on February 23, 2026. Ericsson ultimately confirmed 15,661 individuals were affected and reported that, as of disclosure, it had not detected misuse of the exposed data. Separate reporting in the same news cycle described unrelated ransomware activity affecting an EV charger manufacturer and an unconfirmed ransomware claim against a US electric cooperative; those incidents are distinct from the Ericsson third-party breach.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
On March 10, 2026, Ericsson disclosed the third-party data breach through regulatory notifications and public reporting. The company said exposed data may include highly sensitive personal information, stated it had seen no evidence of misuse, and offered affected individuals identity protection or credit monitoring services.
On February 23, 2026, Ericsson finished its review of the affected files and determined that personal information tied to Ericsson employees and customers was included. Reporting later said the breach affected 15,661 individuals.
Ericsson Inc. was informed by the affected service provider about the incident after the vendor's investigation progressed. Reporting states Ericsson received notification on November 10, 2025.
On April 28, 2025, the service provider detected the incident and launched an investigation with external cybersecurity specialists. The provider also forced password resets, notified the FBI, and implemented additional security measures.
Attackers gained unauthorized access to files held by a third-party service provider supporting Ericsson's U.S. operations. Later reporting attributed the intrusion to a vishing-based social engineering attack against a vendor employee, with access occurring between April 17 and April 22, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcego.theregister.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Volvo Group North America** disclosed an indirect data breach after attackers compromised systems at its vendor **Conduent**, a business process outsourcing provider that handles workforce benefits and other back-office services. Notifications and regulatory filings indicate **16,991** affected individuals tied to Volvo in the US, with intruders having access to Conduent environments from **October 21, 2024 to January 13, 2025**; Volvo learned in late January and later confirmed its exposure as Conduent and customers worked to determine downstream impact. Exposed data included **names**, with reporting also describing theft of highly sensitive identifiers such as **SSNs**, **dates of birth**, and **health/insurance-related information** (e.g., policy details and medical data), though the exact data elements may vary by individual. Conduent reported discovering the intrusion in **January 2025**, taking containment actions and engaging forensic investigators; impacted parties are being offered **identity monitoring/credit monitoring** services and advised to consider **fraud alerts** or **credit freezes**, underscoring the extended notification timelines and broad blast radius typical of large third-party service provider breaches.
Jun 29, 2026
Ernst & Young (EY) disclosed a data breach after attackers gained unauthorized access to a third-party IT support and ticketing platform used by EY personnel supporting tax-related client work. EY said the intruders accessed the system between **March 28 and April 12, 2026**, downloaded multiple documents, and exposed personal and financial information used for tax preparation, including data tied to some individuals’ investment holdings with EY institutional clients. The firm detected anomalous activity on **April 23**, launched an investigation with external cybersecurity experts, secured affected systems, and notified federal law enforcement. EY has not disclosed the identity of the third-party vendor, the number of affected individuals, the attack method, or any attribution to a threat actor. The company said it has not found evidence that the stolen information has been misused or that specific individuals were deliberately targeted, and began notifying affected people on **July 13**. EY also filed breach notifications with the California Attorney General and is offering eligible individuals **24 months** of Experian identity monitoring and restoration services.
Jul 27, 2026
British telecommunications company Brsk confirmed unauthorized access to one of its customer database systems, resulting in the exposure of over 230,000 customer records. The stolen data, which was advertised for sale on a cybercrime forum, included full names, email and home addresses, installation details, location data, phone numbers, and indicators of vulnerability status. Brsk stated that no financial information, passwords, or account credentials were compromised, and there is no evidence of misuse so far. The company has notified affected customers, offered them 12 months of free monitoring services, and reported the incident to relevant authorities, including the ICO and police. Separately, Comcast agreed to pay a $1.5 million fine to settle an FCC investigation into a February 2024 vendor data breach that exposed the personal and financial information of nearly 275,000 customers. The breach occurred at Financial Business and Consumer Solutions (FBCS), a former debt collection vendor, and included names, addresses, Social Security numbers, dates of birth, and account numbers. Comcast has committed to enhanced vendor oversight, regular risk assessments, and improved compliance reporting as part of the settlement. Both incidents highlight the ongoing risks to customer data in the telecommunications sector, whether from direct attacks or third-party vendor breaches.
Jun 29, 2026