Data Breach Ledger
A breach isn't a place on a map. Its victims are everywhere its customers are. So this is a ledger, not a map: every breach we can source that spilled personal records. The focus is on what's newest, but it reaches back years, because a Social Security number stolen in 2017 or a passport leaked in 2018 still works against you today. Led by the number that matters most, tagged by exactly what leaked. The throughline: as age-verification and KYC laws force more people to upload driver's licenses and passports, those are the very documents turning up in the spills.
people's records exposed in 2026
across 161 breaches disclosed in 2026
records exposed, all time
summed across every tracked breach. Most people appear in more than one
breaches in the ledger
tracked back to 2007, and still counting
exposed driver's licenses or passports
the same IDs age-verification laws demand
Been caught in a breach? Jump to what to do ↓
Records exposed each year across the breaches in this ledger. A single mega-breach can tower over an entire year, and people caught in more than one are counted each time.
Sum of disclosed victim counts per year across tracked breaches; breaches with an undisclosed scale aren't included, and people hit by more than one breach are counted each time. 2026 is only a partial year. Bar color runs yellow for lighter years through orange to red for the worst on record.
Each cell is a month. Darker means more breaches disclosed. Tap a month to filter the ledger to it.
How often each kind of personal data turned up across the 301 breaches.
The newest breaches on the ledger and the latest reporting on exposed personal data.
40,000 people. PERSONNEL RECORDS ON MORE THAN 40,000 DEPARTMENT OF HOMELAND SECURITY EMPLOYEES WERE PUBLISHED ONLINE ON OCT 28, 2026 BY A HACKER USING THE NAME DEPARTMENT OF PEACE, TECHCRUNCH AND REUTERS REPORTED.
340,915 people. BLUEBERRY PEDIATRICS TOLD THE OREGON ATTORNEY GENERAL THAT 340,915 PEOPLE WERE AFFECTED BY TWO HACKS THROUGH A CRITICAL METABASE VULNERABILITY, HIPAA JOURNAL REPORTED OCT 28, 2026.
AUSTRALIAN BOOKING-SOFTWARE COMPANY RMS CLOUD CONFIRMED IN LATE OCTOBER 2026 THAT GUEST NAMES, CONTACT DETAILS AND BOOKING INFORMATION WERE STOLEN, AFTER GUESTS OF HOTELS AND HOLIDAY PARKS RECEIVED SCAM MESSAGES QUOTING...
GMO INTERNET SAID ON OCT 27, 2026 THAT A SUSPECTED ATTACKER HAD POSTED INFORMATION APPEARING TO BELONG TO THE COMPANY AND CUSTOMERS OF ITS ONAMAE DESKTOP CLOUD SERVICE, WHICH PROVIDES VIRTUAL DESKTOPS TO FINANCIAL...
2,585,481 people. SONY NETWORK COMMUNICATIONS SAID ON OCT 27, 2026 THAT RECORDS ON MORE THAN 2.58 MILLION CURRENT AND FORMER SO-NET AND PLALA INTERNET CUSTOMERS LEAKED AFTER UNAUTHORIZED ACCESS TO A SERVER.
Austin ISD staff personal information compromised in data breach KVUE
Oshkosh utility customers warned of data breach WBAY
Johns Hopkins Bayview warns patients of data breach involving more than 3,100 people CBS News
238,083 people. DENVER HEALTH MEDICAL PLAN DISCLOSED IN OCT 2026 THAT 238,083 CURRENT AND FORMER MEMBERS' DATA WAS EXPOSED THROUGH ITS AI ANALYTICS VENDOR SQUAREML.
Conduent’s massive data breach leads to proposed $80 million class action settlement Top Class Actions
6,230,000 people. OSAKA ELECTRONICS RETAILER JOSHIN SAID ON OCT 26, 2026 THAT UP TO ABOUT 6.23 MILLION MEMBER RECORDS MAY HAVE LEAKED AFTER UNAUTHORIZED ACCESS TO PART OF ITS NETWORK.
51,620,000 people. EMAIL-DELIVERY SERVICE PROVIDER YUMIL LINK SAID ON OCT 26, 2026 THAT A CUMULATIVE 51.62 MILLION PERSONAL RECORDS MAY HAVE LEAKED IN AN UNAUTHORIZED-ACCESS INCIDENT, UP FROM ABOUT 9 MILLION ESTIMATED...
The biggest breaches in the ledger by people affected. Many are years old, and still fuel identity theft today, because a stolen SSN, passport, or fingerprint can't be reset.
Every tracked breach, grouped by year, newest first. Open a year to read its breaches, or narrow the list and matches open on their own.
40K+ CBP, ICE and CISA staff records published by hacker, Okta data claimed
PERSONNEL RECORDS ON MORE THAN 40,000 DEPARTMENT OF HOMELAND SECURITY EMPLOYEES WERE PUBLISHED ONLINE ON OCT 28, 2026 BY A HACKER USING THE NAME DEPARTMENT OF PEACE, TECHCRUNCH AND REUTERS REPORTED. The hacker gave the data to journalist maia arson crimew, who passed a copy to Distributed Denial of Secrets. The records hold names, job titles, work email addresses, cell phone numbers and office locations, plus Active Directory group memberships showing which internal systems each user could reach, and appear from timestamps to have been taken around mid-August 2026. TechCrunch's count by component: about 21,000 Customs and Border Protection records, about 10,000 from ICE and Homeland Security Investigations, just under 1,000 from CISA, and thousands more from DHS headquarters, USCIS and the Federal Protective Service -- roughly a fifth of DHS's 220,000 staff. Group names reference the surveillance vendor Penlink (one group with more than 2,000 HSI users), CBP's Mobile Fortify facial-recognition app (more than 200 users), and Salt Typhoon and Volt Typhoon investigations. The hacker says the data came from the Okta single sign-on system DHS uses; Okta says it has no evidence its systems or data were compromised. TechCrunch verified part of the dataset against known DHS employees and Reuters matched six employees' details against credit bureau records; DHS did not comment and had not disclosed the breach. The same hacker claimed thousands of DHS contracts in March 2026. NOT ESTABLISHED: how the data was actually obtained, whether the vulnerability is fixed, the exact count, and whether employees will be notified.
Sources techcrunch.com →gbhackers.com →
340,915 children's telehealth records taken through Metabase flaw at the provider and its pharmacy vendor Photon
BLUEBERRY PEDIATRICS TOLD THE OREGON ATTORNEY GENERAL THAT 340,915 PEOPLE WERE AFFECTED BY TWO HACKS THROUGH A CRITICAL METABASE VULNERABILITY, HIPAA JOURNAL REPORTED OCT 28, 2026. The pediatric telemedicine company learned on Aug 22, 2026 that an attacker had exploited the flaw in the Metabase business-intelligence platform to obtain patient data, and on Aug 24 its prescription vendor Photon said a different attacker had exploited the same flaw against Photon and taken a subset of the same information. Blueberry says it patched within hours of Metabase's alert but the attacker already had access; it blocked the access and changed passwords. The Blueberry data covers names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes and charges; the Photon data covers names, addresses, phone numbers, emails, member IDs and medication information. Photos and videos, financial data and SSNs were not involved. Texas received two filings covering 60,581 and 7,249 residents; the incident was not yet on the HHS portal. NOT ESTABLISHED: when the intrusions began, the letter date, which report matches which incident, and whether the data has been published; some families will receive two notices.
Sources hipaajournal.com →
hotel and holiday-park booking vendor hacked; guests phished with real booking numbers
AUSTRALIAN BOOKING-SOFTWARE COMPANY RMS CLOUD CONFIRMED IN LATE OCTOBER 2026 THAT GUEST NAMES, CONTACT DETAILS AND BOOKING INFORMATION WERE STOLEN, AFTER GUESTS OF HOTELS AND HOLIDAY PARKS RECEIVED SCAM MESSAGES QUOTING THEIR REAL BOOKING NUMBERS, ROOM TYPES AND DATES. ABC reported holiday-park operators warning guests on Oct 27 and Tasmanian hotels on Oct 29, including Federal Group's Wrest Point Casino and Country Club, ALH Hotels' Nightcap and Nightelier, and Discovery Parks' Cradle Mountain resort; BIG4, Reflections and G'day Parks were understood to be affected but had not confirmed. The phishing emails, texts and WhatsApp messages claimed the guest's card had been blocked and asked them to re-enter card details or lose the booking. RMS, which says more than 6,000 properties worldwide use its system, says credit card and payment data were not accessed and that it is investigating with forensic specialists; CEO Adam Seskis apologised. NOT ESTABLISHED: how many guests are affected, when the hack occurred, how the attacker got in, which other properties are involved, and whether the Office of the Australian Information Commissioner was notified.
Sources abc.net.au →
hackers post data from Onamae Desktop Cloud trading-desktop service after $50M ransom demand
GMO INTERNET SAID ON OCT 27, 2026 THAT A SUSPECTED ATTACKER HAD POSTED INFORMATION APPEARING TO BELONG TO THE COMPANY AND CUSTOMERS OF ITS ONAMAE DESKTOP CLOUD SERVICE, WHICH PROVIDES VIRTUAL DESKTOPS TO FINANCIAL TRADERS. The company shut the service on Oct 21 after finding unauthorized access and received an email demanding about 8 billion yen (about 50 million dollars); it reported to police and posted an update on Oct 22, offered compensation and alternative service and sought government help on Oct 24, and began collecting customers' devices for malware checks on Oct 25-26. GMO said up to 27,000 servers may be affected and told customers to reset passwords after reports of unauthorized operations on trading accounts. GMO's security unit has separately reported the Chinese AI penetration tool Artex being used against Japanese companies, but has not linked it to this incident. NOT ESTABLISHED: how many customers are affected, which data fields were posted, whether the posted data is genuine, who was responsible, and whether the Personal Information Protection Commission was notified.
Sources techcrunch.com →
2.58M ISP members' names, birth dates and phones leaked; 54K email passwords
SONY NETWORK COMMUNICATIONS SAID ON OCT 27, 2026 THAT RECORDS ON MORE THAN 2.58 MILLION CURRENT AND FORMER SO-NET AND PLALA INTERNET CUSTOMERS LEAKED AFTER UNAUTHORIZED ACCESS TO A SERVER. The intrusion happened on Oct 19, was confirmed on Oct 23 and the data leak was established on Oct 24. The leak covers 2,141,986 So-net member records (1,869,771 current members and 272,215 who left in or after March 2026) and 443,495 plala S Course records (21,130 of them former members) holding names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs but no passwords; 54,401 email addresses with passwords on the free Mail Service (G), A-Box, So-net VAIO Mail and PostPet mail services; 16 bank records with bank, branch, account type, account number and holder name; and data from seven password-reset notices. Credit card data, NURO customers and people who cancelled by the end of February 2026 are not affected. The company stopped the server, cut off the attacker's route, reset the exposed email passwords on Oct 27, is contacting customers individually, opened a dedicated phone line and reported to the Personal Information Protection Commission; it says no secondary damage has been confirmed. NOT ESTABLISHED: how the attacker got in, who was responsible, and whether the leaked data has appeared for sale.
Sources helpnetsecurity.com →
238,083 members' health data reachable for a year through AI vendor's posted key
DENVER HEALTH MEDICAL PLAN DISCLOSED IN OCT 2026 THAT 238,083 CURRENT AND FORMER MEMBERS' DATA WAS EXPOSED THROUGH ITS AI ANALYTICS VENDOR SQUAREML. A SquareML access key was inadvertently posted to a public website on Jun 27, 2025 and stayed there more than a year; the plan was told on Aug 14, 2026 and the key was deactivated on Aug 18. The non-profit plan, affiliated with the Denver Health and Hospital Authority, says the key was read-only so data could not be downloaded, exported, deleted or altered, and no misuse has been found. Exposed data includes full names, city, state and ZIP, demographics, dates of birth, plan eligibility, provider names, admission, discharge and transfer records, and health metrics such as BMI, HbA1c and eGFR; SSNs and financial data were not involved. Letters have been mailed. NOT ESTABLISHED: whether anyone used the key, the HHS report date, and the letter date.
Sources hipaajournal.com →
up to 6.23M electronics-chain members' names, addresses and phones exposed; licence and My Number images among them
OSAKA ELECTRONICS RETAILER JOSHIN SAID ON OCT 26, 2026 THAT UP TO ABOUT 6.23 MILLION MEMBER RECORDS MAY HAVE LEAKED AFTER UNAUTHORIZED ACCESS TO PART OF ITS NETWORK. Joshin found an anomaly on Oct 16, confirmed unauthorized access, isolated the servers and published a first notice about a system failure on Oct 17; the second report on Oct 26 put the exposure at up to about 6 million member-database records (name, address, phone number, member number), about 230,000 Joshin subscription records (member number, phone, handwritten signature, login ID and initial password, billing history, contract number, device ID, activation code) and about 800 records in a renovation photo-upload system including two driver's licence images, one My Number card image, five bank account numbers and construction photos. Joshin says it holds no credit card data, has contacted the renovation customers individually, is warning members about phishing by email, SMS and phone, and is still investigating with outside specialists whether data was actually taken; some services remain suspended. NOT ESTABLISHED: the attack method, whether exfiltration is confirmed, who was responsible, and whether regulators were notified.
email-delivery contractor's leak grows to 51.62M registered addresses
EMAIL-DELIVERY SERVICE PROVIDER YUMIL LINK SAID ON OCT 26, 2026 THAT A CUMULATIVE 51.62 MILLION PERSONAL RECORDS MAY HAVE LEAKED IN AN UNAUTHORIZED-ACCESS INCIDENT, UP FROM ABOUT 9 MILLION ESTIMATED ON OCT 19. The Hankyu Hanshin Holdings group company, which sends bulk email for corporate clients, detected the access on Oct 16 and found further leaks while analysing malicious programs on its systems; the count may still rise. At minimum the data is the email addresses of users registered with client companies; whether names or postal addresses are included was still being confirmed. The cumulative figure counts the same person once per client list, so the number of individuals is lower. NOT ESTABLISHED: which client companies' lists were taken, the attack method, who was responsible, whether the Personal Information Protection Commission was notified, and how many distinct people are affected.
Sources itmedia.co.jp →kumanichi.com →
1.13M Mos Card prepaid numbers, PINs and balances leaked via contractor
MOS FOOD SERVICES, OPERATOR OF THE MOS BURGER CHAIN, ANNOUNCED ON OCT 23, 2026 THAT 1,133,070 MOS CARD RECORDS LEAKED FROM A SERVER RUN BY ITS CONTRACTOR VALUE DESIGN. Suspicious access and failed logins were detected between Oct 14 and 18 and the leak was confirmed on Oct 19; Value Design's parent Paycloud Holdings said a web-server vulnerability in a subsidiary environment was exploited and put the group-wide Value Card leak at 1,424,748 records. The leaked fields are the 16-digit prepaid card number, the 6-digit PIN and the balance; Mos says names, addresses and credit card data were not included. Of about 3.8 million cards issued, roughly 570,000 are in circulation and 560,000 unissued. Mos forced a PIN change on all affected card numbers, said it had received no reports of misuse as of the announcement, and plans tighter API access controls, password rules and IP restrictions on admin accounts; Paycloud says it will recheck all services with an outside firm and share information with client companies and authorities. NOT ESTABLISHED: whether any balances were spent fraudulently, whether email addresses or phone numbers tied to registered cards were exposed, and whether the Personal Information Protection Commission was notified.
patient health records taken from Quanum LSM ordering system used by 500K clinicians
QUEST DIAGNOSTICS TOLD THE SEC ON OCT 22, 2026 THAT AN UNAUTHORIZED PARTY ACCESSED PATIENT RECORDS IN ITS QUANUM LSM SYSTEM, AND CONFIRMED ON OCT 23 THAT PROTECTED HEALTH INFORMATION WAS TAKEN. The 8-K, filed under Item 8.01 rather than Item 1.05, says the company learned of the access on Oct 21, 2026. Quanum Lab Services Manager is the system certain clients use to place test orders and look up results; Quest says it is used by about half a million clinicians in thousands of locations across North America. Quest temporarily paused access to it, with clients ordering by fax, paper, LIS interface or EMR in the meantime, activated incident response, contained the activity, notified federal law enforcement and hired outside experts, and says operations and patient service were not materially disrupted. A security notice on Quest's site, marked to be hidden from search engines, says personal information and patient records were taken but does not list the fields; a spokesperson referred TechCrunch to the notice. The Secaucus, New Jersey company's 2018-2019 breach through collections vendor AMCA affected about 11.9 million patients. No group had claimed the attack as of Oct 23. NOT ESTABLISHED: how many patients, which data fields, how long the access lasted, how the attacker got in, and who was responsible.
11.77M CAPCOM ID accounts' emails and login metadata leaked
CAPCOM SAID ON OCT 22, 2026 THAT 11,774,247 CAPCOM ID ACCOUNTS WORLDWIDE WERE EXPOSED AFTER A THIRD PARTY ACCESSED THE SERVICE. Capcom found traces of unauthorized access on Oct 19 and blocked it, confirmed the leak and unauthorized password changes on Oct 20, reported to police and the Personal Information Protection Commission on Oct 21 and published the advisory on Oct 22. The leaked fields for all affected accounts are email address plus account creation date, last login date, login count and the IP address at last login; 43 accounts also had date of birth, gender, nickname and country or region exposed. Attackers changed the passwords on 196 accounts to lock out their owners, which Capcom reset. A second report on Oct 23 said that for 19 of those 196 accounts, all Japanese, the intruder opened the e-Capcom store member page and took the name and katakana name, phone number, postal code and address, gender, date of birth, purchase history, inquiry history and address book. User-set passwords and credit card data were not leaked. Capcom says it identified and closed the attack method, is contacting affected users in sequence, keeps a dedicated inquiry desk in Japan and is warning of phishing. NOT ESTABLISHED: the attack method, who was responsible, and whether the data has appeared for sale.
Sources techradar.com →automaton-media.com →gamebusiness.jp →
125K officers' data at 22 prefectural forces exposed via disaster-alert vendor Arcadia
JAPAN'S NATIONAL POLICE AGENCY SAID ON OCT 21, 2026 THAT DATA ON ABOUT 125,000 POLICE OFFICERS AND STAFF MAY HAVE BEEN COMPROMISED IN A HACK OF CLOUD VENDOR ARCADIA INC. Twenty prefectural forces, including Aichi, Hyogo and Hiroshima, use Arcadia's disaster safety-confirmation service to check on employees; records hold names and email addresses, and at Tochigi and Saitama each person's division. Four other prefectures, including Shimane and Yamaguchi, use a separate Arcadia service to send crime-prevention and security alerts, exposing names and email addresses of about 16,000 residents and 2,600 companies; Kyodo put the total at 22 prefectural forces. Tochigi police said Arcadia notified them on Oct 13 and they stopped using the system that day. Arcadia, based in Minoh, Osaka, also runs the SpeeCAN RAIDEN disaster mass-messaging service for municipalities; Okinawa municipalities including Miyako (802 subscriber addresses), Itoman and Urasoe reported their alert lists may have leaked in the same incident. The NPA said no investigative information had been confirmed leaked and that it was still establishing the facts; Arcadia and police warned recipients about suspicious emails. NOT ESTABLISHED: when the unauthorized access happened, how it was done, whether data was taken or misused, and the full list of affected forces and municipalities.
970K Medi-Cal members' data accessed, notice 11 months late
PARADIGM HEALTHCARE SERVICES REPORTED A BREACH OF MORE THAN 970,000 MEDI-CAL MEMBERS TO HHS, SECURITYWEEK REPORTED OCT 20, 2026. The San Francisco billing contractor, which processes Medi-Cal claims for the California Department of Health Care Services, found unauthorized access to its local network on Oct 13, 2025; the access window was Oct 8 to 15, 2025. It concluded on Aug 18, 2026 that files with protected health information may have been accessed, and notification letters are dated Sep 14, 2026, about 11 months after detection. Data includes names, dates of birth, gender and Medi-Cal member ID numbers. Paradigm says its Student Health Network billing platform was not affected and reports no evidence of fraud. NOT ESTABLISHED: how the attackers got in, whether data was exfiltrated, and who was responsible; no group has claimed the attack.
Sources securityweek.com →
4.45M donation-portal members' names, addresses, hashed passwords and tax estimates leaked
TRUSTBANK, OPERATOR OF THE FURUSATO CHOICE HOMETOWN-TAX DONATION PORTAL, SAID ON OCT 20, 2026 THAT 4,454,097 MEMBER RECORDS LEAKED AFTER UNAUTHORIZED ACCESS ON OCT 17. The company noticed unusual access patterns on Oct 19, confirmed the intrusion and the leak the same day and suspended the related services at 15:50 with no restart date. The six fields taken are name, email address, postal address, phone number, hashed password and the member's estimated donation tax deduction. Trustbank notified the Personal Information Protection Commission on Oct 20, planned a police report for Oct 21, is investigating with outside experts, warned members to change reused passwords and to ignore messages impersonating the company, and says the count and fields may change. NOT ESTABLISHED: the vulnerability used, who was responsible, whether the hashed passwords are crackable, and when the services resume.
8.18M cardiac-monitoring patients' records stolen in June social-engineering hack
IRHYTHM REPORTED 8,179,772 PEOPLE AFFECTED TO THE OREGON ATTORNEY GENERAL, HIPAA JOURNAL REPORTED OCT 19, 2026, A COUNT CLOSE TO THE SAN FRANCISCO CARDIAC-MONITORING COMPANY'S ENTIRE PATIENT BASE OF ABOUT 8 MILLION. The company identified unauthorized access to business applications hosted on a third-party platform on Jun 8, 2026; a threat actor contacted it on Jun 9 claiming to have taken proprietary and patient data and demanding payment, and iRhythm filed an 8-K on Jun 18 calling the incident material. The June 8-K said the attackers used social engineering between Jun 3 and Jun 8. Stolen data includes names, addresses, phone numbers, email addresses, patient account numbers, device serial numbers, insurance numbers, dates of birth and dates of service. Notification letters began Oct 9, 2026; earlier state filings showed 298,647 Texas and 69,526 South Carolina residents, and the company had declined to give a national total. iRhythm says products, clinical systems and patient safety were not affected, that it holds cyber insurance, and that it knows of no misuse. NOT ESTABLISHED: who was behind the extortion attempt, whether a ransom was paid, and the HHS OCR posting date.
Sources hipaajournal.com →securityweek.com →therecord.media →
1.83M records exposed via stolen cloud credentials, third breach in a month
NIKKEI DISCLOSED IN MID-OCTOBER 2026 THAT 1.83 MILLION PERSONAL INFORMATION RECORDS WERE EXPOSED AFTER HACKERS USED STOLEN CREDENTIALS TO REACH A DEVELOPMENT SYSTEM. The intrusion began in the early hours of Oct 7, 2026 and exposed data stored in the cloud. About 150,000 records held at least one identifier -- full name, email address, physical address, phone number or date of birth -- with email addresses in 120,000 of them; the other 1.68 million records had no identifying data. No credit card data was involved. Nikkei notified Japan's Personal Information Protection Commission on Oct 11 and revoked the credentials. It is the publisher's third incident since late July 2026, after an employee's Google Workspace account was compromised in July and a Microsoft 365 account was hijacked for spear-phishing in September. NOT ESTABLISHED: how the credentials were stolen, who was responsible, and the exact date of Nikkei's public notice.
