Year in review
2025 in review: major breaches and regulatory changes
The incidents and rule changes that shaped GRC work in 2025, with lessons and sources.
A short look back at the incidents and rule changes from 2025 that matter most for governance, risk and compliance work, each with its source.
Themes
- Identity was the front door again: stolen passwords, missing MFA and help desk impersonation drove the biggest incidents.
- Third parties and integrations (OAuth apps, outsourced IT, SaaS) were in the attack path more often than the victim’s own code.
- Operational resilience moved from guidance to law in finance (DORA) and was tested in practice by long shutdowns in retail and manufacturing.
- AI governance became a compliance topic with dates attached under the EU AI Act.
Major incidents
- Feb 2025Bybit cryptocurrency theft
About US$1.5 billion in virtual assets stolen from the exchange on 21 February. The FBI attributed it to North Korea’s “TraderTraitor” activity.
GRC lesson: Digital asset custody and signing processes are high-value targets; third-party wallet software is part of the attack surface.
- Apr 2025Marks & Spencer
Social engineering through a third party led to ransomware, a 46-day pause in online orders and an estimated £300m hit to operating profit.
GRC lesson: Help desk resets and outsourced IT providers belong in your access and supplier controls.
- Aug 2025Salesforce data theft via Salesloft Drift
A group tracked as UNC6395 used stolen OAuth tokens from the Salesloft Drift integration to export data from many companies’ Salesforce instances, mainly between 8 and 18 August, and searched it for secrets such as access keys.
GRC lesson: Connected apps and OAuth tokens are third-party access: inventory them, limit scopes and review them like user accounts.
- Sep 2025Jaguar Land Rover
A cyber attack halted JLR vehicle production for weeks from late August. The UK government backed a £1.5 billion commercial loan guarantee to support the supply chain, and a phased restart began on 29 September.
GRC lesson: A single cyber incident can stop manufacturing and threaten suppliers; resilience planning must include the supply chain.
Regulatory changes
- 6 Jan 2025HIPAA Security Rule proposal
HHS proposed major updates to the HIPAA Security Rule, including stronger requirements for risk analysis, asset inventories and MFA.
- 17 Jan 2025EU DORA applies
The Digital Operational Resilience Act began applying to EU financial entities: ICT risk management, incident reporting, resilience testing and ICT third-party oversight.
- 2 Feb 2025EU AI Act prohibitions apply
Bans on unacceptable-risk AI practices such as social scoring and untargeted facial image scraping started to apply, along with AI literacy duties. Obligations for general-purpose AI models followed from 2 August 2025.
- 31 Mar 2025PCI DSS v4.x future-dated requirements
The 51 future-dated requirements in PCI DSS v4.0/v4.0.1 became mandatory in assessments, including stronger e-commerce script controls and MFA for access to the cardholder data environment.
- 12 Nov 2025UK Cyber Security and Resilience Bill
The UK introduced a bill to update the NIS Regulations 2018, bringing more services (such as managed service providers) into scope and strengthening incident reporting.
- 14 Nov 2025India DPDP Rules notified
India notified the Digital Personal Data Protection Rules, 2025, with phased timelines for most obligations under the DPDP Act.