Weekly Cyber Update: 16 December 2025

Collins Aerospace double whammy attack analysis

In September, Collins Aerospace suffered two separate cyber incidents in the same week, driven by very different root causes, which require critical distinction. In mid-September, Collins disclosed a ransomware attack that shut down its MUSE passenger processing system, causing significant disruption at European airports and stranding thousands of passengers. That incident was real, operationally impactful, and consistent with a traditional ransomware attack affecting live systems.

A single infostealer infection in 2022 created a vulnerability that was exploited years later

Meanwhile, a different threat actor group, Everest, was quietly exfiltrating data from a Collins Aerospace FTP server. Everest accessed the server using valid credentials, “aiscustomer” and “muse-insecure”, previously identified as being stolen in a 2022 infostealer infection on a Collins Aerospace employee device. Those credentials were never rotated. Three years later, they were reused to access an exposed server and extract a large volume of sensitive data, including 1.5 million passenger records, employee details, SQL databases, and audit logs.

Crucially, Everest’s activity shows no evidence of ransomware deployment or encryption. This was a classic data-exfiltration attack using old, valid credentials. The ransomware outage and the Everest breach were two distinct incidents, overlapping in time but unrelated in execution.

5.6 million exposed as 700Credit breach highlights third-party risk

700Credit, a major U.S. credit and identity verification provider widely used by automotive dealerships, has suffered a significant data breach that exposed the personal information of millions of consumers. The incident affected data processed through its 700Dealer platform between May and October 2025, potentially impacting an estimated 5.6 million people. Exposed data includes names, addresses, dates of birth and social security numbers. The organisations that ultimately bore the brunt of the impact weren’t the ones breached. 700Credit sits upstream in the automotive ecosystem, processing highly sensitive identity and credit data on behalf of thousands of dealerships. When 700Credit was compromised, millions of consumers and countless dealerships were exposed simultaneously, even though those dealerships had no direct control over the vulnerable system.

The breach did not involve ransomware or malware. Instead, attackers exploited a weakness in an application interface, enabling unauthorised access and large-scale data extraction without triggering obvious alerts. The exposure was first identified through dark web monitoring before formal disclosure.

700Credit has since engaged external cybersecurity firms, notified regulators and law enforcement, and begun coordinated notifications to dealerships and affected consumers, offering credit monitoring services.

Barts Health discloses data breach

In December 2025, the leading NHS Trust, Barts Health, confirmed that sensitive data was stolen after attackers exploited a vulnerability in its Oracle E-Business Suite system. The criminal group Cl0p exploited a flaw in Oracle’s enterprise software to exfiltrate files from a business database containing invoicing and financial records. The stolen information, later posted on the dark web, includes names, addresses, and other details tied to patients, former staff, suppliers, and associated services dating back several years.

The organisation is pursuing a High Court injunction to block the publication of the stolen files

Barts Health says its core clinical systems, including electronic patient records, were not affected, and it believes its wider IT infrastructure remains secure. Nonetheless, the organisation is pursuing a High Court injunction to block the publication, sharing or use of the stolen files, even though such legal measures have limited impact on determined cyber criminals overseas.

The breach was detected only when stolen files surfaced online months after the August incident, highlighting how data theft can go unnoticed until publication.