23M people's records with partial card numbers taken from e-commerce platform
JAPANESE E-COMMERCE PLATFORM OPERATOR ESTORE REPORTED A BREACH OF RECORDS ON ABOUT 23 MILLION PEOPLE, INCLUDING ONLINE SHOP OPERATORS AND THEIR CUSTOMERS, AS REPORTED OCT 19, 2026. The breach was discovered in August 2026. Exposed data includes names, addresses, telephone numbers and portions of credit card numbers; the affected server did not store full card numbers. NOT ESTABLISHED: how the attackers got in, the exact discovery and disclosure dates, how many of the 23 million are end customers versus merchants, and the notification status.
Sources qatar-tribune.com →
1.26M H2O ID members' names, birth dates and contacts leaked via booking site
H2O RETAILING SAID ON OCT 19, 2026 THAT ABOUT 1.26 MILLION H2O ID MEMBER RECORDS LEAKED FROM A CUSTOMER MANAGEMENT SYSTEM REACHED THROUGH ITS HANKYU AND HANSHIN DEPARTMENT STORE BOOKING SITE. Unauthorized access was confirmed on Oct 16, when the company blocked the traffic and shut the booking site; on Oct 17 it found access to the HANKYU HANSHIN E-STORES and Remo Order online shops and shut them too; on Oct 19 it confirmed the leak, which it says covers nearly all H2O ID members (the shared login for the group's stores, more than 1 million members at the end of August). Leaked fields are H2O ID, name in kanji and kana, gender, email address, postal code and address, mobile and landline numbers, age, date of birth and services used; the online shops also held order history, partial card data (brand, last four digits, name, expiry), partial point-card data and address books, and whether those leaked was still under investigation. No full card numbers or login passwords were held or found leaked. The company reported to the Personal Information Protection Commission and police, is emailing members, opened a toll-free line and warned of phishing; the sites stay closed until the vulnerability is fixed. NOT ESTABLISHED: the vulnerability, who was responsible, whether the shop data was taken, and any misuse.
up to 540K internet-provider customers' names, addresses and phones may have leaked
TOKYO INTERNET PROVIDER NIFTY SAID ON OCT 19, 2026 THAT UP TO 540,000 RECORDS INCLUDING NAMES, ADDRESSES AND PHONE NUMBERS MAY HAVE LEAKED AFTER UNAUTHORIZED ACCESS TO ITS SYSTEM. Kyodo reported the announcement alongside same-day disclosures by H2O Retailing, Yumil Link, Joshin and Trustbank during a wave of intrusions at Japanese companies in October 2026. NOT ESTABLISHED: when the access happened, how it was done, which Nifty service was hit, whether email addresses or payment data were included, whether theft is confirmed, and the notification status.
Sources kumanichi.com →
339,055 cosmetics customers' birth dates and contacts taken from vendor Retail Express over seven months
SYDNEY COSMETICS BRAND NAPOLEON PERDIS TOLD CUSTOMERS IN OCTOBER 2026 THAT ABOUT 339,055 CUSTOMER RECORDS WERE ACCESSED IN A CYBERATTACK ON ITS THIRD-PARTY DATA PROVIDER RETAIL EXPRESS, ABC REPORTED OCT 17, 2026. The unauthorized access ran from November 2025 to June 2026; Retail Express told the company in June and confirmed the scope in August. The data covers names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories of customers from before June 2025; the system held no bank or card details or online-store passwords. The company says the incident is contained, the affected system has been permanently shut down, the Office of the Australian Information Commissioner has been notified, and customers should watch for scam calls and emails. NOT ESTABLISHED: who was responsible, why notification took four months after confirmation, and whether other Retail Express clients were hit.
Sources abc.net.au →
records of about 7M students, including disability status, copied over four months; class action filed
THE CALIFORNIA DEPARTMENT OF EDUCATION ANNOUNCED ON OCT 16, 2026 THAT ITS TESTING CONTRACTOR ETS HAD STUDENT RECORDS COPIED FROM A SECURE FILE-TRANSFER SITE BETWEEN MAY 22 AND SEP 18, 2026. An unauthorized party used a compromised login credential to reach the ETS-run SFTP site that exchanges CAASPP and ELPAC statewide assessment data with the state; ETS identified the activity on Sep 25, told CDE on Sep 26, disabled the account, took the site offline and built a new one. The data covers all students enrolled in California public schools in the three previous school years plus former students who left since 2006 without a confirmed transfer; the state has not given a count, 2025-26 enrollment exceeded 5.7 million, and the lawyers who filed a proposed class action put it at about 7 million current and former students -- that figure is the plaintiffs' estimate, not the state's. Fields, varying by student, include name, date of birth, home address, school, district, grade, statewide and local student IDs, gender, race or ethnicity, primary language, country of origin, English-learner status, disability and Section 504 status, primary disability type, testing accommodations, Title I, McKinney-Vento and military-connected eligibility, and assessment results. SSNs, licence or passport numbers, financial data, passwords and parent data were not involved. Notices in 27 languages began Oct 16 and run into November, with two years of Experian IdentityWorks monitoring (enrollment deadline Mar 19, 2027). Chamberlain v. ETS, filed Oct 20, 2026 by Cotchett, Pitre & McCarthy for two minors aged 10 and 12 and a 2026 graduate, alleges negligence, breach of contract, invasion of privacy and Unfair Competition Law violations and seeks damages and security changes; CDE and the State Board of Education are reviewing ETS's compliance with its contract, with the California Cybersecurity Integration Center, Department of Technology and Office of Emergency Services involved. ETS paused some enrollment processing and testing while it checks system security and says monitoring has found no data made public. NOT ESTABLISHED: the official number of students, how the credential was compromised, who was responsible, and whether any data has been published.
Sources cde.ca.gov →cde.ca.gov →cybernews.com →therecord.media →
22.52M software customers' names, addresses, birth dates and passwords pulled through member API
SOFTWARE VENDOR SOURCENEXT SAID ON OCT 15, 2026 THAT UP TO 22,519,960 CUSTOMER RECORDS MAY HAVE BEEN TAKEN FROM ITS MEMBER INFORMATION SYSTEM. An attacker misused the member-information retrieval API from about 10:00 on Oct 9 until the company confirmed the access about 09:00 on Oct 13 and completed containment at 13:36 that day. Fields possibly exposed, varying by registrant, are email address, password, name, katakana name, address, gender, phone, fax, date of birth, company name, job title, department, subscribed services and registration and login dates; the company says card data is not stored in that system. Sourcenext reported to the Personal Information Protection Commission on Oct 15, planned a police report for Oct 16, is forcing password resets at next login, hired an outside forensic firm and warned of phishing; its login site and support line were overloaded on Oct 16. NOT ESTABLISHED: the root cause and attack method, whether passwords were hashed, whether former members are included, who was responsible, and whether the data has been misused.
11.18M app members' names, birth dates, emails and phones leaked
BK JAPAN, WHICH RUNS BURGER KING IN JAPAN, SAID ON OCT 15, 2026 THAT ABOUT 11.18 MILLION MEMBER RECORDS LEAKED FROM ITS OFFICIAL APP. A third party gained unauthorized access to the member information system between Oct 2 and Oct 7, 2026; the company confirmed the leak on Oct 13 and blocked the source. Leaked fields are member ID, email address, registration type, prefecture, gender, date of birth, name in kanji and katakana, phone number, whether the member has mobile-order history and whether email authentication was completed. The company says it holds no card numbers and has confirmed no leak of login passwords or misuse of the data, is working with outside experts, and warned members about emails, SMS and calls impersonating Burger King. NOT ESTABLISHED: how the attacker got in, whether a vendor system was involved, who was responsible, and whether the records represent as many distinct people.
Sources watch.impress.co.jp →
pathology group hacked; attacker claims 80M patient records
SOUTH AFRICAN PATHOLOGY GROUP AMPATH TOLD PATIENTS ON OCT 13, 2026 THAT A CYBERATTACK DETECTED ON OCT 2 MAY HAVE EXPOSED THEIR PERSONAL DATA. Ampath's notice lists names, South African ID numbers, dates of birth, contact details, medical aid membership details and payment-related information such as payer names, amounts and transaction times as possibly accessed and exfiltrated; it says there is no evidence that medical records, diagnoses, pathology test results or banking details were taken. The ByteToBreach group claimed on a forum that it copied 10 of about 375 databases, including HR, patient and financial data, and that an admissions table held more than 80 million records. Ampath says that figure refers to database rows, not people, since one patient generates many records over time, and calls the claim unverified. It notified the Information Regulator, restored systems from clean backups and hired forensic investigators. NOT ESTABLISHED: the number of people affected, whether a ransom was demanded, and whether any data has been published.
14.64M travel customers' names, birth dates and contacts taken Oct 2-4; 4.13M hashed passwords
ADVENTURE INC., OPERATOR OF THE SKYTICKET TRAVEL BOOKING SITE, SAID ON OCT 9, 2026 THAT ABOUT 14.64 MILLION CUSTOMER RECORDS WERE EXPOSED TO UNAUTHORIZED ACCESS TO ITS SYSTEM BETWEEN OCT 2 AND OCT 4, 2026. The records hold names including passport-style romanised spellings, dates of birth, email addresses, phone numbers and addresses; about 4.13 million also include hashed login passwords. The company says passport numbers were confirmed not leaked. Adventure disclosed two further incidents at the same time: on Sep 20 an attack on a vulnerability in a business-management system exposed or may have exposed 17,780 customer records including names, phone numbers and bank account details used for refunds, and from Aug 3 to Oct 1 bus-reservation confirmation pages viewable without login were scraped mechanically, exposing about 12,000 reservations; it says it stores no card numbers or passport images. Earlier reports had grouped Skyticket with downstream victims of the Oct 7 IDC Frontier cloud ransomware attack; the company's own account describes a direct intrusion. NOT ESTABLISHED: the attack method, whether the count refers to people or records, who was responsible, whether the hashed passwords are crackable, and the notification status.
employee account phished by impostor; customer names and contacts taken, app push alerts hijacked
ASOS CONFIRMED ON OCT 8, 2026 THAT AN ATTACKER WHO IMPERSONATED A TRUSTED CONTACT OBTAINED AN EMPLOYEE'S LOGIN CREDENTIALS AND USED THEM TO REACH CUSTOMER DATA ON THIRD-PARTY PLATFORMS THE RETAILER USES. On Oct 6 customers received push notifications through the ASOS app from a group calling itself Xuanye Group claiming customer data had been stolen and telling staff to contact it on Telegram. ASOS says the exposed data is full names, contact details and some non-personal account information, that payment card data and passwords were not accessed, that it locked down the platforms and is working with external experts, law enforcement and regulators, and that customers need take no action beyond watching for impersonation. This is separate from the July 2026 credential-stuffing incident reported to US regulators in August. NOT ESTABLISHED: the number of customers affected (ASOS gave BleepingComputer no figure), which countries, which third-party platforms, and whether the UK ICO was formally notified.
Sources bleepingcomputer.com →
2.16M Lawson ID members' names and emails taken; app reservations with partial card numbers also hit
CONVENIENCE-STORE CHAIN LAWSON SAID ON OCT 8, 2026 THAT ABOUT 2,155,345 LAWSON ID RECORDS AND 26 LAWSON APP RESERVATION RECORDS WERE EXPOSED TO UNAUTHORIZED ACCESS. The Lawson ID data holds email addresses and names and, where registered, gender, phone number and address; the reservation records hold names, phone numbers and partial credit card numbers. Lawson blocked the suspicious access sources and is contacting affected people. The disclosure came the same day as Daiichikosho's and a day before Skyticket's and BookOff's, prompting an emergency meeting of Japan's National Cybersecurity Office on Oct 8 and a JPCERT/CC warning about attacks on known vulnerabilities and APIs. NOT ESTABLISHED: when the access occurred, the method, whether theft is confirmed, who was responsible, and whether the Personal Information Protection Commission was notified.
Sources watch.impress.co.jp →
ransomware on SoftBank cloud hits 495 companies and local governments
RANSOMWARE HIT SOFTBANK SUBSIDIARY IDC FRONTIER'S IDCF CLOUD ON OCT 7, 2026, AFFECTING 495 CORPORATE AND LOCAL-GOVERNMENT CUSTOMERS. Four cloud zones were badly damaged and the provider told customers they would likely have to rebuild elsewhere from their own backups, with data in part of East Japan Region 1 hard to recover. A ransom-style message reading that the cloud was now the attackers' circulated in screenshots; the note names no known group, and unverified claims cite 225 storage systems holding 3.6 petabytes locked and 554,153 backup snapshots deleted. An Oct 14 update said unauthorized queries touched registration data for 48 customers with no evidence of external exfiltration. Downstream victims include JR East and View Card (up to 6.09 million records via email-delivery services), JR Kyushu (1.3 million email addresses), Nissui Logistics (17 cold-storage centres halted), Ibaraki Prefectural Police, Jiji Press, Skyticket and Daiichikosho. NOT ESTABLISHED: how the attackers got in, who they are, whether a ransom was demanded, and how much customer data was stolen rather than encrypted.
Sources cybernews.com →ibtimes.co.uk →
up to 1.74M discount-store app and online-store members' contact data leaked
MR MAX HOLDINGS SAID ON OCT 6, 2026 THAT UP TO 1,735,154 MEMBERS OF ITS MRMAX APP AND ONLINE STORE MAY HAVE HAD PERSONAL DATA LEAKED. The discount chain, based in Fukuoka and operating in Kyushu and Kanto, noticed suspicious access to the app and online-store servers on the evening of Oct 3, suspended service and blocked outside access the same day. It says a third party misused a feature of the software that makes up the service to break in. Fields possibly leaked are member ID, name, email address and phone number, varying by member; addresses, dates of birth, card data, passwords and purchase history were not affected. The count is every member registered as of Oct 3. The company is notifying members by email, reporting to the Personal Information Protection Commission and consulting police. NOT ESTABLISHED: when the intrusion began, the specific vulnerability, the actual number affected, and whether any data has been misused.
Sources netshop.impress.co.jp →
chip-test equipment maker confirms SSNs, passports and medical data stolen in February ransomware attack
ADVANTEST, THE JAPANESE SEMICONDUCTOR TEST-EQUIPMENT MAKER, SENT LETTERS DATED OCT 6, 2026 CONFIRMING THAT PERSONAL DATA WAS EXTRACTED IN A RANSOMWARE ATTACK THAT BEGAN ON FEB 15, 2026. The company said in February that attackers had reached parts of its network and deployed ransomware but could not yet say whether customer or employee data was affected; the October letters list contact information, dates of birth, Social Security numbers, national ID numbers, driver's license numbers, passport numbers, medical information, financial information and other ID numbers. Advantest says it has no information that the data has been leaked or misused and is offering 18 months of Kroll identity monitoring, with activation by Jan 4, 2027. No ransomware group has publicly claimed the attack. NOT ESTABLISHED: the number of people affected, whether they are employees, customers or partners, which systems were hit, and who was responsible.
400K utility accounts accessed via customer portal
GEORGIA POWER SAID ON OCT 5, 2026 THAT AN UNAUTHORIZED THIRD PARTY ACCESSED ABOUT 400,000 SOUTHERN COMPANY CUSTOMER ACCOUNTS, 300,000 OF THEM GEORGIA POWER CUSTOMERS. The company's web notice covers Georgia Power, Alabama Power and Mississippi Power and lists names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers and other basic account details; it says bank account, payment card and driver's license numbers were not accessed. Georgia Power said it recently detected suspicious activity on its online customer portal, stopped it, called law enforcement and found no ongoing access. Customers are being notified by mail and email with one year of Equifax credit monitoring. NOT ESTABLISHED: the dates of access and discovery, how the attacker got in, and the split of the remaining 100,000 accounts between Alabama Power and Mississippi Power.
Sources wsbtv.com →classaction.org →
8.8M people's CPR numbers, names and addresses pulled from national register
DENMARK'S GOVERNMENT SAID ON OCT 5, 2026 THAT UNAUTHORIZED LOOKUPS IN THE CENTRAL PERSON REGISTER (CPR) EXPOSED NAMES, ADDRESSES AND CPR NUMBERS OF ABOUT 8.8 MILLION PEOPLE, LIVING AND DEAD. Unidentified actors misused a small Danish company's lawful access to run a very large number of automated lookups over about ten days in September 2026, apparently to identify valid CPR numbers. A register employee noticed the activity on Friday Oct 2; the scope was established over the weekend, the company's access was cut, and the data protection authority Datatilsynet was notified on Oct 4. The register holds about 11 million records in a country of six million residents; people with name-and-address protection were not exposed on those fields. Digitalisation minister Christina Egelund called it a deeply serious incident, ordered a full security review of the CPR system and warned Danes about scam calls and emails. Police are investigating. NOT ESTABLISHED: who ran the lookups, how they got into the company's systems, the company's name, whether the data was retained or misused, and the final count. UPDATE, OCT 6, 2026: the company's account made more than 14 million lookup attempts over the ten days, of which about 8.8 million returned a record; the activity surfaced when per-lookup billing produced an unusually large invoice on the evening of Oct 2. The firm held access under section 38 of the Civil Registration System Act, which allows lookups only on a pre-identified group of people. Officers from the National Unit for Special Crime secured evidence at the company on Oct 3; no one has been identified or charged and police are contacting counterparts abroad. Egelund said it is too early to say whether people will get new CPR numbers; MitID-based systems such as health records were not affected, and the civil-security agency told companies and authorities to stop accepting a CPR number alone as proof of identity. The company is still unnamed.
Sources irishtimes.com →thehackernews.com →thenextweb.com →vp.net →
10.79M restaurant app members' names, emails and phones leaked
MONOGATARI CORP, OPERATOR OF THE YAKINIKU KING BARBECUE CHAIN, ANNOUNCED ON OCT 5, 2026 THAT 10,788,963 MEMBER RECORDS LEAKED FROM ITS OFFICIAL APP. The app had 10,808,784 registered users, so almost every member is affected. Monogatari confirmed unauthorized third-party access to the app's member management system on Oct 2, applied communication blocks on Oct 2-3, and confirmed the leak on Oct 3. Leaked fields are member ID, registered name, email address and phone number; the company says login passwords, dates of birth, gender, postal codes, points and store usage history were not leaked and that it holds no card data. The Toyohashi, Aichi company says the app stays open with added security, that no leak has been confirmed in its other brand apps, and that it had found no misuse as of the announcement. NOT ESTABLISHED: how the attacker got in, who was responsible, whether the records map to as many distinct people, and whether the data has been published.
Sources ascii.jp →beinsure.com →
110K clients' names and account numbers taken from inquiry vendor Scala Communications
DAIWA SECURITIES SAID ON OCT 5, 2026 THAT DATA ON AS MANY AS 110,000 CLIENTS MAY HAVE BEEN STOLEN FROM A SERVER RUN BY ITS CONTRACTOR SCALA COMMUNICATIONS. Scala provides Daiwa's online customer inquiry management service; the unauthorized access ran from the evening of Friday Oct 2 to the morning of Saturday Oct 3, and Scala reported evidence of a leak to Daiwa on the Saturday. About 220,000 records are potentially affected when inquiries with no personal data are counted. Exposed fields are customer names, email addresses and account numbers. Japan's second-largest brokerage says the data cannot be used to log in or trade, that its own systems were not breached, and that it had seen no improper transactions or circulation of the data. NOT ESTABLISHED: how Scala's server was breached, who was responsible, and which other Scala clients were affected (press relays name Citizen Watch and Sompo, not confirmed here).
894K survey-panel members' names, addresses and birth dates taken; points looted
GMO RESEARCH & AI SAID ON OCT 5, 2026 THAT AN INTRUDER TOOK THE ENTIRE MEMBER DATABASE OF ITS INFOQ SURVEY SITE, UP TO 948,498 RECORDS, AND ON OCT 14 PUT THE CONFIRMED FIGURE AT 894,082. Unauthorized access to the infoQ server began on Oct 2; a member's inquiry on the morning of Oct 3 prompted the investigation that found it, and the company suspended the service and halted point exchanges that day. Taken fields include full name, furigana, gender, date of birth, email address, postal address, phone number, member ID, encrypted password, nickname, point balance and last survey date; the company holds no card numbers or My Number data. Attackers also exchanged members' points for Amazon gift codes without consent in 611 cases worth 2,869,500 yen, which the company says it will fully compensate. Members are being notified by email. NOT ESTABLISHED: the vulnerability used, who was responsible, how the passwords were encrypted, and whether the data has been published.
Sources internet.watch.impress.co.jp →scan.netsecurity.ne.jp →
hacker lists 11.2M Colombian health-insurance records with diagnoses and IDs
AN ANONYMOUS ACTOR OFFERED A DATABASE OF 11,239,741 RECORDS ON NUEVA EPS MEMBERS ON A STOLEN-DATA FORUM ON OCT 4, 2026, AND THREATENED TO PUBLISH IT IF THE INSURER WENT TO THE AUTHORITIES. Nueva EPS is Colombia's largest health insurer with about 11.5 million affiliates. The 34-file set, analysed from a 30-record sample by the outlet MuchoHacker.lol, contains identification and contact details, ethnic identity, health data including exams, diagnoses, preventive checks, vaccination and habits, communications logs, and a subsidised-regime code, with records dated up to August 2026; the analyst found indicators consistent with a real database but nothing proving the full set is authentic. Nueva EPS said on Oct 6 that it activated its incident response protocol, found no evidence of unauthorized access to its own systems, and is investigating the claim's origin, which may involve a contractor. NOT ESTABLISHED: whether the data is genuine, where it came from, how many people it covers, and whether Colombia's data protection authority has opened a case.
Sources elcolombiano.com →
19.9M patients' SSNs and medical records in 2025 hack
ORACLE HEALTH REPORTED 19,929,149 PEOPLE AFFECTED BY ITS 2025 CERNER BREACH IN A TEXAS ATTORNEY GENERAL FILING PUBLISHED OCT 2, 2026. The filing lists 2,992,244 Texas residents; Oregon, South Carolina (283,903) and Washington (69,238) filings followed, and a sample notice was filed in California. An attacker reached a legacy Cerner server after Jan 22, 2025; Oregon filings put the breach window at Jan 22 to Apr 1, 2025 with discovery around Feb 20, 2025. Oracle began warning its hospital customers in March 2025 but had not published a nationwide total until the state filings. Exposed data varies by patient and includes names, Social Security numbers, addresses, medical record numbers, diagnoses, prescriptions, test results and medical images. NOT ESTABLISHED: whether every affected patient has now been notified, and how the attacker got in.
