Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Individual/Family Services

Breach intelligence, attack campaigns, and threat reports targeting the Individual/Family Services sector.

9 threat reports
Page 1 of 1
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Individual/Family Services Threat Reports

Showing 1–9 / 9 reports
Ghanaian National Sentenced for $10M Romance Scam
Financial Services3 months ago

Ghanaian National Sentenced for $10M Romance Scam

In July 2026, Derrick Van Yeboah, a 41-year-old Ghanaian national, was sentenced to 85 months in prison for orchestrating romance scams that defrauded victims of over $10 million. Operating from February 2015 to October 2024, Van Yeboah impersonated romantic partners online, targeting primarily older and vulnerable individuals. He was a high-ranking member of a Ghana-based criminal organization responsible for stealing more than $100 million through romance scams and business email compromises. This case underscores the persistent threat of online romance scams, which exploit individuals' trust and emotional vulnerabilities. The substantial financial losses and emotional devastation experienced by victims highlight the need for increased awareness and vigilance in online interactions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
pcTattletale's 2024 Data Breach: A Cautionary Tale in Cybersecurity
Computer/Network Security7 months ago

pcTattletale's 2024 Data Breach: A Cautionary Tale in Cybersecurity

In May 2024, pcTattletale, a U.S.-based spyware application, suffered a significant data breach when a hacker infiltrated its servers, defaced its website, and exposed sensitive data, including customer information and victim data. The breach was facilitated by exploiting vulnerabilities that allowed unauthorized access to the company's Amazon Web Services account, leading to the exposure of over 300 million screenshots captured from victims' devices. Following the incident, pcTattletale's founder, Bryan Fleming, announced the company's immediate shutdown, stating that all data had been deleted to prevent further exposure. This breach underscores the inherent risks associated with spyware applications, particularly their potential to compromise user privacy and security. The incident also highlights the growing scrutiny and legal actions against developers and distributors of such software, emphasizing the need for robust security measures and ethical considerations in software development.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Spanish Authorities Dismantle Online Gambling Ring Exploiting Ukrainian Women
Gambling/Casinos8 months ago

Spanish Authorities Dismantle Online Gambling Ring Exploiting Ukrainian Women

In March 2026, Spanish and Ukrainian law enforcement authorities dismantled a criminal network that exploited vulnerable Ukrainian women to facilitate an online gambling scheme, laundering approximately €4.75 million in illicit proceeds. The organization targeted women displaced by the war in Ukraine, bringing them to Spain under the guise of providing assistance. Once in Spain, the victims were coerced into opening bank accounts and credit cards, which the criminals then controlled to conduct fraudulent online gambling activities. The operation led to the arrest of 12 suspects and the seizure of significant assets, including mobile phones, computers, vehicles, and frozen bank accounts across multiple countries. This incident underscores the increasing trend of cybercriminals exploiting vulnerable populations to facilitate financial crimes. The use of sophisticated methods, such as automated betting systems and identity theft, highlights the evolving nature of online fraud and the necessity for robust international cooperation to combat such transnational criminal activities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Bluetooth Vulnerability Exposes WHILL Medical Wheelchairs
Health Care / Life Sciences10 months ago

Critical Bluetooth Vulnerability Exposes WHILL Medical Wheelchairs

In December 2025, a critical IoT vulnerability (CVE-2025-14346) was disclosed in WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, widely used in healthcare and public health sectors. Researchers discovered that these devices failed to enforce authentication for Bluetooth connections, enabling attackers within physical range to pair, take full control, issue movement commands, bypass safety restrictions, and alter configuration profiles with no user credentials required. The issue impacted all device versions, prompting emergency firmware mitigations from WHILL Inc. to restrict unauthorized access and manipulation. This incident underscores urgent risks associated with the growing attack surface in medical IoT and connected healthcare devices. Increasing reliance on wireless interfaces heightens exposure to exploitation, mandating stronger security and authentication measures as the threat landscape evolves.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
How Identity Fraud Among Home-Care Workers Put Patients at Risk in 2025
Health Care / Life Sciences10 months ago

