Monthly Cybersecurity News May 2025

calendar icon
June 7, 2025
5 min

Here are some interesting updates about cybersecurity threats and new trends.

BART Restores Service After Major Computer Outage Disrupts Bay Area Commute

Bay Area Rapid Transit (BART) service was fully restored Friday morning after a systemwide computer outage halted all trains during the critical morning commute, impacting thousands of San Francisco Bay Area residents. The outage began around 4:30 a.m. when BART was unable to power up its train control system, forcing the agency to suspend service for safety reasons. Commuters were left scrambling for alternatives, resulting in heavy traffic on the Bay Bridge and San Mateo Bridge, and prompting other transit agencies like the San Francisco Bay Ferry, Caltrain, AC Transit, and Muni to provide mutual aid.

BART spokesperson Alicia Trost explained that the outage was traced to network devices within a redundant system that were not communicating properly; once these devices were disconnected, service was safely restored by 9:15 a.m. Trost confirmed there were no signs of a cyberattack and the age of the equipment was not a factor. The disruption highlighted BART’s crucial role in Bay Area transportation, as about 174,000 people rely on it daily.

The incident comes amid warnings of a looming financial crisis for BART, which faces a projected $350 million annual deficit beginning in 2027 as pandemic relief funds run out. Local lawmakers are advocating for a 2026 ballot measure to secure new funding, emphasizing that robust public transit is essential for the region’s economy and daily life.

Source: CBS News

Bell Canada Restores Service After Massive Router Update Outage

A widespread outage affected Bell Canada customers in Ontario and Quebec after a technical update disrupted the company’s network services. Bell confirmed that the outage was caused by an update that impacted some routers, but emphasized it was not due to a cybersecurity incident. The company quickly rolled back the problematic update to restore services and apologized for the inconvenience. Data from DownDetector showed outage complaints peaked at over 133,000 around 9:30 a.m. ET, mostly concerning landline and mobile internet disruptions. By 12:15 p.m. ET, complaints had dropped significantly, though some users continued to report issues into the afternoon. Technology expert Ritesh Kotak explained that a single bad update can trigger a chain reaction, causing widespread network failures that take time to resolve. Bell acknowledged the issue on social media and assured customers they were working to restore services as quickly as possible. The outage was primarily limited to Ontario and Quebec, with Bell Aliant in Atlantic Canada largely unaffected. Following a major Rogers outage in 2022, Canadian telecoms are now required to report significant outages within two hours and have agreed to cooperate during major disruptions. Bell’s incident highlights the ongoing challenges of maintaining reliable telecom infrastructure and the importance of transparent communication with customers during outages.

Source: CBC

Ransomware Attack Disrupts M&S Online Shopping for Months

Marks & Spencer (M&S) suspended online orders in late April 2025 following a major ransomware cyberattack that began over Easter, causing significant disruption to its operations. The attack compromised some customer data, including names, contact details, and order histories, but did not expose payment information or passwords. M&S has urged customers to be vigilant about potential phishing attempts and will prompt password resets as a precaution. The company announced it expects online shopping to resume gradually through June and July, with some disruption persisting during this period. The attack, orchestrated by the hacker group Scattered Spider using the DragonForce platform, exploited a third-party vendor through social engineering tactics.

The outage affected not only online sales—which account for about a third of M&S’s clothing and home business—but also led to empty shelves in stores and forced suppliers to revert to manual order processing. M&S estimates the incident will reduce annual profits by around £300 million, with the company’s share price dropping and over half a billion pounds wiped from its market value. While insurance may offset some losses, the impact has been severe for both M&S and its suppliers. The company is working to restore normal operations, but the attack highlights the vulnerability of major retailers to complex cyberthreats.

Source: BBC

Unprotected Database Reveals Millions of Login Credentials for Apple, Facebook, and More

A publicly accessible database containing 184,162,718 unique passwords and login credentials was discovered online, unprotected and unencrypted. This massive breach included sensitive account details for major platforms such as Apple, Facebook, Instagram, Snapchat, Roblox, and even government and financial services. The database, totaling 47.42 GB, was found by cybersecurity researcher Jeremiah Fowler, who noted the data likely originated from infostealer malware. Many of the exposed credentials were verified as current and valid, putting millions of individuals at risk.

The breach included not only social media accounts but also banking, healthcare, and government portals from multiple countries, increasing the potential for identity theft and fraud. The hosting provider restricted public access after being notified, but the database owner remains unknown and the purpose of the collection is still unclear. Experts warn that simply changing passwords is insufficient if devices are still infected with malware that can continue to steal new credentials.

Source: Forbes

When AI Replaces Artistry: Creative Workers Share Their Stories

The article from The Guardian explores the personal and professional impacts of AI-driven automation on creative workers around the world, sharing firsthand accounts from individuals in journalism, illustration, copywriting, voice acting, and graphic design. Mateusz Demski, a journalist and radio presenter from Kraków, Poland, lost his job when his station replaced human hosts with AI avatars, even using the likeness of deceased cultural icons, which sparked ethical debates and public outrage. Demski and others campaigned for regulation and successfully pressured the station to scrap the AI avatars, but he remains concerned about the lack of clear rules and the risks of misinformation and loss of authentic human experience in media.

Lina Meilina, an illustrator from Indonesia, describes how generative AI tools like Midjourney have drastically reduced her workload and income, as clients and even the government turn to AI-generated art instead of hiring human artists. She faces challenges with copyright infringement, as AI can easily replicate and slightly alter her work, making it difficult to prove ownership. The proliferation of AI art has led to job losses and wage reductions among her peers, forcing her to seek alternative sources of income such as making cosplay props.

Annabel Beales, a copywriter from Southampton, UK, recounts how her dream job writing for a garden centre was abruptly ended when her employer switched to using ChatGPT for content creation. Despite reassurances from management, she was let go just before Christmas, and now observes that the company’s website lacks the substance and passion that human writers provide. Beales expresses concern for younger generations as AI increasingly takes over creative roles, and she regrets not spending more time with her terminally ill mother instead of pursuing a career that was ultimately cut short by automation.

Richie Tavake, a voice actor from San Francisco, details how AI-generated voices have begun to replace human actors in audio dramas and video games. He discovered his own voice had been used by AI without his consent, raising issues of compensation and control over one’s likeness. Tavake highlights the importance of authentic representation, especially for diverse communities, and argues that AI cannot replicate the cultural background and emotional depth that skilled actors bring to their roles. He notes that unions like SAG-AFTRA are fighting for stronger protections against the misuse of AI in entertainment.

Jadun Sykes, a graphic designer from the UK, was made redundant after six years at his company when AI tools were adopted to automate much of his work. His experience resonated with many others in his field, as evidenced by the response to his viral YouTube video on the subject. Sykes has since shifted to a content creation role at another company that values human creativity and uses AI only as a supplementary tool. He advises fellow designers to diversify their skills to remain adaptable in a rapidly changing job market.

Source: The Guardian