Sources foxnews.com →techzine.eu →
school district employees' SSNs taken via third-party software flaw
FRONTLINE EDUCATION BEGAN NOTIFYING SCHOOL DISTRICTS ON OCT 1, 2026 THAT EMPLOYEE DATA INCLUDING SOCIAL SECURITY NUMBERS WAS STOLEN. The Pennsylvania edtech vendor, which sells HR and workforce software to districts, says attackers exploited a vulnerability in an unnamed third-party software product to reach part of its environment; its security team identified the flaw on Aug 14, 2026. Letters list Social Security numbers, email addresses and physical addresses of district employees. One district reported 1,210 affected staff, all of its employees. Frontline offered to send notices and handle state attorney general filings unless districts opted out by Oct 16, with two years of TransUnion monitoring for adults and cyber monitoring for minors. NOT ESTABLISHED: the total number of districts and people, when the access began, and which software was exploited.
Sources bleepingcomputer.com →
up to 200K people's CPR numbers taken from identity system
THE TECHNICAL UNIVERSITY OF DENMARK SAID ON OCT 2, 2026 THAT ATTACKERS GOT INTO DTUBASEN, ITS IDENTITY AND ACCESS MANAGEMENT SYSTEM, AND MAY HAVE TAKEN DATA ON UP TO ABOUT 200,000 PEOPLE. Attackers compromised DTU user profiles and used them to reach DTUBasen, which holds records going back to 2003 on about 40,000 active users and about 160,000 former users: current and former employees, students, guests and external partners. For active users the data includes the CPR civil registration number, full name, home address, profile picture, work email, job title, office location and the name, relationship and phone number of a registered next of kin; for former users the CPR number and name remain, since addresses, pictures and next-of-kin data are deleted after six months. DTU says its incident response team contained the attack, notified the Danish Data Protection Agency and the relevant authorities, and is sending personal notices through e-Boks to current and former staff and almost all current and former students with a CPR number on file; guests, partners and next of kin are covered by the public notice because DTU does not hold their CPR numbers. NOT ESTABLISHED: when the attack happened and was detected, exactly which data was downloaded, how many people are actually affected (DTU says it cannot determine this), and who was responsible.
Sources dtu.dk →
immigration law firm notifies people after social-engineering intrusion copied files
FRAGOMEN, DEL REY, BERNSEN & LOEWY, THE GLOBAL IMMIGRATION LAW FIRM, FILED A BREACH NOTICE DATED OCT 2, 2026 WITH THE CALIFORNIA ATTORNEY GENERAL SAYING AN UNAUTHORIZED PARTY COPIED A SUBSET OF ITS FILES. The letter, signed by general counsel and chief privacy officer Hadley Feldman, says the firm discovered on May 5, 2026 that a third party had gained remote access to a single user account as part of a social-engineering campaign and had accessed and copied files; the firm contained the incident, hired cybersecurity experts, notified law enforcement and reviewed the files to identify the people in them. Recipients get 24 months of Experian IdentityWorks monitoring with enrollment by Jan 29, 2027. The sample letter lists only the recipient's name plus an unfilled placeholder for the other data elements. NOT ESTABLISHED: how many people are affected, which data elements (immigration files commonly hold passports, visas and dates of birth), whether they are client employees or visa applicants, and why notice came five months after discovery.
Sources oag.ca.gov →
5.31M customer records hit in payment-system intrusion
YAMATO TRANSPORT REPORTED THAT ABOUT 5.31 MILLION CUSTOMER RECORDS WERE AFFECTED BY UNAUTHORIZED ACCESS TO ITS PAYMENT SERVICE SYSTEM. The parcel carrier confirmed the access on Sep 28, 2026 and restored the service on Oct 9, 2026; the count was reported on Oct 19, 2026. NOT ESTABLISHED: which data fields were exposed, whether payment card data was involved, how the attackers got in, and the notification status.
Sources qatar-tribune.com →
up to 6.09M customer accounts exposed through IDC Frontier cloud attack
EAST JAPAN RAILWAY (JR EAST) WARNED IN OCTOBER 2026 THAT UP TO 6.09 MILLION CUSTOMER ACCOUNTS, INCLUDING ITS VIEW CARD UNIT, MAY HAVE BEEN ACCESSED VIA EMAIL-DELIVERY SERVICES HOSTED ON THE HACKED IDC FRONTIER CLOUD. About 1.67 million email addresses on its Eki-net booking platform are potentially affected. JR East says credit card numbers, home addresses and phone numbers were not exposed. JR Kyushu separately warned that up to 1.3 million customer email addresses may have been exposed in the same cloud attack. NOT ESTABLISHED: how many accounts were actually taken rather than potentially reachable, the exact disclosure date, and the notification status.
Sources cybernews.com →ibtimes.co.uk →
8.72M customers potentially exposed via contractor system
KARAOKE OPERATOR DAIICHIKOSHO SAID IN OCTOBER 2026 THAT ABOUT 8.72 MILLION CUSTOMERS WERE POTENTIALLY EXPOSED IN A BREACH INVOLVING A SYSTEM MANAGED BY AN EXTERNAL CONTRACTOR. The disclosure came during a wave of Japanese breaches tied to compromised cloud and vendor systems, including the IDC Frontier ransomware attack. NOT ESTABLISHED: which data fields were exposed, the contractor involved, the exact disclosure date, whether data was confirmed stolen, and the notification status.
Sources ibtimes.co.uk →
up to 6.43M customers warned of possible data exposure
USED-GOODS RETAILER BOOKOFF WARNED IN OCTOBER 2026 THAT UP TO 6.43 MILLION CUSTOMERS COULD BE AFFECTED BY A DATA INCIDENT. The warning came during a wave of Japanese vendor and cloud breaches in early October 2026. NOT ESTABLISHED: the cause, which data fields were exposed, whether theft is confirmed, the exact disclosure date, and the notification status.
Sources ibtimes.co.uk →
SSNs, government IDs and health records exposed; three class actions filed
LIVE NATION REPORTED A DATA BREACH INVOLVING SOCIAL SECURITY NUMBERS, GOVERNMENT ID NUMBERS AND HEALTH RECORDS TO THE VERMONT ATTORNEY GENERAL ON OCT 1, 2026. The Vermont log lists two Vermont residents and no incident date, and says the count may rise. Three near-identical class actions were filed in the Central District of California: Fraga on Oct 6 (Edelsberg Law), Gosman on Oct 7 (Kopelowitz Ostrow) and Ramos on Oct 7 (Milberg, case 2:26-cv-11678); Fraga and Gosman say they are former Live Nation employees, and the complaints allege, without confirmation, that notice came more than four months after the company learned of the breach. Live Nation told Music Business Worldwide on Oct 8 that it identified, contained and secured the incident, that an outside investigation found it limited in scope with no operational impact, and that a small number of individuals are being notified and offered monitoring. NOT ESTABLISHED: the total number of people affected, when the breach happened and was discovered, how the attacker got in, and whether customers as well as employees are included.
law firm hack exposes 196,645 patients' SSNs, passports and biometric data
MANHATTAN LAW FIRM TARTER KRINSKY & DROGIN REPORTED IN OCT 2026 THAT A 2025 INTRUSION EXPOSED DATA ON 196,645 PATIENTS OF ITS HEALTHCARE CLIENTS. An unauthorized third party accessed some of the firm's servers intermittently between Jul 9 and Sep 9, 2025; the firm spotted suspicious activity on Sep 10, 2025 and brought in forensic specialists, who confirmed files were accessed or acquired. The file review finished more than a year later and letters are now being mailed. Data, varying by person, includes name, Social Security number, driver's license number, date of birth, passport number, tax ID, financial account and payment card data, username and password, medical and health insurance information, and biometric data; attorney-client privileged material was also involved. The firm says it reviewed its security policies and added measures. NOT ESTABLISHED: the attack method and attacker, which healthcare clients' patients are affected, the HHS and state filing dates, and whether credit monitoring is offered.
Sources hipaajournal.com →
258,920 mail-order customers' prescriptions and card data exposed through website
RIDGEWAY PHARMACY OF VICTOR, MONTANA, REPORTED IN OCT 2026 THAT 258,920 CUSTOMERS' DATA WAS EXPOSED THROUGH ITS THIRD-PARTY-BUILT WEBSITE. The mail-order and community pharmacy learned on Aug 21, 2026 that personal information had been exposed via the site; forensic experts found the incident limited to the website with no internal systems involved. Exposed data includes names, addresses, dates of birth, prescription information, health information and insurance information, and payment card data for a subset. Ridgeway is offering credit monitoring and identity protection, reviewing its website arrangements, moving to a new platform and restricting access. NOT ESTABLISHED: when the exposure began, how the website was compromised and by whom, the HHS and state filing dates, and the letter mailing date.
Sources hipaajournal.com →
1.3M court debtors' SSNs and 150,000 foster care reports copied after phishing
THE ARIZONA SUPREME COURT SAID ON SEP 30, 2026 THAT HACKERS COPIED NAMES, CASE NUMBERS AND SOCIAL SECURITY NUMBERS OF ABOUT 1.3 MILLION PEOPLE IN ITS FARE COURT-DEBT PROGRAM, GOING BACK 30 YEARS. The attack on Sep 24, 2026 lasted about two hours before court IT staff found and stopped it; a court employee had opened a phishing email, and the data was copied from a backup server holding highly compressed information. FARE (Fines/Fees and Restitution Enforcement) is the Judicial Branch's statewide program for collecting court-ordered debt from civil traffic, criminal traffic and criminal cases, so those affected are people sent to collections. Chief Justice Ann Scott Timmer announced the incident on Sep 25; on Sep 28 spokesman Alberto Rodriguez disclosed that a second dataset of more than 150,000 confidential Foster Care Review Board reports, covering current and past cases back to 2010, was also accessed -- they contain information about children, names of interested parties and board findings, but no addresses or phone numbers; the Sep 30 update added the FARE count. The court says it has no evidence the data has been read or shared, that no records were deleted or altered, and that the AZPoint protective-order site was not touched. The FBI is investigating. Debtors are being notified by text and in mailed collection notices; the Department of Child Safety, attorneys for children and parents, juvenile judges and board members were notified about the foster reports; the court urged credit freezes. NOT ESTABLISHED: who the attackers were, whether the compressed data has been decoded, the number of people in the foster care reports, and whether any other court systems were reached.
572K convenience-store app members' names, birth dates and addresses leaked
HOKKAIDO CONVENIENCE CHAIN SEICOMART ANNOUNCED ON SEP 30, 2026 THAT ITS APP SERVER WAS BREACHED, EXPOSING 572,022 MEMBERS, ABOUT 49 PERCENT OF ITS APP BASE. Leaked fields are names, gender, dates of birth, addresses, phone numbers, email addresses and the dates members joined and left the points program. The company says passwords and credit card information were not leaked. NOT ESTABLISHED: when the intrusion began, how the server was breached, who was responsible, and the notification status.
Sources digitaltoday.co.kr →
3.05M service members' SSNs exposed for nine months on unencrypted server
THE PENTAGON'S DEFENSE MANPOWER DATA CENTER (DMDC) DISCLOSED IN SEP 2026 THAT UNAUTHORIZED USERS ACCESSED UNENCRYPTED PERSONAL DATA ON ABOUT 3.05 MILLION PEOPLE. A defense official told ABC News on Sep 29, 2026 that 2.76 million living and 294,000 deceased individuals were affected; Military Times first reported the breach the week before. A flaw in a DMDC file-sharing system let a small number of unauthorized users pull files from Oct 2025 until the vulnerability was found and patched on Jul 16, 2026. Every notice includes a Social Security number plus at least one other identifier such as name, date of birth, contact details, sex, race or military occupational specialty. DMDC, which holds more than 60 million personnel records, mailed letters and is offering 12 months of IDX credit monitoring; officials say no misuse has been found. NOT ESTABLISHED: who the unauthorized users were, when letters went out, and the split among service members, veterans, dependents and civilians.
Sources securityweek.com →helpnetsecurity.com →securityaffairs.com →abc30.com →
Polish invoicing platform used by 600K businesses loses tax IDs, bank accounts and password hashes
FAKTUROWNIA SAID ON SEP 29, 2026 THAT AN ATTACKER EXPLOITED A VULNERABILITY AND COPIED DATABASE DATA FROM EVERY ACCOUNT ON ITS INVOICING PLATFORM, WHICH IS USED BY MORE THAN 600,000 BUSINESSES. The intrusion ran from about 03:20 on Sep 27 to about 17:45 on Sep 28; the company blocked the attacker, closed the hole at 18:01 on Sep 28, rotated keys and passwords, moved to new servers and replaced customer API tokens overnight. Its Oct 1 update says the incident touches every account, with about 2,250 accounts losing all 2022-2026 data: company and user names, NIP tax numbers, addresses, user emails and phones, bank names and account numbers with IBAN and SWIFT, hashed passwords, API tokens, session IDs, connected bank balances, invoice amounts for the whole period, contractor records added before Oct 16, 2024 including bank accounts, full invoice content before Mar 22, 2021, and payment details. KSeF certificates, bank logins and card data were not taken. Fakturownia reported to data regulator UODO, CERT Polska and the Central Cybercrime Bureau on Sep 29 and began emailing users on Oct 1. A group calling itself Fingerprint claimed 6 TB of invoices to Zaufana Trzecia Strona and also claims the MyDr and Medyc health-software breaches; Digital Affairs Minister Krzysztof Gawkowski said those responsible are being pursued. NOT ESTABLISHED: the vulnerability, the number of individuals affected, whether the 6 TB claim is genuine, and whether the data has been published.
6.6M car-sharing members' driver's license images and ID documents stolen
TIMES MOBILITY, THE PARK24 GROUP'S CAR-SHARING ARM, CONFIRMED ON SEP 28, 2026 THAT DATA ON ABOUT 6.6 MILLION CURRENT AND FORMER TIMES CAR MEMBERS WAS STOLEN. The intruder entered at the beginning of September 2026; the company detected the access on Sep 25 at 9:07 a.m., blocked it on Sep 26 at 7:25 a.m., and confirmed theft two days later. Exposed data includes full names, addresses, dates of birth, phone numbers, email addresses, driver's license information, identity-verification document images, account passwords stored in an unrecoverable form, and linked service IDs; corporate members' department names were also taken. Japanese reporting put the number of people whose identity documents leaked at 160, and the count includes applicants who never finished signing up. Credit card data was not affected. The company says it will notify members in stages and has seen no sign of the data online. NOT ESTABLISHED: how the attacker got in, who was responsible, and how many license images were actually taken.
16,000 misconfigured app databases leak names, passwords, plates and chats
UPGUARD RESEARCHERS REPORTED ON SEP 25, 2026 THAT ABOUT 16,000 DATABASES HOSTED ON SUPABASE WERE EXPOSING PERSONAL DATA TO THE OPEN WEB. UpGuard scanned about 300,000 domains showing signs of Supabase use and found 16,326 with readable tables; more than half showed personal data and a smaller share held passwords or authentication tokens. Examples include an Indian adult-content site with 65,467 users and over 100,000 private messages, a Philippine OTP service holding 100,000 intercepted SMS codes, a US valet service with about 78,000 license plates and 43,000 names and emails, an African consulate in France with 25,000 people's addresses and emergency housing locations, and a Canadian immigration service with 884 plaintext passwords. The cause is tables created through the API, the route AI coding agents use, that do not turn on Row Level Security by default, and developers who treat public keys as secrets. Supabase's CISO said projects are secure by default and security is a shared responsibility; UpGuard notified owners of significant exposures. Most exposed data sets appear to be US-based. NOT ESTABLISHED: the total number of people exposed and whether any of the data was taken by others before UpGuard's notices.
Sources techcrunch.com →upguard.com →
phone-spoofing social engineers get into managed-care servers
ASTRANA HEALTH FILED AN SEC FORM 8-K ON SEP 23, 2026 REPORTING A MATERIAL CYBERSECURITY INCIDENT AT ITS SUBSIDIARY ASTRANA HEALTH MANAGEMENT. Attackers impersonated company personnel, spoofed Astrana's main corporate phone number and talked employees into granting system access. The Alhambra, California managed services organization, which runs value-based care networks for physicians, says it believes private or confidential information on its servers was accessed or acquired, and determined on Sep 22 that the incident was material because of the sensitivity of the data. It has reset credentials, restricted remote access tools, restored systems from clean backups, engaged forensics, notified law enforcement and is notifying state and federal regulators and payer partners. NOT ESTABLISHED: whether patient, employee or provider data was taken, and how many people are affected; the company says it will notify patients if required.
Sources sec.gov →hipaajournal.com →
ShinyHunters claims terabytes of agent and applicant data from FBIJobs.gov portal
THE FBI CONFIRMED ON SEP 22-23, 2026 THAT IT IS INVESTIGATING A BREACH OF ITS FBIJOBS.GOV RECRUITMENT PORTAL AFTER SHINYHUNTERS CLAIMED TO HOLD 2 TO 3 TB OF PERSONNEL DATA. The group posted a claim on Sep 22 and offered a sample of about 5,000 records said to cover current and former FBI personnel and job applicants, with names, addresses, phone numbers, Social Security numbers, assignments and family details; Reuters matched at least 10 entries, including one for Director Kash Patel, but could not confirm where the data came from. The portal was defaced and taken offline. ShinyHunters says it used an Oracle PeopleSoft zero-day; Google Mandiant separately reports the group exploiting a PeopleSoft flaw patched in June 2026 by bypassing firewall protections. Employees told NPR that medical data and promotion records were among the files and that many learned of the breach from media reports; the group later said it would not leak the files. NOT ESTABLISHED: the number of people affected, whether FBI internal systems beyond the jobs portal were reached, and the actual entry point.
Sources kuow.org →securityaffairs.com →
brokerage back end for Revolut, Stake and Hatch hit by social engineering
DRIVEWEALTH, THE US CLEARING BROKER BEHIND REVOLUT, STAKE AND HATCH STOCK TRADING, SAID A SOCIAL-ENGINEERING CAMPAIGN GAVE OUTSIDERS ACCESS TO CUSTOMER RECORDS ON SEP 4-5, 2026. Stake warned Australian customers on Sep 21, Hatch (New Zealand) on Sep 22, and DriveWealth and Revolut emailed affected users on Sep 24. Exposed fields include names, email and postal addresses, phone numbers, employment details, citizenship, age, gender and partial DriveWealth account numbers; Stake and Hatch customers also had portfolio values and cash balances exposed, and Stake users their W-8/W-9 tax status. Historical records of customers who had closed or migrated accounts were included. Passwords, card details, bank account numbers and ID documents were not exposed and no unauthorized trades or withdrawals were found. DriveWealth's notice to Rhode Island regulators cited about 62,000 state residents and the incident was reported to Lithuania's data protection authority. NOT ESTABLISHED: the total number of people affected across all partner platforms and markets.
admissions system hack exposes 600,000 student records going back 50 years
LUDWIG MAXIMILIAN UNIVERSITY OF MUNICH (LMU) SAID ON SEP 19, 2026 THAT A CYBERATTACK ON ITS ADMISSIONS SYSTEM EXPOSED DATA ON CURRENT AND FORMER STUDENTS, AND ON SEP 28 PUT THE SCOPE AT ABOUT 600,000 RECORDS. The university has been dealing with the incident since Sep 16 and forensic work found the entire data set in the admissions system affected, with enrollment records back about 50 years. Records up to 1994 hold master data and semester history; records from 2005 on are fuller and in some cases include bank details, health insurance numbers, BAfoG student-aid numbers, study progress and reasons for leave of absence. Passwords, exam data and grades were not affected. LMU informed the supervisory and investigating authorities, published the notice under GDPR Article 34, is monitoring the dark web with outside help and says it will contact individuals directly if misuse appears; it shut down systems as a precaution and is restoring them through Sep 30. NOT ESTABLISHED: the attack vector, who was behind it, and whether the data has been published.
Sources lmu.de →it-daily.net →
23.6M user records and 490M image metadata rows with upload IPs and locations stolen
HELPFEEL, THE KYOTO OPERATOR OF THE GYAZO SCREENSHOT SERVICE, DISCLOSED ON SEP 16, 2026 THAT AN ATTACKER STOLE ABOUT 23.62 MILLION USER RECORDS AND ABOUT 490 MILLION IMAGE METADATA RECORDS. The attacker exploited a vulnerability in Gyazo's image upload server on Sep 11, ran commands on Helpfeel systems and reached the database; Helpfeel cut the access on Sep 12, confirmed the exposure on Sep 14 and reported to Japan's Personal Information Protection Commission on Sep 15. User records include names, email addresses, password hashes, device and login-session IDs, X integration tokens, Google SSO emails and subscription status. Image metadata, mostly for images from Jan 2019 or earlier, includes image IDs used in URLs, upload IP addresses, user agents, EXIF location data, OCR text and hashed passphrases for private images; Helpfeel says it cannot rule out that some private images were viewed, and metadata for a further 2.4 million images was pulled using specific filters. No payment card data was involved. NOT ESTABLISHED: the number of distinct people affected, since many accounts are anonymous, and whether the exposed session IDs remained valid.
1.06M Texans' SSNs and license numbers confirmed stolen; hacker claimed 7.49M records
CENTERPOINT ENERGY TOLD THE TEXAS ATTORNEY GENERAL IN MID-OCTOBER 2026 THAT A SEPTEMBER BREACH AFFECTED 1,062,060 TEXAS RESIDENTS, WITH NAMES, ADDRESSES, SOCIAL SECURITY INFORMATION AND DRIVER'S LICENSE NUMBERS. The Houston utility first disclosed the incident in an SEC Form 8-K on Sep 14, 2026, saying an unauthorized third party obtained personal information on a portion of its customers through an external-facing system after the company saw an online post claiming a customer data set; energy service was not affected. A poster using the alias 4d722e4d656f77 had offered about 7.49 million customer records on a crime forum on Sep 12, listing names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status and partial Social Security numbers, and said the data came from a public API with no rate limiting or authentication. The Texas filing, reported by Click2Houston on Oct 14, lists full Social Security information and license numbers; CenterPoint, which serves about 7 million accounts in Texas, Indiana, Minnesota and Ohio, said it was still determining which customers would receive notices and had engaged outside forensic and legal advisers. NOT ESTABLISHED: counts for other states, how the 1.06 million Texans relate to the 7.49 million records claimed, whether letters have gone out, and how the API was exposed.
Sources securityaffairs.com →cyberinsider.com →securityaffairs.com →
passport scans and selfies handed to scammers using a government email domain
REVOLUT CONFIRMED ON SEP 12, 2026 THAT IT DISCLOSED CUSTOMER IDENTITY DOCUMENTS TO AN UNAUTHORIZED THIRD PARTY AFTER RECEIVING FRAUDULENT DATA REQUESTS SENT FROM A LEGITIMATE GOVERNMENT AGENCY EMAIL DOMAIN. The London fintech, which has more than 80 million customers, told affected users that dates of birth, postal and email addresses, phone numbers and copies of identity documents such as passports and driver's licenses were released, and that verification selfies, account statements and transaction histories may also have been included. Revolut called it an external impersonation scam, blocked the sender, and alerted the agency, law enforcement and regulators; it described the number of customers as limited and declined to name the agency or market. Finance Magnates later reported the requests came from a compromised Italian government email account and covered about 680 customers' KYC documents and transaction records. NOT ESTABLISHED: Revolut has not published a count or confirmed which country's agency domain was used.
DAVID driver database raided through a police officer's stored credentials; breach letters mailed from Oct 16
FLORIDA'S HIGHWAY SAFETY AND MOTOR VEHICLES DEPARTMENT CONFIRMED ON SEP 11, 2026 THAT ITS DAVID DRIVER AND VEHICLE DATABASE WAS BREACHED. FLHSMV says it learned of the intrusion on Sep 4 and that the attacker used the credentials of a single Plant City Police Department user, which had been improperly stored on a personal device. ShinyHunters claimed it began iterating through DAVID record IDs on Sep 3, downloading pages and images, and that it holds more than 200,000 driver records; it posted a DAVID record for Jeffrey Epstein as proof and says it exploited a password-reset flaw to reach DMV and FBI-agent accounts. DAVID is the law-enforcement portal to Florida license, photo and vehicle data. FLHSMV notified the Attorney General, is working with the Florida Digital Service and FDLE, and said it would notify affected Floridians. NOT ESTABLISHED: the number of records actually taken, the data fields involved, and whether the data was published after the ransom deadline passed. UPDATE, OCT 16, 2026: FLHSMV ISSUED A PUBLIC BREACH NOTICE AND BEGAN MAILING LETTERS. The notice says a malicious actor used compromised credentials to access department records on Sep 4, 2026, and that the potentially affected information includes driver license and motor vehicle data, document images and other personal information; the department says it has no evidence of misuse. Letters were to go out the week of Oct 16 to current license and ID-card holders who may be affected, with substitute notice under section 501.171, Florida Statutes, for former license holders and past vehicle owners it cannot reach by mail. FLHSMV is offering a year of Sontiq (TransUnion) identity and credit monitoring with $1 million in identity-theft insurance and set up FLHSMV.gov/DataBreach. Hackread's Sep 14 review of the leaked archive (about 52.3 GB in 612,982 ZIP files, not a count of people) found unredacted scans of Social Security cards, US and foreign driver licenses, residence documents and employment authorization cards alongside title and transfer records, so Social Security numbers are added to the data types here on the strength of that review, not the state notice. ShinyHunters told Hackread it got the police user's credentials from an infostealer log and then exploited weak security-question answers in the portal's password-recovery process. STILL NOT ESTABLISHED: how many Floridians received letters, and whether the state will publish a count.
Sources bleepingcomputer.com →mysuncoast.com →content.govdelivery.com →hackread.com →
unpatched VPN flaw exposes 246,000 records on officials across 23 ministries
JAPAN'S DIGITAL AGENCY DISCLOSED ON SEP 11, 2026 THAT ATTACKERS BREACHED ITS GOVERNMENT SOLUTION SERVICE (GSS), THE SHARED NETWORK PLATFORM USED BY 23 MINISTRIES AND AGENCIES, EXPOSING ABOUT 246,000 PERSONNEL RECORDS. A third party exploited a medium-severity VPN vulnerability for which a patch was already available, then used a maintenance and operations staff account to reach a file server; the agency noticed mass file access on Jun 25, confirmed the VPN entry on Jul 9, notified the privacy regulator on Jul 15 and went public 78 days after detection. About 189,000 records belong to employees and officials of GSS user organizations and 57,000 to contractors; fields include about 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 physical addresses. My Number IDs, bank accounts and pension numbers were not included and the agency says the general public is not affected. NOT ESTABLISHED: the VPN product and flaw, when the intrusion began, and who was behind it.
EHR vendor's API raided via stolen vendor credentials; 3.5M patient records claimed
VERADIGM, THE CHICAGO EHR AND PRACTICE-MANAGEMENT COMPANY FORMERLY KNOWN AS ALLSCRIPTS, FILED AN SEC FORM 8-K ON SEP 8, 2026 DISCLOSING THEFT OF PATIENT DATA. A threat actor obtained credentials from a third-party vendor's environment and used them to reach a Veradigm API used for customer services, copying personal data tied to a small number of Veradigm customers; the company says no other part of its network was reached. Veradigm says the data included personal information and, for some patients, Social Security numbers, but no clinical or medical records, and is offering credit monitoring. The Gentlemen extortion group listed Veradigm on its leak site on Sep 5 claiming 3.5 million patient records with names, addresses, phone numbers, emails and guarantor details, and threatened to publish them. NOT ESTABLISHED: Veradigm has not disclosed how many people were affected or which customers' patients were involved; the 3.5 million figure is the attackers' claim.
220M passenger records with passport numbers left open on default credentials
RESEARCHERS AT KINRYU LABS REPORTED ON SEP 8, 2026 THAT AN ADVANCE PASSENGER INFORMATION SYSTEM (APIS) DATABASE HOSTED IN VIETTEL IP SPACE IN HANOI HAD EXPOSED 220,783,700 PASSENGER AND CREW RECORDS. The Elasticsearch cluster named pax-info held 29 indices and about 107 GB covering flights from Jan 2017 to Apr 2026: 210.3 million passenger and 10.5 million crew records with names, dates of birth, sex, nationality, passport or travel-document numbers with expiry and issuing country, plus flight numbers, routes, seats and baggage references. Direct access was blocked, but a second cloud path accepted default credentials; scanners had indexed the host since Oct 2022. Kinryu Labs reported it on Jun 3 to Vietnamese authorities, affected airlines and national CERTs, and Singapore Airlines' security team helped get it secured by Jun 8. Records are travel events, not unique people, so frequent flyers appear repeatedly. NOT ESTABLISHED: which Vietnamese organisation operated the system, how long the data was reachable, and whether anyone copied it before it was secured.
219,665 cosmetic-surgery app users' consultation records and IDs leaked
HEALING PAPER, OPERATOR OF THE GANGNAM UNNI COSMETIC-SURGERY PLATFORM, SAID ON SEP 7, 2026 THAT 219,665 USERS' PERSONAL DATA AND CONSULTATION RECORDS WERE LEAKED. About 160,000 are in South Korea, about 48,000 in Japan and 4,218 in Taiwan, with others in Thailand, China and elsewhere. An unauthorized party reached consultation records through the platform's API on Sep 4; the company blocked the route and found the same attacker trying a different channel on Sep 5. Leaked fields include names, phone numbers, email addresses, dates of birth, gender, country or region, social-media login IDs, IP addresses and device data, plus consultation details: procedure names, hospital and doctor names, preferred appointment times, reasons for seeking treatment, consultation status and photos. The company posted an apology, notified every affected user individually, opened a 30-day lookup tool showing each user what leaked, and warned of impersonation scams. NOT ESTABLISHED: whether the Sep 5 attempt succeeded, who was responsible, whether regulators were notified, and whether the data has been sold or published.
422,584 fan-platform accounts' payment and refund records pulled through an API
WEVERSE COMPANY, THE HYBE SUBSIDIARY RUNNING THE K-POP FAN PLATFORM WEVERSE, DISCLOSED ON SEP 6, 2026 THAT 422,584 ACCOUNTS HAD DATA ILLEGALLY ACCESSED. KISA told the company on Sep 3 that an outside reporter had flagged a vulnerability; Weverse filed a breach report with KISA on Sep 4 and President Zooil Yang issued an apology and notice on Sep 6. The exposed set is one personal identifier, the internal account ID generated at sign-up, together with payment method, payment gateway, currency, purchase and cancellation amounts, purchase timestamps, purchase status and refund dates; the company says names, contact details and card numbers were not included and that payment forgery is unlikely. Weverse tightened access controls on the payment API, removed internal IDs from external exposure and says it will pursue legal action. It is the company's second data incident of 2026 after a January insider leak. NOT ESTABLISHED: how long the API was open, whether users outside South Korea are included, and whether the data has been recovered.
ID-verification vendor confirms breach as 153M license scans are offered for sale
IDSCAN.NET, A NEW ORLEANS ID-VERIFICATION VENDOR USED FOR AGE AND IDENTITY CHECKS, CONFIRMED A BREACH ON SEP 4, 2026. Brian Krebs reported on Sep 1 that a dark web service called Nexus was selling scans it claimed covered more than 153 million US and Canadian driver's licenses, 10 million ID cards, 3 million travel documents and 579,000 medical cards; Krebs traced records for himself and consenting relatives to businesses that use IDScan. IDScan says it learned on or about Sep 1 that an unauthorized third party may have accessed and copied customer information on its cloud platform, including names and driver's license or other government ID numbers, and is offering credit monitoring. Its customers include car rental firms, retailers, hospitality venues and cannabis dispensaries. The FBI New Orleans field office opened an investigation and at least four proposed class actions were filed in the Eastern District of Louisiana. NOT ESTABLISHED: IDScan has not confirmed the number of people affected, the access window or whether license images were taken; the 153 million figure is the seller's claim.
Sources helpnetsecurity.com →govinfosecurity.com →esecurityplanet.com →
1.08M Australian and New Zealand students, parents and staff exposed via Metabase flaw
MATHSPACE, A SYDNEY MATHS-EDUCATION PLATFORM, CONFIRMED ON SEP 3, 2026 THAT AN ATTACKER TOOK DATA ON 1,079,819 STUDENTS, PARENTS, GUARDIANS AND SCHOOL STAFF IN AUSTRALIA AND NEW ZEALAND. The attacker exploited an unpatched vulnerability in Mathspace's self-hosted Metabase reporting tool, gaining administrator access without a login; access began Aug 10 and the Australian reporting database was downloaded on Aug 27, three weeks after Metabase published a critical advisory on Aug 6 that Mathspace's process failed to escalate. Exposed fields include internal user IDs for student accounts, usernames, first and last names, email addresses, country, time zone, user type and login dates; academic records, passwords and tokens were not exposed, though school affiliation may be inferable from email domains. Mathspace notified schools, the OAIC, ASD's ACSC, New Zealand's Privacy Commissioner and NCSC and state education departments on Sep 4 and began notifying individuals on Sep 6. NOT ESTABLISHED: the breakdown between children and adults, and whether the data has been sold or published.
names and SSNs taken through Oracle E-Business Suite zero-day
BIMBO BAKERIES USA FILED NOTICE WITH THE CALIFORNIA ATTORNEY GENERAL ON SEP 4, 2026 THAT ATTACKERS TOOK FILES CONTAINING NAMES AND SOCIAL SECURITY NUMBERS FROM ITS ORACLE E-BUSINESS SUITE APPLICATION. The Horsham, Pennsylvania baker (Thomas', Entenmann's, Sara Lee, Arnold, Oroweat) says a zero-day vulnerability in the Oracle software let unauthorized parties acquire files; its investigation determined on Dec 6, 2025 that the flaw had allowed access, and on Aug 19, 2026 it identified a file holding names and SSNs. Letters dated Aug 31, 2026 offer 12 months of single-bureau credit monitoring through Cyberscout and say the company applied Oracle's patches and is re-evaluating vendor relationships. The California notice says 51 Rhode Island residents are included. The broader Oracle EBS campaign has been tied to the Cl0p extortion group, which Bimbo has not confirmed. NOT ESTABLISHED: the total number of people affected, whether they are employees or others, when the intrusion occurred, and whether a ransom was demanded.
Sources oag.ca.gov →cyberinsider.com →
government probe puts Korean streamer's hack at 39.5M accounts, more than its user base
SOUTH KOREA'S MINISTRY OF SCIENCE AND ICT ANNOUNCED ON SEP 3, 2026 THAT THE HACK OF THE CJ ENM STREAMING SERVICE TVING COMPROMISED 39.54 MILLION ACCOUNTS AND 361 TECHNICAL ASSETS INCLUDING SOURCE CODE. Tving detected the intrusion on May 30 and reported it to KISA on Jun 1, later than the 24-hour rule, and now faces a possible fine. A hacker stole a developer's access key and moved into internal systems; the government's three-month joint investigation found 22.06 million active and 17.37 million dormant or closed accounts affected, plus 110,000 test accounts, across 7.26 million direct sign-ups, 8.63 million CJ ONE memberships and 22.47 million social-login accounts, so one person may hold up to 13 accounts and the earlier provisional estimate was 13 million victims. Up to 20 categories and 70 data types were taken, including names, dates of birth, mobile numbers, emails, CI/DI identity-linkage codes and payment histories; the Korea Herald reported that encryption keys for some fields were also taken. Tving is offering a year of fraud insurance, 5,000 won in credits and a CEO apology, and the Personal Information Protection Commission will set the deduplicated count and penalties. NOT ESTABLISHED: the number of unique people, the attacker's identity, and whether the data was sold.
Sources koreatimes.co.kr →koreaherald.com →view.asiae.co.kr →
399,086 Medicaid beneficiaries' IDs and demographics hidden in public reports for three years
THE DISTRICT OF COLUMBIA'S MEDICAID AGENCY REPORTED TO HHS ON SEP 3, 2026 THAT 399,086 MEDICAID AND DC HEALTHCARE ALLIANCE BENEFICIARIES' DATA HAD BEEN REACHABLE FROM ITS PUBLIC WEBSITE SINCE 2023. Two reports on the Department of Health Care Finance site showed aggregate enrollment statistics, but the underlying personal data sat in hidden fields that unauthorized people could potentially access. DHCF learned of the problem and announced it on Jul 21, 2026, pulled the reports and investigated, then determined it was a reportable HIPAA breach; it appeared on the HHS breach portal in late September. Exposed fields are Medicaid ID number, date of birth, provider name, race, gender, ward and ethnicity; names, SSNs and financial data were not included. Letters are being mailed to all affected people and the agency says it has tightened internal processes. NOT ESTABLISHED: whether anyone actually extracted the hidden data, and the letter mailing date.
cancer-device maker reports unauthorized access touching 1,400+ US patient records
NOVOCURE TOLD THE SEC ON SEP 1, 2026 THAT A SUBSIDIARY FOUND UNAUTHORIZED ACCESS TO SOME OF ITS INFORMATION SYSTEMS IN MID-AUGUST 2026. The Form 8-K, filed under Item 8.01 rather than Item 1.05, says the company activated its response plan, contained the intrusion and hired outside forensic experts. The data involved internal patient ID numbers for more than 1,400 US patient records, which Novocure says carry no names or other identifying data, plus additional identifying information for fewer than 50 patients in the western United States, general contact information for healthcare providers, and employees' job titles and phone numbers. Novocure makes the Optune tumor-treating-fields devices; it says no treatment devices were reached and operations were not affected. The company says it is evaluating notification duties, will notify affected patients, does not consider the incident material, and would file an Item 1.05 amendment if that changed. NOT ESTABLISHED: who was responsible (the filing names no threat actor and no ransom demand), what the additional identifying information for the western US patients was, and when notifications went out.
Sources sec.gov →
138,677 Medicare Advantage members' data reached through three phished employee mailboxes
CLOVER HEALTH TOLD HHS IN SEPT 2026 THAT A JULY SOCIAL-ENGINEERING ATTACK ON THREE EMPLOYEE EMAIL ACCOUNTS INVOLVED THE PROTECTED HEALTH INFORMATION OF 138,677 PEOPLE. The publicly traded Medicare Advantage insurer, which operates in 11 states, noticed unusual login activity on Jul 4, 2026 and found that employees had been tricked into giving up credentials; the three accounts belonged to non-managerial staff handling member visit scheduling and broker-facing sales and could not reach financial or claims systems. Clover disclosed the incident in July, reported it to the SEC and law enforcement, said it was not material to its business, and said it would notify members if HIPAA-protected data proved to be exposed. NOT ESTABLISHED: the specific data elements, when the access began and how long it lasted, whether data was exfiltrated, the exact HHS report and letter dates, and whether credit monitoring is offered.
Sources hipaajournal.com →
Musinsa fashion platform API leak exposes 159,000 customers' names and delivery details
SOUTH KOREAN FASHION PLATFORM 29CM ANNOUNCED ON AUG 30, 2026 THAT ABOUT 159,000 CUSTOMERS' DATA HAD LEAKED THROUGH AN ORDER-LOOKUP API. The Musinsa subsidiary says abnormal external access to the API used to retrieve order information occurred on Aug 27, 2026. For 138,841 customers only names were exposed; for 21,011 the leak included names, email addresses, phone numbers and delivery addresses. Payment data and login credentials were not involved. 29CM blocked the access route, reported voluntarily to the Korea Internet & Security Agency, notified customers, and opened a 30-day lookup page. NOT ESTABLISHED: who pulled the data and whether it has been shared, and whether the Personal Information Protection Commission has opened a review.
employee SSNs, ID and bank details accessed through a compromised staff account
TOY MAKER HASBRO FILED BREACH LETTERS WITH THE MASSACHUSETTS ATTORNEY GENERAL IN LATE AUG 2026 AFTER AN ATTACKER USED A COMPROMISED EMPLOYEE ACCOUNT TO REACH STAFF PERSONAL DATA. The Pawtucket, Rhode Island company says it disabled the account and ended the access. Its letters say the data may have included names with email addresses, postal addresses, phone numbers, national ID numbers or financial information; the Massachusetts listing covers Social Security numbers, financial account numbers, credit or debit card numbers and driver's license numbers, for 436 Massachusetts residents. Hasbro has not given a total, a detection date or a cause, and did not link the incident to the Mar 28, 2026 cyberattack it disclosed in April. NOT ESTABLISHED: the total number of employees affected, when the account was compromised, and who was behind it.
patient SSNs and medical data exfiltrated from Salesforce and Snowflake; ShinyHunters claims 284M rows
MCKESSON DISCLOSED IN AN SEC FILING ON AUG 28, 2026 THAT DATA HAD BEEN EXFILTRATED FROM THIRD-PARTY APPLICATIONS SERVING ITS ONCOLOGY & MULTISPECIALTY AND MEDICAL-SURGICAL UNITS. The Irving, Texas drug distributor says it detected the intrusion on Aug 25, 2026. On Aug 31 the ShinyHunters group listed McKesson, claiming about 1 TB and 284 million rows of patient data taken from Salesforce and Snowflake environments between Aug 21 and Aug 25 after vishing calls to employees and takeover of Okta single sign-on accounts; it demanded more than $55 million and said McKesson never replied. McKesson's Sep 8 update said the data likely includes names, addresses, phone numbers, email addresses, patient IDs and dates of birth, and for some people health insurance details including Medicare and Medicaid IDs, medical information, billing and payment data and Social Security numbers. The 284 million figure is database rows, not people; Troy Hunt of Have I Been Pwned found 6.4 million unique email addresses in the set, drawn from patients, staff and marketing lists. NOT ESTABLISHED: the number of individuals affected, which McKesson says is still undetermined, and whether an HHS breach report has been filed.
Sources helpnetsecurity.com →hipaajournal.com →bleepingcomputer.com →
8.7M customers' contact details and vehicle registrations stolen
MANCHESTER AIRPORTS GROUP ANNOUNCED ON AUG 27, 2026 THAT AN ATTACKER HAD TAKEN DATA ON 8.7 MILLION CUSTOMERS OF MANCHESTER, LONDON STANSTED AND EAST MIDLANDS AIRPORTS. The stolen records come from car park, lounge and Fast Track bookings and from in-airport Wi-Fi sign-ups, and hold email addresses, phone numbers, postcodes and vehicle registration numbers. MAG says the affected system did not hold bank or payment details, that airport operations and aviation security were not disrupted, and that it has reported the incident to the National Cyber Security Centre and the Information Commissioner's Office. The attack took place over a weekend and the system was contained; MAG has not said when. Vehicle registrations tied to names and phone numbers are what number-plate camera networks match against. NOT ESTABLISHED: the date of the intrusion, how the attacker got in, who is responsible, and whether the data has been published or sold.
Sources radiox.co.uk →cxtoday.com →
12.9M customer records leaked by ShinyHunters after $3.3M ransom refused
THE SHINYHUNTERS GROUP PUBLISHED DATA ON ABOUT 12.9 MILLION CARHARTT CUSTOMERS IN LATE AUG 2026 AFTER THE WORKWEAR MAKER REFUSED A $3.3 MILLION RANSOM. The Dearborn, Michigan company was added to the group's leak site and, when negotiations ended, the archive was released; a message attributed to Carhartt's negotiator said the company would not continue talks. Troy Hunt of Have I Been Pwned loaded the set on Aug 25, 2026 and counted 12.9 million unique email addresses with names, phone numbers and postal addresses, after excluding millions of synthetic records that did not belong to real people. Hunt judged the data most likely came from Carhartt's Databricks analytics platform. The group also claimed employee and internal corporate data, which has not been verified. Carhartt had made no public statement at the time of reporting. NOT ESTABLISHED: the initial access method, whether Carhartt has notified customers or regulators, and whether the employee data claim is genuine.
Sources haveibeenpwned.com →techradar.com →bleepingcomputer.com →
July 2025 museum breach exposed SSNs, IDs and medical data; notices sent 13 months later
THE LOS ANGELES COUNTY MUSEUM OF ART POSTED A BREACH NOTICE ON AUG 24, 2026 FOR AN INTRUSION THAT RAN FROM JUL 7 TO JUL 11, 2025. LACMA says it detected suspicious activity on Jul 11, 2025, confirmed in Aug 2025 that part of its network had been accessed, received the first data-review results in late Feb 2026, and then spent months confirming contact details before writing to customers and employees. The exposed data, varying by person, includes full names, dates of birth, Social Security numbers, driver's license or government ID numbers, limited financial account and payment card numbers, health insurance information and medical details such as provider, diagnosis, treatment and dates. The notice was filed with the California attorney general. LACMA set up a call center and, per BleepingComputer, offered one year of identity protection with a Nov 22, 2026 enrollment deadline. NOT ESTABLISHED: the number of people affected, which LACMA declined to give, how the attackers got in, and whether any group claimed the attack.
Sources lacma.org →bleepingcomputer.com →esecurityplanet.com →
credential-stuffing attack exposed 138,828 US customers' details and partial card data
ONLINE FASHION RETAILER ASOS NOTIFIED 138,828 US CUSTOMERS IN AUG 2026 THAT ATTACKERS HAD LOGGED INTO THEIR ACCOUNTS WITH REUSED PASSWORDS. ASOS US Sales LLC detected unusual account activity on Jul 28, 2026, concluded on Jul 29 that an unauthorized party may have accessed accounts using credentials obtained outside ASOS, blocked the accounts and on Jul 30 forced password changes. Notification letters dated Aug 21, 2026 were filed with the California attorney general. Data visible in the accounts included names, email addresses, delivery and billing addresses, phone numbers, dates of birth, linked social-media account details, and partial payment card data (cardholder name, last four digits and expiry). ASOS said it blocked or cancelled a small number of suspicious transactions. The 138,828 figure comes from a law firm's investigation notice rather than from ASOS directly. NOT ESTABLISHED: whether non-US customers were also affected and whether ASOS has confirmed the count.