How Identity Fraud Among Home-Care Workers Put Patients at Risk in 2025

In late 2025, a series of identity fraud cases within the home healthcare sector exposed substantial patient safety risks, as unqualified individuals impersonated registered caregivers to provide in-home care services. Attackers exploited weak identity and access management processes—primarily by sharing credentials and mobile devices, enabling false geolocation verification—to bypass patient safety protocols. Law enforcement and government reports highlighted multiple cases in the US and UK involving impersonation, altered electronic monitoring, and direct falsification of visit records. These incidents led to financial fraud against Medicaid, diminished quality of patient care, and, in some tragic cases, severe patient neglect or harm. This trend reflects a growing abuse of digital identity controls in healthcare, where rapid sector expansion and understaffed workforces create security gaps. The surge in similar impersonation tactics and the inadequacy of traditional geolocation or password-based controls underline the urgent need for advanced identity verification—such as biometrics—combined with device and contextual authentication, especially as regulatory scrutiny increases.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Pajemploi Data Breach Exposes 1.2 Million French Citizens: What Went Wrong?
Government Administration10 months ago

Pajemploi Data Breach Exposes 1.2 Million French Citizens: What Went Wrong?

In June 2024, French public agency Pajemploi, responsible for social security management for parents and home childcare providers, suffered a large-scale data breach. Attackers exploited a flaw in the agency's online system that enabled them to access personal data belonging to approximately 1.2 million individuals, including names, addresses, social security numbers, bank details, and tax identification data. The breach was discovered after abnormal activity was detected, and Pajemploi acted swiftly to close the vulnerability, notify affected users, and inform regulatory authorities, including France's data privacy regulator CNIL. The incident temporarily restricted access to certain online services for impacted users. This breach highlights the ongoing targeting of government and public-sector databases holding sensitive citizen data. With regulatory requirements such as GDPR placing heavy penalties on agencies that fail proper controls, the Pajemploi incident underscores the urgency of robust data protection, zero trust segmentation, and advanced anomaly detection across Europe’s digital public services.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
2024 Android Infostealer Attack: How Termux and Telegram Fueled Stealthy Mobile Data Breaches
Banking/Mortgage10 months ago

2024 Android Infostealer Attack: How Termux and Telegram Fueled Stealthy Mobile Data Breaches

In October 2024, researchers identified a novel Android infostealer undetected by antivirus engines, leveraging Termux—a legitimate terminal emulator app—to collect sensitive data from mobile devices. The attacker deployed a Python-based stealer designed to extract user contacts, SMS, call logs, location data, and app-specific files, including those for Facebook, WhatsApp, and banking. Exfiltration occurred via Telegram API integration, and a persistent backdoor was installed for continued access. The operation showcased clever abuse of legitimate utilities, with initial device compromise mechanics still unclear, though social engineering leading to the installation of Termux is likely. This incident highlights the evolving landscape in which infostealers now aggressively target mobile platforms as device usage and data stored on them surge. With sophisticated yet undetectable malware exploiting legitimate tools and APIs, organizations and users face heightened risks from threats previously confined mostly to Windows environments.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Ransomware Breach at London’s Kido Nursery: Child Data Leaked by Radiant Group
Primary/Secondary Education10 months ago

Ransomware Breach at London’s Kido Nursery: Child Data Leaked by Radiant Group

In September 2025, the Kido International nursery chain, operating in several countries and serving over 15,000 families, suffered a ransomware attack orchestrated by the Radiant Group. Attackers accessed sensitive data and photographs of more than 1,000 children, their families, and nursery employees. Some stolen data, including children's pictures and residential addresses, were leaked on a dark web site to pressure Kido into paying a ransom. When extortion attempts failed, the attackers removed the leaked files, but only after making threatening calls to parents, intensifying the distress of the incident. This event underscores the alarming targeting of childcare and educational institutions by cybercriminals, reflecting a broader trend of ransomware attacks exploiting organizations that handle sensitive personal data. The swift arrests by London police of suspects involved demonstrate growing law enforcement action, yet also highlight increased risks for sectors entrusted with children's safety and privacy.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Datzbro Android Trojan Exploits Elderly via Facebook Travel Event Scams in 2025
Banking/Mortgage10 months ago

Datzbro Android Trojan Exploits Elderly via Facebook Travel Event Scams in 2025

In August 2025, cybersecurity researchers discovered a sophisticated Android banking trojan named Datzbro targeting elderly users in Australia. The malware spread through AI-generated Facebook groups promoting travel events for seniors, tricking victims into installing a malicious app under the guise of exclusive event details. Once installed, Datzbro enabled full device takeover, allowing threat actors to intercept credentials, manipulate transactions, and conduct fraudulent activities undetected, resulting in significant financial losses for victims and the potential compromise of sensitive personal data. This incident highlights the growing exploitation of AI-driven social engineering techniques and the increasing focus on vulnerable demographics like the elderly. The convergence of advanced mobile malware and tailored deception campaigns presents escalating risks for global financial institutions and their customer bases.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports