The Cloud Under Fire: What May 2025 Revealed
May 2025 saw a surge in cloud-era cyberattacks—ranging from insider breaches to ransomware—impacting finance, retail, healthcare, beverage, and SaaS industries. These incidents underscore a critical lesson: if you lack full visibility and automated security, even trusted vendors can’t protect you.
This post spotlights breaches that were discovered and reported in May 2025, and explores how CloudWize could have stopped them.
Major Breaches Reported in May 2025
1) Coinbase – Insider Extortion
Disclosed May 11, 2025: Rogue overseas contractors at a third-party vendor accessed Coinbase user data and demanded a $20 million ransom. The incident was discovered only after extortion attempts were made.
Impact: 69,461 customers affected; data included names, partial SSNs, ID images.
Source – SecurityWeek
2) Marks & Spencer – Ransomware via IT Partner
Disclosed May 6, 2025: The “Scattered Spider” group used social engineering on a helpdesk vendor to deploy ransomware across M&S systems, disrupting operations.
Impact: System outages and likely customer data exposure.
Source – Reuters
3) Commvault – SaaS Backup Zero-Day (CVE‑2025‑3928)
Disclosed May 1, 2025: A zero-day vulnerability in Commvault’s Azure-hosted backup service was added to CISA’s Known Exploited Vulnerabilities list. Attackers used it to deploy webshells and extract client secrets.
Impact: Secrets compromised across global SaaS environments.
Source – TechRadar
4) Coca‑Cola Middle East – Ransomware Data Dump
Disclosed May 22, 2025: Everest ransomware actors targeted Coca‑Cola’s Dubai-based bottler, dumping 1,104 files containing employee data.
Impact: ~959 employees affected; leaked files included passports, salary info, and visa documents.
Source – The Hacker News
5) Adidas – Helpdesk Vendor Leak
Disclosed May 23, 2025: A breach at a third-party helpdesk provider exposed customer contact information. No payment details were involved.
Impact: ~544,000 records affected; potential phishing risk.
Source – Times of India
6) LexisNexis – GitHub Misconfiguration
Disclosed May 28, 2025: A misconfigured GitHub repo exposed internal code, API keys, and documentation.
Impact: ~364,000 records at risk; attacker access to internal systems.
Source – Wired
Common Patterns in May 2025 Breaches
- Vendors and third parties are frequent entry points.
- Zero-day exploits are targeting SaaS platforms in the wild.
- Developer environments are exposing secrets via Git misconfigurations.
- Incident discovery delays allow attackers time to escalate.
These breaches prove that security gaps are not just technical—they’re architectural. CloudWize was built to address exactly this challenge.
How CloudWize Prevents These Threats
Insider & Third-Party Risk
- Real-time DSPM and access monitoring to flag unauthorized access
- Third-party posture scoring and risk segmentation
Ransomware & Supply Chain Intrusions
- CNAPP-based behavioral analytics to catch abnormal patterns
- Runtime protection to block encryption attempts
Secrets Exposure & API Misuse
- Secrets scanning in repositories and IaC
- API token governance and anomaly detection
SaaS Vulnerability Coverage
- SSPM with zero-day alerting
- RBAC enforcement across SaaS and cloud-native apps
Why CloudWize?
CloudWize unifies your security stack, replacing fragmented tools with a Cloud Security Center of Excellence:
- CNAPP + DSPM in one
- Secrets and IaC security
- Real-time detection & response
- Compliance automation (SOC 2, GDPR, HIPAA)
- Full support for AWS, Azure, GCP, and Kubernetes
Organizations using CloudWize report:
- 80% reduction in misconfigurations
- 65% faster security reviews
- Lower vendor and audit risk
Want to Know Your Breach Risk Score?
You don’t need to wait for a breach to know your weaknesses.
Schedule a CloudWize demo and see how we can detect the gaps before attackers do:
👉 https://www.cloudwize.io/demo