1.99M guests hit via vendor flaw, 46,727 cards with CVVs and 104K passport or licence numbers
QUEST APARTMENT HOTELS, AN AUSTRALIAN SERVICED-APARTMENT CHAIN, DISCLOSED A BREACH ON AUG 19, 2026 AND SAID ON SEP 16 THAT 1,991,613 CUSTOMERS WERE AFFECTED, INCLUDING 46,727 CREDIT CARDS WITH CVV CODES. Quest said unauthorised access to a database arose from a vulnerability at an unnamed third-party technology provider and that all affected records predate June 2025. Beyond names, addresses, phone numbers and emails, the data included 297,739 card numbers without CVVs, 225,300 vehicle registrations, 104,268 passport or driver's licence numbers, 3,328 dates of birth, 271 NDIS numbers and 46 Medicare numbers; some cards were expired. Quest notified the OAIC, the Australian Signals Directorate, the Australian Cyber Security Centre and Victoria Police and is contacting affected people directly. NOT ESTABLISHED: which provider was breached, who the attackers were, and whether the data has been published.
Sources cyberdaily.au →
1.2M borrowers' SSNs, IDs and bank data stolen from third-party cloud platform
CONSUMER LENDER HEIGHTS FINANCE DISCLOSED IN AUG 2026 THAT AT LEAST 1.2 MILLION PEOPLE'S DATA WAS STOLEN FROM A THIRD-PARTY CLOUD PLATFORM. Heights Finance Holdings Co. discovered on May 7, 2026 that an unauthorized actor had accessed a cloud-based platform it used to store customer data; it says its loan-management systems and internal networks were not affected. State attorney general filings give 734,828 Texans, 486,463 South Carolinians, 26 New Hampshire residents and 21 Vermonters. Exposed data varies by person and includes names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers, government and driver's license numbers, bank account information and loan account details. The company reported the incident to federal law enforcement, is offering 24 months of credit monitoring, and says dark-web monitoring has found no sign the data has been shared. No extortion group has claimed it. NOT ESTABLISHED: the name of the cloud vendor, the national total beyond the four states, and whether the data has been sold.
extortion group claims 2.1M Australian customers' records from third-party provider
A NEW EXTORTION GROUP CALLING ITSELF XPL0ITRS LISTED AUSTRALIAN RETAILER OZ HAIR AND BEAUTY ON ITS LEAK SITE ON AUG 18, 2026, CLAIMING 2.1 MILLION CUSTOMER RECORDS. The claimed data covers names, email and home addresses, phone numbers and the last four digits of active gift cards. The company told Cyber Daily the claim related to data held by an unnamed third-party provider and that its IT provider was investigating; the group's download link was broken at the time. xpl0itrs launched on Jun 12, 2026 and is reported to be linked to the TeamPCP group, with a focus on supply-chain breaches. NOT ESTABLISHED: whether the 2.1 million figure is genuine, which provider was breached, and whether the OAIC was notified.
Sources cyberdaily.au →
39,798 crypto hardware wallet buyers' names, addresses and orders exposed by plug-in flaw
CRYPTO HARDWARE WALLET MAKER SAFEPAL TOLD 39,798 CUSTOMERS ON AUG 16, 2026 THAT THEIR ORDER DATA HAD BEEN EXPOSED AND WAS BEING OFFERED FOR SALE. An authorization flaw in the order-tracking function of a store plug-in let anyone pull other customers' order records; a separate configuration error stopped a data-cleanup job from running between Sep 2025 and Apr 2026, so orders back to Mar 2, 2025 were still stored. Affected orders were placed between Mar 2, 2025 and Apr 11, 2026. Exposed fields are names, email addresses, shipping addresses, phone numbers and purchase details; SafePal says seed phrases, private keys, passwords, bank and card data and government IDs were not involved. Customers reported phishing emails and calls as early as May 2026, and a forum seller claims to hold the same data set. SafePal published a lookup tool for affected orders. For hardware-wallet buyers, a home address tied to a known crypto holding is a physical-security risk. NOT ESTABLISHED: whether the forum listing is genuine and how long the flaw was exploitable before May 2026.
ransomware group claims data from 1,778 user and 130 staff accounts
HONG KONG BAPTIST UNIVERSITY SAID ON AUG 16, 2026 THAT DATA FROM ABOUT 1,778 USER ACCOUNTS AND 130 STAFF ACCOUNTS WAS BELIEVED ACCESSED AFTER A RANSOMWARE GROUP CLAIMED AN ATTACK. The group calling itself TheGentlemen listed the university on its leak site. HKBU removed the affected web content, hired outside firms to review its IT systems and personal-data security, opened a hotline, and said it had received no ransom demand and would announce any confirmed personal-data breach. NOT ESTABLISHED: what data fields were in the accessed accounts, whether the Privacy Commissioner was notified, and whether the group has published the data.
2.8M patients' lab results, diagnoses and some SSNs stolen in June intrusion
BAYLOR GENETICS REPORTED 2,810,878 PEOPLE TO HHS AFTER AN INTRUDER SPENT A WEEK IN ITS NETWORK IN JUNE 2026. The Houston clinical genomics lab, which runs genetic tests for hospitals, says an unauthorized third party accessed part of its network from Jun 11 to Jun 17, 2026; suspicious activity was spotted around Jun 15 and the data review finished about Jul 30. Patient data includes names, dates of birth, addresses, medical testing information, laboratory results, diagnoses and health insurance details, with Social Security numbers for a limited subset; current and former employees lost Social Security numbers, government ID numbers and financial account information. Notification letters began Aug 14, 2026, and state filings reviewed by Hearst Television's consumer unit (which produced the Aug 28 WLWT report that generated this record) count about 248,000 Texans, 57,000 Massachusetts residents, 50,000 Illinois residents and 27,000 in Washington. Baylor Genetics says it knows of no confirmed misuse. NOT ESTABLISHED: how the attacker got in, whether any group claimed the attack, and whether raw genetic sequence data was among the lab results taken.
European Steam hardware buyers' delivery data stolen from shipping partner CEVA Logistics
VALVE BEGAN EMAILING EUROPEAN STEAM HARDWARE CUSTOMERS ON AUG 10, 2026 THAT THEIR DELIVERY DATA WAS STOLEN FROM ITS SHIPPING PARTNER CEVA LOGISTICS. CEVA, a CMA CGM subsidiary that handles Valve's European hardware shipments, said a cyberattack disrupted eight European warehouses; attackers were on its servers from Jul 29 to Aug 1, 2026 and Valve learned of the compromise on Aug 7. Taken were names, postal addresses, phone numbers, email addresses and the type and price of products ordered. Valve says payment data, passwords, Steam Guard codes and account data were not affected, warned of phishing by email, text and voice using the stolen details, and is notifying data protection authorities in the affected countries. NOT ESTABLISHED: the number of customers affected, the attacker, and whether CEVA's other retail clients lost data in the same intrusion.
3.8M patients' SSNs, scanned IDs and health data stolen from billing vendor
UNLIMITED TECHNOLOGY SYSTEMS REPORTED A BREACH OF 3,803,750 PEOPLE TO HHS IN EARLY AUG 2026, THE LARGEST US HEALTH DATA BREACH REPORTED TO FEDERAL REGULATORS AT THAT POINT IN 2026. The Montgomery, Ohio company sells billing and revenue-cycle software to more than 4,500 oncology practices and 6,500 specialty providers. It says an unauthorized actor was inside its commercial data center from Oct 5 to Oct 10, 2025 and that it detected the activity on Oct 19, 2025; notification letters went out about ten months later, in Aug 2026. Exposed data includes names, Social Security numbers, dates of birth, addresses, email addresses, phone numbers, health insurance details, medical record numbers, diagnoses and dates of service, plus scanned driver's licenses, insurance cards and intake forms. The company says complete medical records, medical images and payment card or bank data were not taken. Two years of Kroll identity protection are offered. The HIPAA Journal listing on Aug 6 and The Register's report on Aug 7 describe the same incident. NOT ESTABLISHED: how the intruder got in, whether any extortion group holds the data, and which provider clients' patients are affected.
Sources theregister.com →securityaffairs.com →bleepingcomputer.com →
all customers' names, addresses, phones and login IPs taken via Metabase zero-day
LAPTOP MAKER FRAMEWORK TOLD ALL OF ITS CUSTOMERS ON AUG 6, 2026 THAT THEIR DATA HAD BEEN TAKEN THROUGH ITS METABASE ANALYTICS VENDOR. Metabase, the business-intelligence service Framework uses, was hit by an unauthenticated SQL-injection zero-day (CVSS 10.0, versions 0.58 through 0.63) that gave the attacker administrator access; Framework's instance was accessed on Aug 3 and Metabase notified it on Aug 6. Exposed fields are full names, email addresses, billing and shipping addresses, phone numbers, company names and login IP addresses; business customers also had VAT, EIN and billing-email data exposed. Payment details were not involved. Framework rotated credentials and says no other systems were touched. Form builder Tally lost user email addresses and password hashes in the same Metabase campaign. A spokesperson said every customer was affected but gave no number. NOT ESTABLISHED: the customer count, the attacker's identity, and whether the login IP history was used to locate anyone.
Sources techcrunch.com →bleepingcomputer.com →notebookcheck.net →
3.75M patients' SSNs, IDs, bank and medical data stolen from its AWS cloud store
CARECLOUD TOLD HHS ON AUG 17, 2026 THAT MORE THAN 3.75 MILLION PEOPLE WERE AFFECTED BY ITS MARCH 2026 BREACH, UP FROM THE 345,000 IT FIRST NOTIFIED. The New Jersey electronic-health-records and billing vendor says hackers spent about six days in March 2026 inside a cloud data store in its Amazon Web Services account and exfiltrated patient data. Letters to the first 345,000 patients went out in late July and early Aug 2026, more than four months after the intrusion, with identity protection offered only where state law requires it. The HHS filing on Aug 17 was revised upward on Aug 18, and TechCrunch reported on Aug 19 that it was the fifth-largest health data theft of 2026 so far. The stolen set is the full identity bundle: names, addresses, dates of birth, Social Security numbers, driver's license, passport and other government ID numbers, bank account and card numbers, and medical and insurance information. No ransomware group has claimed the attack. NOT ESTABLISHED: whether the count will rise again, how the AWS environment was accessed, and whether the data has appeared for sale.
Sources hipaajournal.com →techcrunch.com →techcrunch.com →malwarebytes.com →
1.6M customer contact records leaked after ShinyHunters extortion refusal
RINGCENTRAL DISCLOSED ON JUL 28, 2026 THAT A SOCIAL-ENGINEERING ATTACK HAD EXPOSED CUSTOMER DATA; 1.6 MILLION RECORDS WERE LEAKED ON AUG 3. The Belmont, California cloud phone and messaging provider, which serves more than 600,000 businesses, said the attack affected a limited portion of its customers. The ShinyHunters extortion group had listed RingCentral on its leak site on Jul 27, claiming 623 GB, with a Jul 30 payment deadline. RingCentral did not pay. On Aug 3 the group published a 280 GB archive; on Aug 13 Have I Been Pwned confirmed roughly 1.6 million unique email addresses with names, phone numbers and postal addresses. No passwords or payment data were included. RingCentral says it has seen no further unauthorized activity and is contacting affected customers directly. SecurityWeek's Aug 14 report of 1.6 million likely affected describes this same incident. NOT ESTABLISHED: how the help-desk impersonation gained access, and whether business customers' end users are among the 1.6 million.
Sources bleepingcomputer.com →securityweek.com →haveibeenpwned.com →theregister.com →
900,000 current and former customers' details and partial payment data taken
ORIGIN ENERGY, ONE OF AUSTRALIA'S LARGEST ELECTRICITY AND GAS RETAILERS, CONFIRMED ON JUL 22, 2026 THAT AN INTRUDER HAD TAKEN DATA ON ABOUT 900,000 CURRENT AND FORMER CUSTOMERS OUT OF ROUGHLY 4.8 MILLION. Origin had been investigating a potential threat since early July that initially appeared not credible before new information confirmed the intrusion. The data included names, dates of birth, phone numbers, addresses, account information and partial payment card or bank account numbers. An individual claimed to hold data on 2 million customers and threatened to leak it, then told The Australian a deal had been reached and nothing would be released; Origin, whose CEO Frank Calabria called it a criminal matter under investigation, did not confirm any agreement and warned that other scammers could exploit the incident. A Reuters factbox in September 2026 listed the breach among Australia's largest alongside Optus, Medibank, Latitude, MediSecure and Qantas. NOT ESTABLISHED: how the attacker got in, whether a ransom was paid, and whether the data has been published.
55.3M AI-music accounts exposed, users never individually notified
The November 2025 breach of AI music platform Suno finally got a number on July 20, 2026, when Have I Been Pwned ingested the stolen dataset: 55.3 million unique accounts. Exposed data includes email addresses, phone numbers used as logins, names, physical addresses, purchase records, and partial payment-card details from tens of thousands of Stripe records -- card type, expiry, and last four digits. Suno had decided individual customer notifications were not required, so for most of its users the HIBP listing eight months later is the first practical way to learn they were in the dump. The case is becoming a reference point for how AI startups handle disclosure: a consumer platform with tens of millions of accounts, a breach it acknowledged only generally, and a notification standard outsourced to a volunteer-run lookup site.
first breach executed by an autonomous AI agent
Hugging Face, the platform hosting much of the world's open AI models, disclosed a high-severity breach on July 20, 2026 with a first for this ledger: the intrusion was carried out by an autonomous AI agent system exploiting vulnerabilities in production infrastructure. Entering through the data-processing pipeline, the attacker's agent stole cloud and cluster credentials, moved laterally across internal clusters, and took internal datasets before Hugging Face closed the holes, evicted the actor, and rebuilt compromised nodes. The inevitable milestone, arrived: AI attacking the AI supply chain, at machine speed, against the company whose job is distributing AI.
Sources upguard.com →
15M members' SSNs, Medicaid IDs and dental records stolen; largest US health breach of 2026
DENTAQUEST REPORTED 15 MILLION PEOPLE TO HHS, MAKING ITS MAY 2026 HACK THE LARGEST US HEALTH DATA BREACH REPORTED IN 2026. The Massachusetts dental-benefits administrator, the second-largest dental insurer in the country, says an intruder was in parts of its network from May 17 to May 20, 2026 and was discovered on May 20. The ShinyHunters extortion group claimed the attack in June and published about 234 GB; Have I Been Pwned found 2.6 million unique email addresses in the leak alongside names, addresses, phone numbers, dates of birth and genders, and one folder reportedly held more than 1.7 million Social Security numbers. DentaQuest's own notice lists names, addresses, Social Security numbers, member IDs, Medicaid and Medicare numbers, and dental or vision health information including diagnoses, treatment and billing details. Letters began going out on Jul 17, 2026 with 24 months of Kroll credit monitoring; the 15 million figure appeared on the HHS breach tracker by Aug 11, 2026, and one independent researcher estimated the total could reach 23.4 million. NOT ESTABLISHED: the final count, whether ransomware was deployed, and whether the company paid.
Sources securityaffairs.com →healthexec.com →techrepublic.com →
A prison payphone provider left personal documents of more than 300,000 people exposed to the open web -- part of a 2026 wave of leaks involving government-issued identity documents that TechCrunch tallied at over two million exposed passports and driver's licenses across a hotel check-in system, a money-transfer app, a UK visa service and this carceral phone vendor. The civil-liberties shape of this one is specific: the people in a prison phone provider's database are not customers who chose a brand -- they are families of incarcerated people, using the only channel the state permits, often at monopoly rates, and already subject to call recording and monitoring. The surveillance was mandatory and the data protection was optional. Anyone whose documents sat in that system got there by talking to a family member.
Sources techcrunch.com →
A UK visa service exposed applicants' passport scans and selfies to the web, in the same 2026 wave of identity-document leaks that reached a hotel check-in platform and a prison phone provider -- over two million people's government documents in total. Why it belongs on this map: a passport-plus-selfie pair is exactly the credential bundle that age-verification regimes (the UK Online Safety Act among them) now require ordinary people to upload to third parties to read and speak online. Every AV mandate builds more databases shaped like this one, and this is what happens to databases shaped like this one. The document-leak wave is the empirical case against upload-your-ID as the price of speech.
Sources techcrunch.com →
Hong Kong appliance distributor hack affects up to 1.05M people, staff HKID and bank data
HONG KONG APPLIANCE DISTRIBUTOR SHUN HING GROUP REPORTED A CYBERATTACK TO THE PRIVACY COMMISSIONER ON MAR 23, 2026 AND THE PCPD SAID IN JULY 2026 THAT UP TO 1.05 MILLION PEOPLE WERE AFFECTED. The company's April statement said attackers gained unauthorised access and encrypted its systems; more than 920,000 customers had names, addresses and email addresses exposed, and about 1,000 employees had identity card numbers, bank account details and salary information exposed. Shun Hing filed a police report and hired independent cybersecurity experts; the PCPD opened a formal investigation. NOT ESTABLISHED: the ransomware group involved, whether the data was published, and the outcome of the PCPD investigation.
Sources thestar.com.my →
300,000+ rail travelers' passport and ID details exposed
A breach at Eurail, which sells Interrail and Eurail passes, exposed the personal data of more than 300,000 travelers, including names, contact details, dates of birth, and passport or ID details, with some IBANs or health-related information. Some travelers were advised to replace their passports.
Sources brightdefense.com →
intelligence-sharing platform breached
The Department of Homeland Security confirmed on July 1, 2026 that an unknown attacker had breached HSIN, the sensitive-but-unclassified network that federal, state, local, tribal, and private-sector partners use to share intelligence, coordinate security for major events, and respond to incidents. First reported by Nextgov, the intrusion is believed to have happened between late May and early June and also hit an associated SharePoint system; DHS said it isolated the affected systems and that classified networks were not impacted, while it stayed unclear whether any data was taken. Sen. Mark Warner, vice chair of the Senate Intelligence Committee, called for a DHS and DOJ investigation, noting HSIN was supporting security for the World Cup underway in the US.
Sources techcrunch.com →nextgov.com →
US insurance regulators breached via Oracle PeopleSoft zero-day
The National Association of Insurance Commissioners -- the standard-setting body for US insurance regulators -- was breached by ShinyHunters through a zero-day in an Oracle PeopleSoft server. The group claimed 3.1 TB across roughly 105,000 files, including regulatory filings from 2017-2024, customer, order, and payment records, and credentials for production environments; NAIC's response was that only publicly available data, outdated logs, and configuration files were taken. The gap between those two descriptions is the story, and either way a regulator that holds filings from every US insurer was reachable through one unpatched enterprise server -- the same PeopleSoft vector ShinyHunters has been running against universities and agencies all year. Scale update: by mid-July the same PeopleSoft zero-day campaign had breached more than 100 organizations -- including Nissan's employee records across four countries -- before Oracle had even published an advisory.
The finding that ties this site's breach vertical to its censorship one: only 24 PERCENT of breach notices in the first half of 2026 disclosed how the breach occurred, down from 100 percent in 2020, per the Identity Theft Resource Center -- a transparency collapse that leaves victims unable to assess their own exposure and other organizations unable to defend against the same attack. The rest of the half-year picture: 281 healthcare breaches with 11.7 million notices; a sevenfold surge in malicious-insider incidents (21 in six months against 3 in all of 2025), which researchers tie to tech-sector layoffs and North Korean operatives posing as remote IT workers. What companies are not required to say is becoming as significant as what is taken.
Sources beckershospitalreview.com →
A Russian VPN provider exposed the personal records of roughly 865,000 users. This one belongs on a censorship tracker more than most: a VPN is what people reach for when a government blocks what they can read or when an age-verification wall demands their identity, and the UK's mandatory age checks alone drove a 1,400 percent surge in VPN sign-ups within days. The whole value of the tool is that no list of its users exists. When the provider itself is breached, the people most exposed are the ones who took a deliberate step to avoid being catalogued -- and in a jurisdiction where that choice can itself be treated as suspicious.
Sources tech.co →
The accommodation reservation provider confirmed unauthorized parties gained access to customer details, and did not say how many people were affected; financial information was not compromised. The undisclosed count is itself the entry's point, and it matches the Identity Theft Resource Center's finding that only 24 percent of 2026 breach notices explained how the breach happened, against 100 percent in 2020. Travel records are a movement history -- where someone stayed, when, and with whom -- which is precisely the category of data that ordinary people never think of as surveillance until it is in someone else's hands.
Sources tech.co →
attackers copy personal data from internal systems
The Danish maker of Ozempic and Wegovy disclosed on June 11, 2026 that attackers had reached a limited number of internal IT systems and copied non-public data, including personal data. The group claiming responsibility said it got in months earlier through an exposed high-privilege developer credential; healthcare-professional records were directly identifying, while clinical-trial patient data was pseudonymized.
Sources pkware.com →
3M+ hunting/fishing license holders' IDs stolen from state agency
The Texas Parks and Wildlife Department said a breach may have exposed the driver's license and passport numbers of more than 3 million people who bought hunting and fishing licenses. The theft of state-held government ID numbers underscores the risk created as age-verification and KYC systems push more people to hand over identity documents.
6.99M people's driver's licenses exposed by auto insurer
Auto insurer AssuranceAmerica told customers that hackers who breached its systems (discovered March 17, 2026) stole names, contact information, and driver's license numbers, along with policy, vehicle, and claims details. The company said the attackers targeted an employee and it disabled the compromised credentials. Regulatory filings to the Maine and Indiana attorneys general put the total at about 6.99 million people. Update, July 8, 2026: filings with the Indiana and Maine attorneys general put the toll at 6.99 million people, with notification letters going out July 10 -- among the largest driver's-license spills in the year's run of identity-document breaches. TechCrunch noted Maine's own breach-disclosure portal was offline at the time, under review after someone published a fraudulent breach notice on it.
Sources techcrunch.com →
455K students' and alumni records, including passports, leaked
ShinyHunters leaked files from the University of Nottingham's student records system. Have I Been Pwned found roughly 455,000 unique email addresses along with names, addresses, phone numbers, passport numbers, and sensitive fields such as ethnicity, disability, citizenship status, and fee-payment data for current students and alumni.
Sources securityweek.com →
Tchap government messaging platform breach hits 73K accounts
France's interministerial digital directorate DINUM disclosed a breach of Tchap, the government's sovereign messaging platform, after an account-hijacking incident on June 7, 2026. Officials said 73,467 accounts were affected; an actor using the name 'misere' claimed to have taken 13.5GB of messages and user data, a larger claim officials had not verified.
