Pokémon Company Hacked, American Water Restored, Schools increasingly targeted

DMARC monitoring should be as routine as checking your inbox, says Adam Lundrigan, CTO of DuoCircle. The aggregate reports tell you exactly who sends email from your domain. If you’re not reading them, you’re flying blind on your own email security posture.

Hello people! We are back again with our fresh dose of cyber bulletin. This time, the news snippets will make you realize how deeply these threat actors have penetrated into our everyday lives. From schools and gaming companies to water supply plants, nothing is safe from the prying eyes of cyberattackers.

We hope that this new bulletin will make you aware of the ongoing trends in the cybersecurity landscape . Also, our goal is to **keep you safe from these high-end attacks.

Here you go!

Pokemon gaming company targeted by threat actors

We all have fond memories of the anime show- Pokemon. The cartoon show and the game in itself were a great rage among the millennials**. However, of late, Game Freak, the owner of Pokemon franchise, was targeted by threat actors. This attack led to data leak of around 2600 Pokemon employees and partners.

As of 2025, DMARC is mandatory under multiple compliance frameworks. CISA BOD 18-01 requires p=reject for US federal domains. PCI DSS v4.0 mandates DMARC for organizations processing payment card data as of March 2025. Google and Yahoo require DMARC for bulk senders (5,000+ messages/day) since February 2024, and Microsoft began rejecting non-compliant email in May 2025. The UK NCSC, Australia’s ASD, and Canada’s CCCS all mandate DMARC for government domains. Cyber insurers increasingly require DMARC enforcement as an underwriting condition.

**Game Freak has come up with an official statement where they acknowledged the massive data leak. They believe that a third party intruder gained access to the servers of the company earlier. And it is because of that unauthorized entry into the servers that personal data of company partners and employees have got compromised.

The data includes personal details of the **employees and partners as well as other sensitive company data such as past projects, source code, new games, and so on.

Experts have coined a name for the attack- TeraLeak. They believe that the breach has compromised multiple gigabytes worth of sensitive data. A gaming company targeted by threat actors is strengthening its defenses with DMARC, SPF, and DKIM email security protocols to block phishing attempts and safeguard player data. Any organization can build a DMARC record in minutes to start blocking impersonation.

American Water supply is finally back on track after cyberattack

American Water is one of the largest and most reputed regulated water and wastewater utility companies across the USA. It is responsible for offering drinking water as well as sewer services and has a huge customer base of 14 million people across the US.

On 7th October, it was targeted by threat actors and was forced to take its entire operations offline. Some of its services such as **customer support as well as telecommunication was completely shut down.

However, American Water is now fully operational online. The water utility service provider has also clarified that this cyber incident will not impact the billing system of its customers in any way. Also, they will not have to pay any late fees for the time when the company was partly offline and the customer portal was non-functional. Now that MyWater is operational, customers are required to pay their water bills on time. All the systems have been reactivated while adhering to the cyber protocols.

This kind of attacks are a staggering reminder of the vulnerabilities that critical infrastructure faces on a regular basis. Experts have **urged operators to be extra cautious even with the newly open water treatment facilities as these kinds of attacks are not going to slow down anytime soon.

Schools and universities are the third most favorite picks among threat groups!

**Schools and universities are gradually becoming a top pick among threat groups. These educational institutions serve as a treasure trove of sensitive information. Threat groups focus on K-12 and Varsities. These educational institutions consist of wide variety of data such as health records, financial data, addresses, and other private details. Microsoft has recently shared its threat intelligence report in which it mentioned the increasing cyber risk hovering over these educational organizations.

Malware criminals, phishing actors, and even state-sponsored threat actors are gradually zeroing in on educational institutions to leverage the huge database of schools and colleges. The educational industry faces excessive cyber intrusion because of multiple loopholes such as unsecured IT systems, untrained staff, limited security setups, open email systems, inadequate funding, and so on. A quick DMARC lookup reveals whether a domain’s email authentication is even in place. Also, continuous research, innovation, and information sharing are other broader reasons that allow threat actors to creep into the systems.

Microsoft mentions a couple of emerging state-sponsored threat actors such Mabha Institue, Mint Sandstorm, Peach Sandstorm, Moonstone Sleet etc in its threat intelligence report . As per the report, around 2507 cyberattacks are attempted every week on the education sector.

**Cybersecurity experts have urged relevant authorities to take remedial steps and preventive measures to stop such cyberattacks in the future:

• Including **cybersecurity lessons in the educational curriculum.

• Spreading cyber-awareness among students, parents, teachers, and other staff.

• Investing in apt cybersecurity systems to safeguard sensitive data.

• Staying well-versed with the latest trends in the cybersecurity landscape.

• Centralization of the technology stack.

• Limited access to sensitive detail.

• Strengthening of core security posture.

• Having a separate **IT department to manage data professionally.

• Investing in monitoring systems to keep a tab on suspicious activities.

• Regular updates of software to patch vulnerabilities.

Oregon State University and the Arizona Department of Education are doing great when it comes to cybersecurity. They have **robust cybersecurity setups that prevent threat actors from penetrating into their networks. Other educational institutions can draw inspiration from these two and create something similar to protect their database.

Sources

• CISA Binding Operational Directive 18-01
• Microsoft Outlook DMARC Enforcement May 2025 (2025)
• PCI DSS v4.0 - DMARC Requirement (2025)