Sources securityweek.com →
14.2M email accounts exposed across six Japanese ISPs
Japanese carrier KDDI disclosed a breach of an email platform it provides to six ISPs (STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and Biglobe). Up to 14.22 million email addresses and passwords may have been exposed after attackers exploited a third-party software vulnerability; the company urged users to change passwords.
Sources infosecurity-magazine.com →
2.2M customer and corporate records claimed stolen
Kodak confirmed a June 2026 breach after ShinyHunters claimed it stole 2.2 million customer and corporate records and listed the company on its leak site. Kodak said an unauthorized third party temporarily accessed a limited amount of data but had not verified the record count or full scope.
Sources brightdefense.com →
legacy senior-patient records accessed
Amazon-owned One Medical disclosed that a third-party file-storage platform holding archived records for legacy Iora Health and One Medical Seniors patients was accessed in June 2026. Affected files included demographic and clinical data across nine metro areas; ShinyHunters claimed 8.8TB of data, which One Medical had not confirmed.
Sources onemedical.com →
26M+ records with facial-recognition and biometric data exposed
ShinyHunters used a voice-phishing call to breach Madison Square Garden Entertainment and published a trove the group said covered up to 26 million people. The leaked data reportedly included MSG's facial-recognition entry-surveillance logs, biometric data, background-check reports, and threat-assessment profiles built on visitors and celebrities, plus attendee contact details. MSG had not confirmed the scope; multiple class actions followed.
Sources cpomagazine.com →
insurer breach exposes personal and bank-account data
US supplemental-insurance giant Aflac disclosed a 2026 breach after attackers compromised its Japan subsidiary, stealing personal information and bank account details for about 4.38 million customers, along with policy and coverage data.
985,000 passports and licenses left on the open web
A security researcher found roughly 985,000 passport and driver's-license photos from an identity-verification company sitting on public web servers -- no password, no encryption, reachable by anyone with the URL, for months. The firm had collected the documents to perform age and identity checks, exactly the kind of KYC and age-verification screening that laws are pushing onto more of the internet, then stored the resulting ID scans as if they were disposable public images.
Sources schneier.com →
customer contact and support data stolen via the Klue supply-chain hack
LastPass disclosed on June 24, 2026 that attackers reached customer data in its Salesforce environment after the Icarus extortion group compromised Klue, a market-intelligence vendor, and stole the OAuth tokens Klue held for many of its customers. Exposed data was limited to names, email addresses, phone numbers, physical addresses, and customer support-case records; LastPass said its products, infrastructure, and encrypted password vaults were not affected. The same Klue supply-chain attack hit more than a dozen firms including Recorded Future, Tanium, and Jamf.
students' and alumni data exposed in a careers-platform breach
The University of Oxford disclosed in early June 2026 that its CareerConnect careers platform, run by third-party provider Group GTI, had been breached on May 28. Attackers accessed the first names, last names, and email addresses of students, alumni, research staff, and recruiters, plus encrypted passwords for users who logged in with a local password rather than Oxford's single sign-on. Oxford said the attack appeared aimed at harvesting credentials for phishing; no financial or course data was involved. It was Oxford's second third-party breach of 2026.
employee survey data stolen from a third-party HR tool
A hacker using the handle SHADOWBYT3$ claimed on June 13, 2026 to have stolen about 859 MB of data from TinyPulse, a third-party employee-survey service used by Nintendo of America, and demanded a $2 million ransom. Nintendo confirmed the incident but said it was limited to internal survey content for a small subset of employees, that its own systems were not compromised, and that no customer or financial data was involved -- disputing the attacker's claim that bank statements and W-9 tax forms were included. Most of the data reportedly dated back several years.
Researchers at Cybernews found a publicly exposed database of more than 8.3 terabytes holding about 24 billion credential records -- usernames, passwords, and other account data -- reportedly drawn from 36 sources including Telegram channels, earlier breach compilations, and infostealer logs, with some datasets apparently exported directly from live servers. The trove was taken offline soon after discovery, so the number of duplicate records could not be confirmed.
Sources malwarebytes.com →
staff payslips, personnel files, and CVs claimed stolen
The Council of Europe, the continent's oldest intergovernmental body, said in June 2026 that it was investigating a data-breach claim by the ShinyHunters extortion group. The attackers claimed to have taken more than 409,000 payslips covering over 10,000 staff from 2011 to 2026, along with thousands of personnel files and CVs, said to include names, dates of birth, home addresses, phone numbers, employee IDs, salaries, bank-account and tax details, and some medical records.
Sources privacyguides.org →
1.6M booking files with guests' names and birth dates taken
PIERRE & VACANCES-CENTER PARCS SAID IN MID-MAY 2026 THAT A CYBERATTACK ON MAY 14 ON ITS BOOKING SITE LA FRANCE DU NORD AU SUD, A MAEVA SUBSIDIARY, HAD EXPOSED 1.6 MILLION BOOKING FILES. The exposed data included occupants' names, dates of birth, phone numbers and detailed stay information; the group said email addresses and bank details were not taken. The attacker claimed data on more than 4 million people, which IT-Connect noted is plausible because one booking file covers several guests. The group said it had notified affected customers and filed a complaint against persons unknown; the main risk flagged was phone scams impersonating the booking provider to extract card details. NOT ESTABLISHED: how the attackers got in, the confirmed number of people, and whether the CNIL has opened a procedure.
Sources it-connect.fr →
197,400 customers' emails, locations and purchases stolen from former provider
HAVE I BEEN PWNED ADDED A ZARA BREACH OF 197,400 PEOPLE ON MAY 8, 2026 AFTER ANALYSING DATA STOLEN FROM DATABASES HOSTED BY A FORMER INDITEX TECHNOLOGY PROVIDER. Inditex disclosed the incident in April 2026 and said the affected databases belonged to an unnamed former provider, that its own systems and operations were unaffected and that several international companies were hit through the same provider. ShinyHunters claimed responsibility and leaked a 140 GB archive it said came from BigQuery instances reached with compromised Anodot authentication tokens; Inditex has not attributed the attack. Exposed fields are email addresses, geographic locations, purchases with product SKUs and order IDs, and support tickets with their market of origin; Inditex says names, phone numbers, addresses, credentials and payment data were not accessed. Inditex says it is notifying authorities. NOT ESTABLISHED: the total count across all Inditex markets, whether customers were notified directly, and the provider's identity.
Sources bleepingcomputer.com →
15 million files leaked from the country's largest media group
Mediaworks, Hungary's largest media group, disclosed on May 4, 2026 that it had suffered a serious cyberattack on April 30. Hungary's data protection authority later said the attackers had unlawfully obtained nearly 15 million files, about 8.5 terabytes, and published them on the dark web, including names, addresses, bank-account details, internal records, and public-interest documents. The company said its investigation was ongoing and warned readers about phishing abuse.
Sources brightdefense.com →
Trellix -- formed from the McAfee Enterprise and FireEye merger, protecting more than 50,000 business and government customers -- disclosed unauthorized access to part of its source code repository on May 4, 2026. No customer records are known to have been taken, which is why it appears here as a structural entry rather than a scale one: source code from a security vendor is a map of the defences protecting tens of thousands of other organisations, including governments. It joins Aura, the identity-protection company breached by voice phishing, in the year's quiet theme -- the companies selling protection are inside the blast radius too.
Sources brightdefense.com →
30M+ students' and staff data stolen
ShinyHunters breached the Canvas learning-management system run by Instructure twice within two weeks in April-May 2026, claiming data from nearly 9,000 institutions (including Harvard and Princeton). Personal information of more than 30 million students and staff was taken -- names, emails, student IDs and private messages -- and the attackers defaced Canvas login screens during finals. Instructure paid a ransom.
Sources techcrunch.com →cloaked.com →
law-firm breach exposes clients' IDs and health data
Law firm Blank Rome disclosed a May 2026 breach in which an attacker posed as IT over the phone and tricked an attorney into uploading files to an external account. The exposed client information may have included Social Security numbers, driver's license, state ID and passport numbers, other government IDs, financial account and payment-card data, and medical and health-insurance information.
Sources forthepeople.com →
1 million hotel guests' passports and licenses left on the open web
Tabiq, a Japanese hotel check-in platform run by startup Reqrea, left an Amazon S3 storage bucket public, exposing more than 1 million guests' passports, driver's licenses, and facial-verification selfies to anyone who knew the bucket name. Files spanned early 2020 to May 2026 and covered travelers from many countries. A researcher found it and TechCrunch alerted the company and Japan's JPCERT, after which it was locked down; the exposure window and whether others accessed it remain unknown.
national ID portal (ants.gouv.fr) breach hits 11.7M accounts
France Titres, which runs the government identity portal ants.gouv.fr, confirmed a breach exposing about 11.7 million accounts (a threat actor advertised up to 19 million). Exposed fields included login IDs, names, email addresses, dates of birth and unique account IDs, and sometimes postal addresses, birthplaces and phone numbers. A 15-year-old suspect was detained on April 25, 2026.
Sources brightdefense.com →
employee SSNs and birth dates sent to outside partners in a district email
SPRING ISD, NORTH OF HOUSTON, CONFIRMED ON APR 10, 2026 THAT A DISTRICT EMAIL HAD EXPOSED EMPLOYEES' SOCIAL SECURITY NUMBERS. On Apr 9, 2026 a message to community partners about Teacher Appreciation Week inadvertently included other employees' names, Social Security numbers and dates of birth. The district told its roughly 5,600 employees late on Apr 10, asked recipients to delete the message, notified state agencies, placed the employees who sent it on administrative leave and offered credit-monitoring resources to all staff. The incident was an internal error, not an outside intrusion. NOT ESTABLISHED: how many employees' records were in the email, and how many outside recipients received it. The Aug 4, 2026 Houston Chronicle item that generated this record could not be retrieved, so any later development it reported is not recorded here.
Sources abc13.com →
China-linked breach of a wiretap surveillance system
The FBI told Congress that a suspected China-linked intrusion into an unclassified network holding pen-register and trap-and-trace surveillance data (the DCS-3000 'Red Hook' collection system) was a 'major incident' under FISMA. First detected Feb 17, 2026 and reportedly reached through a commercial ISP's vendor infrastructure, the breach is believed to have exposed the phone numbers of people under active FBI surveillance.
Sources nbcnews.com →thehill.com →
A threat actor publicly claimed access to Adobe support systems on Apr 3, 2026, asserting 13 million support tickets, 15,000 employee records, HackerOne submissions and internal documents. Support tickets are an underrated exposure: people paste screenshots, licence keys, account details and sometimes identity documents into them while trying to fix a problem, with no expectation that the thread is a permanent record. Reported downstream victims of the wider campaign included LastPass, Huntress, Recorded Future, Tanium, Jamf, Gong, Sprout Social and HackerOne itself. CLAIM STATUS: figures are the attacker's, not a company disclosure.
Sources brightdefense.com →
vishing call exposes millions of customer records
One of the largest U.S. broadband providers was compromised on April 1, 2026 when the ShinyHunters group used a voice-phishing call to obtain an employee's Microsoft Entra credentials and reach Charter's Salesforce environment. Charter said only sales tools were affected, but breach monitoring tied the published data to about 4.9 million people (the group claimed 42 million records): names, emails, phone numbers and home addresses.
3.83M people's SSNs and health data taken in April ShinyHunters hack
MEDTRONIC REPORTED 3,834,294 PEOPLE AFFECTED TO THE INDIANA ATTORNEY GENERAL WHEN IT BEGAN MAILING BREACH LETTERS, SECURITYWEEK REPORTED, FAR BELOW THE 9 MILLION RECORDS THE SHINYHUNTERS GROUP CLAIMED. The medical-device maker confirmed in late April 2026 that attackers had reached its corporate IT systems after ShinyHunters listed the company on its leak site on Apr 17, 2026. The letters say names, contact details, dates of birth, Social Security numbers and health-related information were involved, that products, manufacturing and distribution were not affected, and that Medtronic has no evidence the data was posted publicly; it offers 24 months of credit, dark-web and identity-restoration monitoring, added safeguards, and notified law enforcement and regulators. A notification letter was also filed with the California attorney general. The group later removed Medtronic from its leak site; whether a ransom was paid is not known. NOT ESTABLISHED: how the attackers got in, the letter date, the HHS OCR count, and whether the 9 million claim counted records or people.
cruise operator breach exposes 6M passengers' passport and license numbers
Carnival, the world's largest cruise operator, disclosed that a social-engineering attack on a single employee account (identified April 14, 2026) let an attacker copy personal data on about 6 million people, including names, addresses, dates of birth, and government-issued ID numbers such as driver's license and passport numbers.
Sources securityweek.com →
breach exposes SSNs of customers and dependents
Equipment maker Kubota disclosed a breach that took place between March and April 2026, which may have exposed full names -- including those of dependents -- and Social Security numbers, among other personal details. The company had not confirmed the number of people affected.
Sources privacyguides.org →
KYC passports, licenses and selfies left on open server
A misconfigured, password-free Amazon server run by the money-transfer app Duc left hundreds of thousands of files reachable to anyone, dating back to 2020 -- government-issued IDs such as driver's licenses and passports, know-your-customer selfies, and spreadsheets of names, addresses, and transactions. Another example of KYC identity checks becoming the leak.
Sources privacyguides.org →
3.6 million exposed through a shared vendor
In April 2026 the Everest ransomware group claimed data from two major US banks breached through a shared third-party vendor rather than the banks themselves -- about 3.4 million records from Citizens and over 250,000 Social Security numbers and tax IDs from Frost Bank -- a textbook case of shared-vendor risk cascading across financial institutions.
Sources strobes.co →
13.5 million accounts exposed in Salesforce data theft
Education publisher McGraw-Hill was caught in the 2026 wave of Salesforce-related thefts by ShinyHunters; Have I Been Pwned confirmed 13.5 million unique email addresses in the leaked data, alongside names, phone numbers, and physical addresses -- a broad spear-phishing risk across its student and educator base.
Sources strobes.co →
5.5 million customers' data stolen
Home-security company ADT confirmed an April 2026 intrusion after ShinyHunters claimed the theft; Have I Been Pwned measured about 5.5 million people in the exposed dataset. Stolen data was mostly names, phone numbers, and addresses, with dates of birth and the last four digits of Social Security or tax IDs included for a smaller share.
Sources brightdefense.com →
stolen API keys exposed 212,523 users' Turkish ID numbers, found a year later
TURKISH CONSUMER-COMPLAINTS PLATFORM SIKAYETVAR NOTIFIED KVKK THAT THIRD PARTIES WHO OBTAINED ITS API KEYS TOOK 212,523 USERS' NAMES, TURKISH NATIONAL ID NUMBERS, PHONE NUMBERS AND EMAIL ADDRESSES; THE BOARD PUBLISHED THE NOTICE ON MAR 13, 2026. The breach occurred Apr 24-26, 2025 but was not detected until Mar 2, 2026, about a year later. KVKK published the Sikayetvar and Baydoner notices together, putting more than 1.7 million people's identity and contact data at risk across the two. NOT ESTABLISHED: who used the API keys, whether the data was published, and what sanction KVKK imposed.
Sources iscihaber.net →
supplier call-centre platform holding 1.49M customers' ID numbers accessed
TURKISH RESTAURANT CHAIN BAYDONER NOTIFIED KVKK THAT A SUPPLIER-RUN CUSTOMER SERVICE AND CALL CENTRE PLATFORM HOLDING 1,490,789 PEOPLE'S DATA WAS ACCESSED WITHOUT AUTHORISATION FROM FEB 15, 2026; THE BOARD PUBLISHED THE NOTICE ON MAR 13, 2026. The intrusion was identified on Mar 8, 2026. Data in the system included names and contact details, Turkish national ID numbers, app passwords and order and delivery details; Baydoner said the number actually affected had not yet been determined. NOT ESTABLISHED: the confirmed count, which supplier ran the platform, and whether KVKK fined the company.
Sources iscihaber.net →
2.8 million accounts leaked after extortion
In March 2026 ShinyHunters claimed records from Hallmark Cards' Salesforce environment and, after an unmet extortion deadline, leaked more than 2.8 million unique accounts -- customer names, phone numbers, physical and email addresses, and dates of birth.
Sources proton.me →
1.5 million exposed at an identity-protection company
In March 2026 identity-protection company Aura confirmed a breach after an employee fell for a voice-phishing (vishing) attack, giving ShinyHunters access through a marketing tool. More than 1.5 million records of customer names, addresses, phone numbers, and email addresses were exposed -- a pointed irony for a firm that sells identity protection.
Sources proton.me →
500,000 customers' bank and National Insurance data exposed
A March 2026 software glitch at Lloyds Banking Group let around half a million UK customers of Lloyds, Halifax, and Bank of Scotland view other people's sensitive data -- transactions, sort codes, account numbers, and even National Insurance numbers -- and in some cases data belonging to customers of other banks.
Sources cybermagazine.com →
15M French patients' details and doctors' notes stolen from practice software
A HACKER TOLD FRANCE 2 IN FEBRUARY 2026 THAT HE HAD TAKEN THE PATIENT DATABASE OF MONLOGICIELMEDICAL.COM, CEGEDIM'S PRACTICE SOFTWARE USED BY ABOUT 3,800 FRENCH DOCTORS; THE HEALTH MINISTRY PUT THE NUMBER OF PEOPLE AFFECTED AT ABOUT 15 MILLION. France 2 estimated 11 to 15 million people; the hacker claimed 19 million records with 150,000 unique email addresses. The data included names, dates of birth, postal and email addresses and phone numbers; about 169,000 records carried a doctor's free-text comment, some mentioning serious illness, addiction, sexuality or religion, though medical records themselves were not in the database. Cegedim said it found abnormal access to doctors' accounts in late 2025, filed a complaint on Oct 27, 2025 after staff received extortion emails claiming several thousand records, contacted affected doctors in January 2026 and informed the CNIL; Paris prosecutors referred the case to the cybercrime brigade. The database was taken down from the dark web but reportedly remained for sale. NOT ESTABLISHED: the final count, how the doctor accounts were accessed, and whether patients have been notified individually.
Sources futura-sciences.com →
1.8M patients' records, IDs and biometrics taken
The largest public health system in the U.S. said an attacker reached its network through a third-party vendor from late November 2025 through February 2026 and copied files on at least 1.8 million people -- medical records, Social Security numbers, driver's licenses and passports, and biometric fingerprints and palm prints -- one of the largest healthcare breaches reported to HHS in 2026.
Sources cloaked.com →pkware.com →
6.2 million customers, with passport and license numbers
In February 2026 attackers broke into a customer-contact system at Odido, the largest mobile operator in the Netherlands (formerly T-Mobile NL), and downloaded data on about 6.39 million people -- roughly one in three Dutch residents. The haul included names, addresses, phone numbers, dates of birth, bank account (IBAN) numbers, and, for many, passport or driver's-license numbers, a near-complete identity-theft toolkit.
Sources therecord.media →
3 million records with SSNs stolen
US fintech lender Figure Lending confirmed a February 2026 breach after an employee was socially engineered into giving ShinyHunters access via the company's Okta single-sign-on. More than 3 million records were exposed, including names, dates of birth, addresses, phone numbers, email addresses, passwords, and Social Security numbers.
Sources proton.me →
national biometric, passport and voter database hit
Senegal's Directorate of File Automation (DAF), the agency that manages national ID cards, biometric records, passports, and electoral data, was hit by a February 2026 cyberattack that compromised about 139 terabytes -- the citizen database, biometric records, and immigration files -- and halted document production for days. The number of individuals was not quantified, but it reaches much of the country.
Sources sharkstriker.com →
3.4M affected in healthcare billing vendor breach
TriZetto Provider Solutions, a Cognizant-owned revenue-cycle vendor that processes billions of US healthcare transactions a year, reported a breach to the HHS Office for Civil Rights in February 2026 affecting about 3,433,965 people -- the largest single healthcare breach reported to OCR in the first half of 2026. An unauthorized party had accessed insurance eligibility-verification records, with access beginning around November 2024.
Sources paubox.com →techtarget.com →
CPF and RG numbers of 9M residents, 93% of the state, posted free on a forum
A DATASET WITH THE CPF TAX NUMBERS, RG IDENTITY NUMBERS, EMAIL AND HOME ADDRESSES OF MORE THAN 9 MILLION RESIDENTS OF PERNAMBUCO, ABOUT 93 PERCENT OF THE BRAZILIAN STATE'S POPULATION, WAS POSTED FREE ON AN INTERNET FORUM, TNH1 REPORTED ON JAN 18, 2026. The outlet said the data came from federal systems but did not name the agency; the state health secretariat SES-PE responded by activating its LGPD data protection officer, tracing the leak's origin and tightening security practices. The data was unencrypted and the perpetrators were not identified. NOT ESTABLISHED: which system the data came from, whether the national data authority ANPD opened a case, and whether the data is genuine.
Sources tnh1.com.br →
10M+ records claimed stolen from Hinge, Match, and OkCupid
ShinyHunters claimed in late January 2026 to have stolen more than 10 million records tied to Match Group's dating apps -- Hinge, Match, and OkCupid -- via a social-engineering attack on Okta SSO access. The data reportedly included user IDs, IP addresses, Hinge subscription transaction IDs and amounts paid, and internal employee emails. Match Group said it was investigating.
Sources brightdefense.com →
1 million gym members' bank details exposed
European gym chain Basic-Fit confirmed a 2026 breach affecting around 1 million members, exposing bank account details, names, dates of birth, and other contact information -- the account numbers being the standout risk for direct-debit fraud.
Sources tech.co →
2.7 million owners' SSNs and driver's licenses exposed
Automaker Hyundai suffered a 2026 breach compromising the personal data of up to 2.7 million owners, with the stolen records including Social Security numbers and driver's-license details.
Sources tech.co →
employees' SSNs and national IDs stolen via Oracle zero-day
Nissan warned current and former employees of a 2026 breach after attackers exploited an Oracle PeopleSoft vulnerability, part of a wider extortion campaign. Exposed data could include contact and banking information, Social Security numbers, Social Insurance Numbers, national identification numbers, and tax and beneficiary details.
Sources privacyguides.org →
~1 million exposed
System failures at the Illinois and Minnesota human-services departments exposed the personal data of nearly a million people in early 2026. In Illinois sensitive case information sat publicly visible for years; in Minnesota excessive internal access led to improper disclosure. Exposed fields included names, addresses, dates of birth, Medicaid IDs, and the first digits of Social Security numbers.
Sources pkware.com →
185,000 people's SSNs and licenses in franchise-document leak
A 2026 breach tied to 7-Eleven's franchisee-document systems exposed roughly 185,000 people; filings reportedly referenced Social Security numbers and driver's-license numbers, and the company offered identity-protection services to those affected.
Sources brightdefense.com →
1.4 million patients' SSNs and health data stolen
Tennessee healthtech firm Xsolis disclosed a January 2026 breach, blamed on a phishing attack, that affected roughly 1.4 million people. Social Security numbers and health-insurance information were among the data believed stolen.
Sources tech.co →
customers' SSNs and driver's licenses left accessible by a software setting
Petco disclosed in December 2025 that a misconfigured setting in one of its applications had left customer files accessible online, exposing names, Social Security numbers, driver's license numbers, financial account and card numbers, and dates of birth. Discovered during a July 2025 security review, the retailer notified customers months later and filed breach reports in Texas, California, Massachusetts, and Montana. Petco, which serves over 24 million customers a year, did not disclose the total number affected.
Sources techcrunch.com →foxnews.com →
33.7M customers' names, addresses and door codes taken by ex-employee; record 624.7B won fine
SOUTH KOREA'S LARGEST ONLINE RETAILER COUPANG ADMITTED IN LATE NOVEMBER 2025 THAT ABOUT 33.7 MILLION CUSTOMER ACCOUNTS HAD BEEN ACCESSED, AND ON JUN 11, 2026 THE PERSONAL INFORMATION PROTECTION COMMISSION FINED IT A RECORD 624.7 BILLION WON (ABOUT $409 MILLION). The PIPC found that a Chinese former employee who had built Coupang's alternative login system took its signing key when he left at the end of 2024, tested it on 95 accounts in January 2025, and from April to October 2025 cycled through member IDs about 148 million times to harvest names, phone numbers, home addresses, apartment entry codes, email addresses and order histories, then sent extortion emails to Coupang and to customers. Coupang's first report in November covered about 4,500 accounts before the figure rose to 33.7 million. The PIPC confirmed 33,222,472 members plus at least 4,338,368 non-members stored as delivery recipients, about 37.6 million people in all. It referred Coupang for prosecution over deleting six months of access logs after being ordered on Nov 21, 2025 to preserve them, and fined it a further 201.1 billion won for covertly tracking the browsing of 11.2 million users. The Consumer Dispute Settlement Commission ordered 100,000 won per victim on Jul 31, 2026; Coupang said it may challenge the fine. NOT ESTABLISHED: whether the data was sold or published beyond the extortion emails, the outcome of the criminal case against the former employee, and whether Coupang's appeal proceeds.
nation-state actor lived in BIG-IP source code for a year
F5 disclosed on October 15, 2025 that a nation-state actor -- linked by Bloomberg to China's BRICKSTORM/UNC5221 cluster -- had persistent access to the development environment of BIG-IP, the load balancers and gateways that sit in front of a huge share of the world's networks, for at least twelve months. Stolen: portions of BIG-IP source code, F5's internal notes on undisclosed vulnerabilities, some customer configurations, and employee data. Detection came August 9; disclosure waited until October at the Justice Department's direction. CISA issued an emergency directive the same day -- its language was that the actor posed an imminent threat capable of full compromise of targeted systems -- ordering every federal civilian agency to patch or disconnect, with roughly 680,000 F5 devices visible on the open internet. Nobody's personal data was the product here; the product was the master key to everyone else's.
Sources cybersecuritydive.com →therecord.media →thehackernews.com →
70,000 government-ID photos stolen from an age-verification vendor
Discord said in October 2025 that hackers breached a third-party support vendor and stole data from users who had filed age-related appeals, including about 70,000 photos of government IDs (driver's licenses and passports) taken as selfies to prove their age. Also exposed were names, usernames, emails, support-chat transcripts, limited billing metadata including the last four digits of cards, and IP addresses. The attackers claimed a far larger haul of up to 2.1 million ID images, which Discord disputed as an extortion tactic.
Sources techcrunch.com →nbcnews.com →
430,000 customer records exposed through external supplier
HARRODS SAID ON SEP 26, 2025 THAT A CYBERATTACK ON ONE OF ITS EXTERNAL SUPPLIERS HAD EXPOSED ABOUT 430,000 CUSTOMER RECORDS. The data covered basic identification details: names, email addresses and other contact details, plus references tied to loyalty and marketing programmes; Harrods said no payment data was involved. The attackers tried to contact the store, which said it would not engage, and Harrods said the incident was unrelated to an intrusion attempt it blocked in April 2025. Customers were told by email and Harrods said it was working with UK authorities and regulators and would tighten oversight of third-party vendors. NOT ESTABLISHED: which supplier was breached, who the attackers were, and whether the ICO has taken action.
Sources incibe.es →
2.97M cardholders hit as 200GB of payment data taken through unpatched server
LOTTE CARD, SOUTH KOREA'S FIFTH-LARGEST CARD ISSUER, SAID ON SEP 18, 2025 THAT HACKERS HAD TAKEN ABOUT 200 GIGABYTES OF DATA COVERING 2.97 MILLION CUSTOMERS, ABOUT A THIRD OF ITS 9.6 MILLION CARDHOLDERS. Attackers scanned an online payments server on Aug 12, 2025, installed malicious code on Aug 13 and exfiltrated data until Aug 27 through a web shell, exploiting a vulnerability patched elsewhere in 2017 but missed on one server used for a rarely used overseas payment service. Lotte Card found the intrusion in a routine check on Aug 26, confirmed it on Aug 31 and first reported about 1.7 GB; the Financial Supervisory Service probe that began Sep 2 put the total above 200 GB. About 280,000 customers had card numbers, expiry dates and security codes exposed and were told to reissue cards; the remaining 2.69 million had connection data, virtual payment codes and internal IDs exposed. Only 56 percent of the 2,700 leaked files were encrypted. CEO Cho Jwa-jin pledged 110 billion won for security over five years and full compensation for any secondary damage. NOT ESTABLISHED: whether the data has been used for fraud, who the attackers were, and what sanction the regulators imposed.
Sources koreaherald.com →
rogue femtocell intercepted subscribers' IMSI, IMEI and SMS codes for micropayment fraud; 54B won fine
KT, SOUTH KOREA'S SECOND-LARGEST MOBILE CARRIER, DISCLOSED IN SEPTEMBER 2025 THAT ATTACKERS USING A ROGUE FEMTOCELL (SMALL BASE STATION) HAD INTERCEPTED SUBSCRIBERS' PHONE NUMBERS, IMSI AND IMEI IDENTIFIERS AND SMS VERIFICATION CODES TO MAKE FRAUDULENT MICROPAYMENTS, AND AT THE END OF JULY 2026 THE PERSONAL INFORMATION PROTECTION COMMISSION FINED IT ABOUT 54 BILLION WON. SBS Biz reported 22,227 customers affected, with 368 people hit by 777 fraudulent payments worth about 243 million won; ImmuniWeb's summary of the PIPC announcement cited 16,647 people. The attackers obtained a lost KT femtocell holding a valid certificate, which stayed valid for ten years, and cloned it onto a fake device that KT's network accepted. The PIPC also found 38 KT servers infected with malware including the BPFDoor backdoor from as early as March 2024, which KT handled internally without reporting, and said KT deleted network logs so the full extent of data theft could not be determined; attackers had access to the internal network for about 11 months from October 2024. The government asked KT to waive penalty fees for all customers. NOT ESTABLISHED: the final count (22,227 versus 16,647), whether the 2024 server intrusion took customer data, and who the attackers were.
Sources biz.sbs.co.kr →immuniweb.com →
live copy of every American's Social Security file moved to a cloud only DOGE could see
The Social Security Administration's own chief data officer, Charles Borges, filed a whistleblower complaint with the Office of Special Counsel and Congress on August 26, 2025: DOGE staffers had copied NUMIDENT -- the master file of every Social Security number ever issued, over 548 million records with names, birth dates, parents' names, citizenship, and ethnicity for 300M+ living Americans -- into a cloud environment only DOGE personnel could access, with no security oversight and no logging of who touched it. Career security officials had refused the request; a DOGE-affiliated official approved it with one word. Borges, who was never consulted, warned that a compromise could mean reissuing every American a new SSN. No exfiltration was proven -- that is precisely the problem: with no tracking, no one can say. Filed here as an exposure, not a confirmed theft, and as the ledger's largest single concentration of identity data placed outside normal controls.
485,000 Dutch cervical-screening participants' BSN numbers and results stolen
DUTCH LAB CLINICAL DIAGNOSTICS NMDL, A EUROFINS SUBSIDIARY THAT ANALYSES CERVICAL SCREENING SAMPLES FOR THE NATIONAL POPULATION SCREENING PROGRAMME, WAS HACKED AND DATA ON MORE THAN 485,000 PARTICIPANTS WAS STOLEN, THE HEALTH MINISTRY TOLD PARLIAMENT ON AUG 11, 2025. The breach was discovered on Jul 6, 2025. The stolen data included names, addresses, BSN citizen service numbers, phone numbers, email addresses and test results. Bevolkingsonderzoek Nederland suspended its contract with the lab, reported the breach to the Autoriteit Persoonsgegevens and the health inspectorate, set up a crisis team and promised letters to participants; RIVM called in the National Cyber Security Centre and ordered an independent investigation into the lab's security. The minister said screening results were not affected. NOT ESTABLISHED: who carried out the attack, whether the data has been published, and whether the lab or BVO NL face sanctions.
Sources privacy-web.nl →
4.4 million people's SSNs exposed at a credit bureau
Credit bureau TransUnion disclosed in August 2025 that attackers reached a third-party Salesforce environment and took data on more than 4.4 million US individuals, including names, addresses, dates of birth, and unredacted Social Security numbers. TransUnion said its core credit database was not affected.
Sources bleepingcomputer.com →
Salesforce data siphoned from hundreds of companies
Between roughly August 8 and 18, 2025, the threat actor tracked as UNC6395 used OAuth tokens stolen from Salesloft's Drift chat integration to reach the Salesforce environments of around 760 organizations, exporting an estimated 1.5 billion records. The exposed data was mostly business contact details (names, email addresses, phone numbers, job titles) and customer support-case content; investigators found the attackers combed the data for embedded secrets such as AWS keys and passwords to pivot into other systems. Confirmed victims included Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, Tenable, and a small number of Google Workspace accounts.
1.11M customers' licenses taken in the Salesforce wave
Farmers Insurance notified 1,111,386 customers in August 2025 that names, addresses, birth dates, driver's license numbers, and partial Social Security numbers were stolen from a third-party vendor's database on May 29 -- one hit among dozens in the year's ShinyHunters/UNC6040 Salesforce campaign, in which voice-phishing calls talked employees into linking a malicious OAuth app to their Salesforce instance, after which the attackers simply downloaded the CRM and extorted the owner. The Farmers entry earns its place as the wave's insurance-sector exemplar: a company serving 10 million households, breached through a vendor it wouldn't name, in a campaign whose victims routinely say third-party CRM rather than the word Salesforce.
Sources bleepingcomputer.com →securitymagazine.com →cyberguy.com →
6.4M customers' contract details, birth dates and IBANs taken in cyberattack
BOUYGUES TELECOM, FRANCE'S THIRD-LARGEST MOBILE OPERATOR, SAID IN AUGUST 2025 THAT A CYBERATTACK DETECTED ON AUG 4 HAD EXPOSED THE DATA OF ABOUT 6.4 MILLION CUSTOMERS. The exposed data included names, postal addresses, dates of birth, contract details and, for part of the base, IBAN bank account numbers; the company said card numbers and passwords were not affected and that professional customers' company information may also have been taken. Bouygues notified the CNIL, filed a criminal complaint and told affected customers by SMS or email, warning of phishing calls that could cite a customer's name or IBAN to gain trust. NOT ESTABLISHED: how the attackers got in, how many of the 6.4 million had IBANs exposed, and whether the CNIL has opened a sanction procedure.
Sources tomsguide.fr →
1.5M Swedes' personal ID numbers and HR records published after municipal software supplier hacked
SWEDISH HR-SOFTWARE SUPPLIER MILJODATA WAS HIT BY A RANSOMWARE ATTACK IN AUGUST 2025 AND, AFTER A FAILED RANSOM NEGOTIATION, THE DATACARRY GROUP PUBLISHED DATA ON MORE THAN 1.5 MILLION PEOPLE ON SEP 14, 2025. Miljodata's Adato rehabilitation and Novi personnel-notes systems are used by about 200 Swedish municipalities, including Stockholm, and about 25 companies including SAS and Boliden. The Swedish Prosecution Authority put the published records at over 1.5 million individuals; Have I Been Pwned loaded 870,000 unique email addresses. Exposed fields included names, addresses, phone numbers, personal identity numbers, dates of birth and gender, with sensitive data in many cases. DataCarry listed Miljodata on its leak site on Sep 13, 2025. The privacy regulator IMY opened GDPR audits of Miljodata and of the City of Gothenburg, Almhult municipality and Region Vastmanland, focusing on protected identities, former employees and children. NOT ESTABLISHED: the ransom demanded, how the attackers got in, and the outcome of the IMY audits.
Sources teiss.co.uk →
5.7 million customers' data taken via a call-center vendor
Qantas confirmed that a June-July 2025 attack on a third-party call-center platform, attributed to the Scattered Spider group, exposed data on 5.7 million customers -- names, email addresses, phone numbers, dates of birth, addresses, and frequent-flyer details. The data was later leaked after the airline refused an extortion demand.
Sources securityboulevard.com →
most of 1.4 million customers' data stolen
Allianz Life disclosed a July 2025 breach, tied to the Salesforce-targeting extortion wave, that reached a majority of its roughly 1.4 million customers along with financial professionals and some employees, exposing personal data including Social Security numbers. The company said it contained the intrusion within a day.
Sources guardz.com →
72,000 images including women's verification IDs leaked on 4chan
Tea, a women-only dating-safety app that required a selfie and government ID to join, left a legacy Firebase storage bucket unsecured, exposing about 72,000 images in July 2025 -- roughly 13,000 verification selfies and government IDs (driver's licenses and passports) plus 59,000 images from posts and messages. A second flaw exposed more than a million private messages. The verification photos were downloaded and reposted on 4chan, putting the app's users at risk.
Sources techcrunch.com →npr.org →
residents' and staff data leaked in the Interlock ransomware attack
The Interlock ransomware group attacked the City of St. Paul in late July 2025, prompting a full network shutdown, a local state of emergency, and activation of the Minnesota National Guard. After the city refused to pay, the gang leaked about 43 GB taken from a Parks and Recreation network drive. The city confirmed the exposed data covered 12,484 people -- current and former employees, interns, volunteers, and program participants -- including names, addresses, phone numbers, dates of birth, and Social Security numbers.
5.4 million patients' health data exposed
Episource, an Optum-owned medical billing and risk-adjustment firm, detected unauthorized network access in early 2025 and disclosed in June that the breach affected more than 5.4 million people across the health systems it serves, exposing health and personal information.
Sources fortifydata.com →
86 million records re-leaked in 2025 with SSNs decrypted
In May-June 2025 a threat actor posted a repackaged AT&T customer database on a Russian cybercrime forum -- about 86 million unique records including full names, addresses, phone numbers, and nearly 44 million Social Security numbers. Crucially, SSNs and birthdates that were encrypted in the earlier 2021/2024 thefts were now circulating fully decrypted in plaintext, turning old stolen data into ready-to-use identity-theft kits.
Sources bankinfosecurity.com →
64 million McDonald's job applicants exposed by a '123456' password
Security researchers found that McHire, the McDonald's hiring chatbot built by Paradox.ai, protected an admin account with the password '123456' and had an insecure API (IDOR) that together exposed up to 64 million job applicants' names, emails, phone numbers, IP addresses, some home addresses, and chat transcripts. Disclosed on June 30, 2025 and fixed within a day, no Social Security numbers or financial data were involved. Paradox.ai said only the researchers accessed the data and that no records were leaked publicly.
customers' contact details, birth dates and order histories stolen in Easter cyberattack
MARKS & SPENCER CONFIRMED ON MAY 13, 2025 THAT CUSTOMER DATA WAS STOLEN IN THE CYBERATTACK IT FIRST ACKNOWLEDGED ON APR 23, 2025, WHICH HALTED ONLINE ORDERS AND CLICK AND COLLECT FOR WEEKS. The retailer told customers that names, email and home addresses, phone numbers, dates of birth, online order histories, household information and masked card details were taken, and said it holds no full card numbers; all users were prompted to reset passwords. M&S did not say how many people were affected; its annual report listed 9.4 million active online customers, all of whom were emailed about the breach. Reports linked the attack to the Scattered Spider group, which M&S did not confirm, and the Information Commissioner opened an investigation covering M&S and two other UK retailers hit in the same period. NOT ESTABLISHED: the confirmed number of people affected, whether a ransom was paid, and the ICO's findings.
Sources thestack.technology →
69,000 customers' data leaked by bribed support agents
Cybercriminals bribed overseas support contractors at vendor TaskUs to pull data on 69,461 Coinbase customers, an intrusion that began in December 2024 and was discovered in May 2025. The stolen records included names, addresses, phone numbers, email addresses, masked Social Security and bank-account numbers, and images of government-issued IDs submitted for identity verification. No passwords, private keys, or funds were taken. Coinbase refused a $20 million ransom and offered a matching bounty instead.
2.1 million applicants' sensitive records stolen
The UK's Legal Aid Agency, part of the Ministry of Justice, was hit by a cyberattack detected on April 23, 2025 and disclosed on May 19. Attackers downloaded a large amount of data on people who applied for legal aid through its online service going back to 2007 -- contact details, addresses, dates of birth, national ID numbers, criminal history, employment status, and financial data such as debts and payments. The group claimed about 2.1 million records, and the MoJ admitted the agency's systems had been known to be vulnerable for years. UPDATE OCT 15, 2026: A FORENSIC REVIEW FOUND THE STOLEN RECORDS GO BACK ALMOST FIVE DECADES, WITH THE EARLIEST VERIFIED RECORD FROM 1978. About 250,000 records predate 2007, most from the 1990s and 2000s and a fractionally small number from before 1990; the bulk still relates to applications, claims and payments between Jan 2007 and May 16, 2025 or to cases live in that period. Provider data (contracts, office locations, financial details, contacts and LAA Online Portal credentials) was also taken. The MoJ says it has no evidence the data has been published and is investing more than 200 million pounds in digital services and cybersecurity. NOT ESTABLISHED: the total number of people affected, what the pre-2007 records contain, whether individuals have been notified directly, and who the attackers were.
1.7 million patients' records stolen in the Interlock ransomware attack
Interlock ransomware operators breached the 14-hospital Ohio health system Kettering Health, holding access from April 9 to May 20, 2025, when they deployed ransomware and triggered a system-wide outage that forced staff back to paper records. The gang exfiltrated roughly 941 GB of data and published it after Kettering refused to pay. Confirmed at 1,695,382 individuals, the stolen data included names, Social Security numbers, driver's license and passport numbers, financial account numbers, medical and treatment information, health insurance and billing records, and account usernames and passwords.
the Signal clone archiving officials' texts, cracked in 20 minutes
After a Reuters photo caught national security adviser Mike Waltz using TM SGNL -- a modified Signal that archives messages for compliance -- a hacker breached its maker TeleMessage in what they described as 15-20 minutes of effort. The clone kept plaintext copies of supposedly end-to-end-encrypted messages on its archive servers; the haul included message contents and metadata tied to Customs and Border Protection, Coinbase, Scotiabank, and, per a Reuters review of the later 410GB DDoSecrets release, more than 60 government users -- disaster responders, diplomats, Secret Service members, a White House staffer. Cabinet-level chats weren't in the stolen set, but the architecture was the story: every agency that bolted an archiving middleman onto Signal had quietly traded away the encryption itself. Smarsh suspended the service; CBP disabled it immediately.
915,000 current and former customers' SINs and licence numbers taken
NOVA SCOTIA POWER, THE PROVINCE'S ELECTRIC UTILITY, DISCOVERED ON APR 25, 2025 THAT AN ATTACKER HAD BEEN INSIDE ITS SYSTEMS, AND THE PRIVACY COMMISSIONER OF CANADA SAID ON MAR 25, 2026 THAT ABOUT 375,000 CURRENT AND 540,000 FORMER CUSTOMERS, ROUGHLY 915,000 PEOPLE, WERE AFFECTED. The compromised data included names, phone numbers, email and mailing addresses, dates of birth, account histories, driver's licence numbers and social insurance numbers. Commissioner Philippe Dufresne opened an investigation after numerous complaints; the utility signed a compliance letter committing to specific privacy improvements and offered credit monitoring and identity protection to all customers. The investigation stays open until the commitments are met. NOT ESTABLISHED: how the attacker got in, whether a ransom was demanded or paid, and whether the stolen data was published.
Sources priv.gc.ca →
social security fund hacked; files on nearly 2M workers with ID and bank data posted to Telegram
MOROCCO'S NATIONAL SOCIAL SECURITY FUND (CNSS) CONFIRMED IN APRIL 2025 THAT ITS IT SYSTEMS WERE HIT BY A SERIES OF ATTACKS AND THAT DATA WAS LEAKED TO TELEGRAM; MOROCCAN MEDIA REPORTED MORE THAN 54,000 FILES COVERING NEARLY 2 MILLION PEOPLE. An actor calling itself JabaROOT claimed the breach on Apr 8, 2025, framing it as retaliation for alleged Moroccan attacks on Algerian institutions, and also defaced the labour ministry's website. The files reportedly contain names, national ID numbers, phone numbers, email addresses, bank account details and other personal and financial information on private-sector employees and the companies that declare them. CNSS activated its security protocol, opened an internal administrative investigation and said some documents circulating were false, inaccurate or truncated; the vendor Resecurity said the data was uploaded to an underground forum but not yet offered for sale. NOT ESTABLISHED: the confirmed count, how much of the leaked data is genuine, and whether Morocco's data authority CNDP has acted.
Sources darkreading.com →techcabal.com →
2.7 million dialysis patients' SSNs and health data stolen
The Interlock ransomware group attacked kidney-dialysis giant DaVita in April 2025, exfiltrating and encrypting data on about 2.7 million patients from a lab database -- names, dates of birth, addresses, Social Security numbers, dialysis and health-insurance records, and even images of checks.
Sources hipaajournal.com →
customers' driver's licenses stolen via Cleo file-transfer flaw
Hertz, including its Dollar and Thrifty brands, confirmed in April 2025 that customer data had been stolen after attackers exploited zero-day flaws in Cleo's file-transfer software in late 2024. Exposed data included names, contact details, dates of birth, credit-card and driver's license information; a smaller group also had Social Security or other government-ID numbers, passport data, or Medicare/Medicaid IDs taken. Hertz gave no total but said it would be inaccurate to call it millions. The Clop ransomware gang was behind the wider Cleo campaign.
all 6.5 million members' personal data stolen
UK retailer Co-op confirmed that a late-April 2025 cyberattack by Scattered Spider affiliates stole the personal data of all 6.5 million of its members -- names, addresses, email addresses, phone numbers, and dates of birth. No financial, transaction, or password data was taken. The attack forced Co-op to shut down systems, emptying some store shelves, but early isolation stopped the DragonForce ransomware from being deployed. Four suspects aged 17-20 were later arrested.
23.2M subscribers' SIM keys stolen; record $97M fine
South Korea's biggest carrier disclosed in April 2025 that attackers had reached its Home Subscriber Server and siphoned 25 categories of data on 23.2 million people -- phone numbers, IMSI subscriber identities, and the USIM authentication keys that make SIM cloning possible. The regulator's autopsy was brutal: internet-facing, management, and internal networks linked on one system, management servers needlessly connected to the subscriber core, 26.1 million SIM authentication keys stored unencrypted, and, in the privacy commission chairperson's words, a company in a vulnerable state for a long time that kept missing its chances. SKT replaced every subscriber's SIM card and spent about $812M on remediation and compensation; the PIPC still levied a record 134.8 billion won (~$97M) fine -- the largest in Korean history -- which SKT sued to overturn in January 2026, arguing no user suffered financial loss.
Sources koreaherald.com →theregister.com →lightreading.com →
RansomHouse publishes South African operator's customer IDs, banking and medical data
SOUTH AFRICAN MOBILE OPERATOR CELL C CONFIRMED IN APRIL 2025 THAT DATA STOLEN IN A 2024 INTRUSION HAD BEEN PUBLISHED BY THE RANSOMHOUSE GROUP, WHICH POSTED IT ON ITS LEAK SITE IN JANUARY 2025. Cell C serves about 7.7 million customers; reports put the stolen volume at nearly 2 terabytes, including full names and contact details, ID numbers, banking details, medical records and driver's licence numbers, though the company had not finalised how many people were affected. Cell C notified the Information Regulator, set up an information hub and offered customers free protective registration with the Southern African Fraud Prevention Service. NOT ESTABLISHED: the number of people affected, when the intrusion began, and whether the Information Regulator has sanctioned Cell C.
SQL injection exposed 244,396 subscribers' national ID numbers and addresses
TURKISH ISP TURKNET REPORTED TO THE DATA PROTECTION BOARD KVKK THAT A SQL INJECTION ATTACK BEGINNING FEB 26, 2025 EXPOSED 244,396 SUBSCRIBERS' DATA, AND THE BOARD PUBLISHED THE NOTICE ON MAR 20, 2025. TurkNet learned of the breach on Mar 11, 2025 from a public complaint record at the telecoms regulator BTK. The exposed fields were names, phone numbers, subscriber numbers, Turkish national ID (TC kimlik) numbers, subscription line details, addresses and static IP data. KVKK said the figure was preliminary, based on initial log reviews, and that its review continued. NOT ESTABLISHED: the final count, whether the data was sold, and what sanction KVKK imposed.
Sources cnbce.com →
5.5 million patients' data stolen
Yale New Haven Health, Connecticut's largest health system, disclosed a March 2025 hack in which attackers stole the personal data of about 5.5 million patients, including names, dates of birth, contact details, Social Security numbers, and medical-record information. Patient care was not disrupted.
Sources mobihealthnews.com →
credential stuffing on transit-card site exposed 51,691 users; PIPC fine Jan 2026
SOUTH KOREA'S PERSONAL INFORMATION PROTECTION COMMISSION FINED TRANSIT-CARD OPERATOR T-MONEY 534 MILLION WON ON JAN 29, 2026 OVER A CREDENTIAL-STUFFING ATTACK THAT EXPOSED 51,691 USERS' DATA. Between Mar 13 and 25, 2025 an attacker made more than 12.26 million login attempts from 9,647 IP addresses on the T-money Card & Pay website, peaking at 131 per second, logged into 51,691 accounts and reached pages holding names, email addresses, mobile numbers and home addresses; in 4,131 accounts the gift function was used to steal about 14 million won of mileage. The PIPC found T-money failed to detect or block the abnormal traffic and ordered corrective measures and publication of the penalty. NOT ESTABLISHED: who ran the attack and whether the stolen data was resold.
Sources hankyung.com →
1.2 million patients exposed after a managed-services account was abused
Absolute Dental, a Nevada practice with more than 50 locations, was breached between February 19 and March 5, 2025 after attackers ran a malicious version of a legitimate software tool through an account tied to its third-party managed-services provider. A file review concluded on July 28, 2025 confirmed 1,223,635 people affected. Exposed data included names, contact details, dates of birth, Social Security numbers, driver's license or state-ID information, passport or other government-ID information, and health information; a smaller subset also had financial-account or payment-card data exposed.
62 million people's SSNs and health data exposed
Business-services and government-contracting giant Conduent disclosed a ransomware breach in an April 2025 SEC filing; attackers had been in its systems from October 2024 to January 2025 and took more than 8TB of data. Notifications expanded through 2026 as states reported millions of residents affected, and healthcare-breach reporting ultimately placed the total above 62 million people, with Social Security numbers and medical information among the exposed data.
Sources brightdefense.com →
62 million students' records, including SSNs, stolen
A single stolen contractor login let attackers into PowerSchool's K-12 student-information system in January 2025; reporting placed the reach at more than 62 million students and 9.5 million teachers across North America. Exposed data included grades, medical information, and Social Security numbers. PowerSchool paid a ransom but data still surfaced.
Sources techcrunch.com →
4.7 million members' health data shared with Google Ads
Blue Shield of California disclosed in 2025 that a misconfigured Google Analytics setup had, from 2021 to 2024, shared the protected health information of about 4.7 million members with Google's advertising system -- names, insurance plan details, medical claims data, and doctor-search activity -- potentially fueling targeted ad campaigns. A textbook case of ad-tech tracking quietly leaking medical data.
Sources securityweek.com →
China inside US phone networks, through the wiretap door
Chinese state hackers spent years inside at least nine major US carriers -- AT&T, Verizon, T-Mobile, Lumen, Charter and more -- in what Sen. Mark Warner called the worst telecom hack in the nation's history and the FBI called gigantic and seemingly indiscriminate: over a million call records, who called whom, when, and from where, with the ability to geolocate millions and record calls at will, sparing no one, not even children. The entry that should haunt every lawful-access debate: Salt Typhoon compromised the CALEA wiretap portals that carriers are legally required to build for court-ordered surveillance -- the mandated backdoor became the foreign intelligence service's front door. Targets included the phones of both 2024 presidential campaigns. By August 2025 the FBI counted 200+ victim companies across 80 countries; one carrier had hosted the intruders for three years before detection. No breach notification letters, no credit monitoring -- the people affected are simply everyone with a phone.
2024 subscriber breach draws 42M euro CNIL fines in Jan 2026
FRANCE'S CNIL FINED THE ISP FREE 15 MILLION EUROS AND FREE MOBILE 27 MILLION EUROS IN JANUARY 2026 OVER THE OCTOBER 2024 BREACH OF SUBSCRIBER DATA. Free, the Iliad group's French operator, disclosed in October 2024 that an attacker had taken subscribers' personal data. Univers Freebox, relaying Le Figaro's May 2026 report on CNIL figures, put the affected base at more than 24 million contracts. The CNIL said breach notifications rose to a record 17,802 in 2025 from 5,630 in 2024, including more than 11,600 triggered by attacks on the software publishers Weda and Harvest, and 2,730 in the first quarter of 2026. NOT ESTABLISHED: the exact number of people affected, what fields beyond identity and contract data were taken, and whether Free has appealed the fines.
Sources universfreebox.com →
1.3 billion people's SSNs exposed by a data broker
Background-check data broker National Public Data exposed roughly 2.9 billion records covering about 1.3 billion people through a misconfigured database -- full names, addresses, dates of birth, Social Security numbers, phone numbers, and emails. The fallout pushed NPD into bankruptcy.
Sources upguard.com →
190 million people in the largest US health breach
A ransomware attack on UnitedHealth's Change Healthcare -- which processes a huge share of US medical claims -- exposed the data of roughly 193 million people (a tally that nearly doubled UnitedHealth's initial estimate), including health records, Social Security numbers, and financial information, making it the largest healthcare breach in US history.
Sources app.stationx.net →
73 million account records exposed, plus near-total call logs
AT&T disclosed in 2024 that data on about 73 million current and former account holders -- including Social Security numbers -- had leaked online, and separately that call and text metadata for nearly all its wireless customers had been downloaded from a third-party cloud platform.
Sources app.stationx.net →
national ID and facial photos of 80% of citizens leaked
In April 2024 a threat actor dumped 144GB of data on more than 5.1 million Salvadorans -- over 80% of the population -- including a high-definition headshot of each person labeled with their national ID (DUI) number, plus names, birthdates, phone numbers, emails, and addresses. It is among the first breaches to expose the biometric data of nearly an entire country.
Sources resecurity.com →
560 million customers exposed in the Snowflake wave
As part of the 2024 Snowflake campaign -- in which stolen logins gave attackers access to about 165 companies' cloud data because multi-factor authentication was not enforced -- an alleged 560 million Ticketmaster customer records were taken, including names, contact details, and partial payment information.
Sources techcrunch.com →
job applicants' SSNs exposed via Snowflake
Advance Auto Parts was among the Snowflake-wave victims in 2024; the breach exposed sensitive data on more than 2.3 million people, largely job applicants, including Social Security numbers and other personal details.
Sources techcrunch.com →
13.4 million members' health data sent to ad trackers
Kaiser Permanente disclosed in 2024 that tracking technologies on its websites and apps had transmitted the personal and health-related data of about 13.4 million members to third-party advertisers including Google, Microsoft Bing, and X -- names, IP addresses, and details of how members used its health sites. It was the largest confirmed US health breach of 2024 and a stark example of surveillance-style ad tracking spilling medical data.
Sources hipaajournal.com →
252 million voter records, including passport data, put up for sale
Ahead of Indonesia's 2024 election, a threat actor calling themselves 'Jimbo' advertised a breach of the General Elections Commission (KPU) system totaling about 252 million voter entries -- national identity (NIK) numbers, names, birthplaces and dates, addresses, and reportedly passport details -- for roughly two bitcoin, in a country of about 274 million people.
Sources resecurity.com →
49 million customer records scraped
Dell disclosed a 2024 breach in which an attacker abused a partner portal to scrape a database of about 49 million customer records, including names, physical addresses, and order and hardware information.
Sources en.wikipedia.org →
6.9 million people's genetic and ancestry data exposed
A credential-stuffing attack on 23andMe in 2023 reached about 6.9 million people's profiles, exposing ancestry, relationship, and in some cases health-related genetic data -- information that, once out, can never be changed.
Sources app.stationx.net →
95 million+ people hit across thousands of organizations
The Clop ransomware group exploited a zero-day in the widely used MOVEit file-transfer tool in 2023, cascading through thousands of companies and government agencies and ultimately exposing the data of more than 95 million people -- a defining supply-chain breach.
Sources app.stationx.net →
14 million people's licenses and passports stolen
A 2023 breach of Australian lender Latitude Financial, begun with stolen employee credentials, affected about 14 million people across Australia and New Zealand -- including roughly 7.9 million driver's license numbers and 53,000 passport numbers, some records dating back to 2005. Latitude offered to reimburse customers who replaced stolen ID documents.
Sources latitudeclassaction.com.au →
815 million citizens' Aadhaar and passport data leaked
In late 2023 a threat actor put the personal data of more than 800 million Indian citizens up for sale, drawn from records held by the Indian Council of Medical Research, including names, addresses, passport numbers, and Aadhaar national-ID numbers -- one of the largest exposures of government-ID data ever.
Sources learn.g2.com →
11 million patients' data stolen and posted for sale
Hospital giant HCA Healthcare disclosed in 2023 that an external storage location was accessed and data on about 11 million patients was stolen and offered for sale, including names, contact details, dates of birth, and appointment information. It was the largest US health-data breach reported that year until Change Healthcare.
Sources chiefhealthcareexecutive.com →
35.8 million customers exposed via Citrix Bleed
Attackers exploited the Citrix Bleed vulnerability in October 2023 to reach Comcast Xfinity's internal systems, exposing usernames and hashed passwords for about 35.8 million customers -- essentially the entire base -- and, for many, names, contact details, the last four digits of Social Security numbers, dates of birth, and security questions. Comcast later settled for $117.5 million.
Sources cbsnews.com →
14.7 million mortgage customers' data stolen
Mortgage servicing giant Mr. Cooper disclosed a late-2023 cyberattack that exposed the data of about 14.7 million current and former customers, including names, addresses, dates of birth, Social Security numbers, and bank account numbers tied to their home loans.
Sources abcnews.com →
50 million citizens' national ID data exposed by a government site
In mid-2023 a researcher found a Bangladeshi government website leaking the personal data of tens of millions of citizens -- names, contact details, and national ID card numbers drawn from the country's birth-and-death registration system -- reachable without authentication. Reporting placed the exposure at around 50 million people.
Sources biometricupdate.com →
up to 40 million voters' registers accessed
The UK Electoral Commission disclosed in 2023 that hackers had sat undetected in its systems for over a year, gaining access to electoral registers holding the names and addresses of up to 40 million voters, including many not otherwise on public rolls. The intrusion was discovered 14 months after it began.
Sources resecurity.com →
34.9 million passport holders' data leaked from Immigration
In July 2023 the hacker 'Bjorka' leaked data on 34.9 million Indonesian passport holders taken from the Immigration Directorate General -- full names, passport numbers, issue and expiry dates, dates of birth, and gender -- and offered it for sale, spanning documents issued from 2009 to 2020.
Sources thejakartapost.com →
9.8 million Australians' passports and licenses exposed
A 2022 breach of Australian telecom Optus, traced to an exposed, unauthenticated API, exposed the data of about 9.8 million current and former customers -- roughly a third of Australia's population -- including names, dates of birth, addresses, and passport, driver's license, and Medicare numbers. Optus reserved A$140 million partly to replace compromised identity documents.
Sources en.wikipedia.org →
9.7 million health-insurance customers' records leaked
A 2022 breach of Australian health insurer Medibank, entered via stolen admin credentials, exposed data on about 9.7 million current and former customers -- names, dates of birth, Medicare and passport numbers, and highly sensitive health-claims data including diagnoses and procedures. When Medibank refused a US$10M ransom, the data was published on the dark web.
Sources techrepublic.com →
1 billion residents' IDs and surveillance records exposed
In 2022 a hacker offered a 23TB dump from the Shanghai National Police database -- roughly one billion Chinese residents -- exposing names, addresses, national ID numbers, phone numbers, and photos of ID cards, passports, and driver's licenses, alongside detailed police and criminal-case records. Files included movement tracking and reports of people punished for using a VPN to post critical remarks, laying bare a state surveillance apparatus. Likely left exposed by a misconfigured, password-free dashboard.
Sources techcrunch.com →
5.4 million accounts exposed via an API flaw
A now-patched Twitter API flaw let attackers match email addresses and phone numbers to accounts, and in 2022 a dataset of about 5.4 million users built this way was put up for sale.
Sources securitymagazine.com →
69 million players breached
The children's virtual-pet game Neopets was breached in 2022 after attackers spent 18 months inside its systems, stealing data on about 69 million current and former users -- names, emails, birth dates, gender, PINs, and hashed passwords -- plus source code.
Sources securitymagazine.com →
8.2 million users' financial data taken by an ex-employee
Block disclosed in 2022 that a former employee had downloaded internal reports covering about 8.2 million Cash App Investing users, exposing names, brokerage account numbers, portfolio holdings, and trading activity.
Sources swimlane.com →
2 million patients' SSNs and health data stolen
Massachusetts medical provider Shields Health Care Group disclosed a 2022 breach affecting more than 2 million people across 56 facilities, exposing Social Security numbers, diagnoses, medical records, billing information, and other personal data.
Sources getastra.com →
students' IDs and records leaked
The Vice Society ransomware group leaked about 500GB of data from the Los Angeles Unified School District, the second-largest US school district, in 2022 -- including students' passport and Social Security details, health information, and psychological assessments -- after the district refused to pay.
Sources securitymagazine.com →
700 million users' profile data scraped and sold
Data associated with about 700 million LinkedIn users -- roughly 90% of its base -- was scraped and offered for sale in 2021, including names, email addresses, phone numbers, geolocation, and professional details usable for targeted phishing and social engineering.
Sources app.stationx.net →
533 million users' phone numbers leaked
The phone numbers and profile details of about 533 million Facebook users across 106 countries were posted online for free in 2021, tied to a vulnerability abused before 2019. Phone numbers cannot be changed as easily as passwords, keeping the data useful to scammers for years.
Sources app.stationx.net →
76.6 million customers' SSNs and licenses exposed
T-Mobile confirmed in 2021 that a breach exposed the personal data of about 76.6 million current, former, and prospective customers, including names, dates of birth, Social Security numbers, and driver's license or ID information.
Sources app.stationx.net →
national ID data for the entire population stolen
In 2021 a hacker obtained the contents of RENAPER, Argentina's National Registry of Persons, which issues national ID cards to every citizen -- exposing the ID-card data, including photos, of essentially the country's entire population of about 45 million. The government suspected an insider; the data was offered for sale on hacking forums.
Sources upguard.com →
4.5 million passengers, with passport data
Air India disclosed a 2021 breach, stemming from a compromise at IT provider SITA, that affected about 4.5 million passengers worldwide and exposed names, birth dates, contact details, passport information, and some payment card data.
Sources en.wikipedia.org →
77 million records exposed
Eyewear giant EssilorLuxottica had about 77 million records exposed tied to a 2021 breach, including names, contact details, and health-related eyecare information.
Sources en.wikipedia.org →
142 million hotel guests' details posted online
Details of MGM Resorts hotel guests -- names, addresses, phone numbers, dates of birth, and emails -- were posted on hacker forums. First reported in early 2020 as 10.6 million guests, the exposed set was later found being sold at about 142 million records. MGM said no passwords or payment card data were included.
Sources securityaffairs.com →
270 million records leaked
The storytelling platform Wattpad suffered a 2020 breach exposing roughly 270 million records -- names, email addresses, hashed passwords, dates of birth, and other profile data. The database, tied to the ShinyHunters group, was first sold privately and later dumped for free on hacker forums.
Sources securitymagazine.com →
9 million travelers' data stolen
UK low-cost airline easyJet disclosed a 2020 breach that exposed the email addresses, names, and travel records of about 9 million customers, and the full credit card details (including CVV) of roughly 2,200 of them. The airline was criticized for waiting months to notify customers.
Sources nordlayer.com →
5.2 million guests hit in a second breach
In March 2020 Marriott disclosed a fresh breach -- distinct from its 2018 Starwood incident -- after attackers used two employees' login credentials to siphon data on about 5.2 million guests over roughly a month, including names, contact details, dates of birth, gender, and loyalty account information. No payment data was taken.
Sources auth0.com →
350 million records, including voicemail transcripts
A researcher found unsecured databases from VoIP provider Broadvoice exposing more than 350 million records -- caller names, phone numbers, and locations -- along with hundreds of thousands of transcribed voicemails, some revealing sensitive medical and financial details.
Sources securitymagazine.com →
538 million users' data offered for sale
Data on about 538 million users of the Chinese microblogging platform Weibo surfaced for sale in 2020 -- real names, site usernames, gender, and location, with phone numbers for roughly 172 million of them. No passwords or payment data were reported in the set.
Sources beaglesecurity.com →
76,000 fingerprints exposed by a biometrics firm
Researchers found an unsecured server run by Brazilian biometrics company Antheus Tecnologia holding about 76,000 fingerprint records -- stored as binary data that could be reverse-engineered back into usable fingerprints -- alongside some 81.5 million records with employee and administrator details. Unlike a password, a leaked fingerprint can never be changed.
Sources stealthlabs.com →
885 million mortgage records exposed
A website design flaw (an insecure direct object reference) left roughly 885 million First American Financial mortgage and title documents publicly accessible without authentication, including Social Security numbers, driver's licenses, bank account details, and images of sensitive financial records going back years.
Sources app.stationx.net →
106 million applicants' data stolen
A misconfigured web application firewall let an attacker access Capital One data on about 106 million credit-card applicants in the US and Canada in 2019, including names, addresses, credit scores, and roughly 140,000 Social Security numbers and 80,000 linked bank account numbers.
Sources consumernotice.org →
1.2 billion people's profiles exposed
In 2019 researchers found an open database holding about 1.2 billion people's aggregated profiles -- names, email addresses, phone numbers, and social-media handles -- traced largely to data brokers People Data Labs and OxyData, illustrating how brokers concentrate risk.
Sources app.stationx.net →
140 million users breached
Design platform Canva was hacked in 2019, exposing about 140 million users' names, usernames, email addresses, and hashed passwords.
Sources en.wikipedia.org →
320 million subscribers exposed by an app flaw
A security flaw in an app from Indian telecom giant Airtel exposed the data of about 320 million subscribers in 2019, including names, birth dates, addresses, and other subscriber details.
Sources en.wikipedia.org →
540 million records left on public servers
In 2019 researchers found more than 540 million Facebook user records -- account IDs, comments, likes, and some contact details -- sitting exposed on public cloud servers by third-party app developers.
Sources en.wikipedia.org →
1.1 billion citizens' national ID and biometric data exposed
India's Aadhaar national identity system, which links biometric and demographic data to a unique ID number, was reported in 2018 to be accessible through insecure government portals and third-party endpoints, exposing the records of close to 1.1 billion citizens and raising lasting concerns about centralized digital-ID systems.
Sources learn.g2.com →
500 million guests' records, including passports, exposed
Attackers sat inside Starwood's guest reservation system from 2014 until Marriott discovered the intrusion in 2018, exposing data on up to 500 million guests -- names, addresses, dates of birth, and encrypted passport numbers, with some payment data. The UK ICO fined Marriott and it had to reimburse guests for replacement passports.
Sources huntress.com →
340 million records left on an open server
In 2018 marketing data broker Exactis exposed a database of about 340 million records on a publicly accessible server, including phone numbers, emails, home addresses, and detailed personal characteristics -- assembled on people who never knowingly did business with the firm.
Sources consumernotice.org →
9.4 million passengers, with passport numbers
Hong Kong carrier Cathay Pacific disclosed a 2018 breach affecting about 9.4 million passengers, exposing names, birth dates, phone numbers, addresses, and -- for many -- passport and Hong Kong ID numbers.
Sources en.wikipedia.org →
60 million users exposed by an API flaw
A flaw in the US Postal Service's Informed Visibility tool exposed the account details of about 60 million users in 2018 -- usernames, addresses, phone numbers, and mailing data -- to any logged-in user.
Sources en.wikipedia.org →
162 million accounts breached
The video app Dubsmash was breached in 2018, with about 162 million records -- usernames, email addresses, and hashed passwords -- later put up for sale among a large batch of stolen databases.
Sources en.wikipedia.org →
150 million users breached
Under Armour's MyFitnessPal app was breached in 2018, exposing about 150 million users' usernames, email addresses, and hashed passwords.
Sources itpro.com →
92 million users breached
The genealogy site MyHeritage disclosed a 2018 breach exposing the email addresses and hashed passwords of about 92 million users.
Sources csoonline.com →
57 million riders and drivers exposed in a concealed breach
In late 2016 two attackers used an AWS key found in a private Uber GitHub repository to download data on 57 million riders and drivers from a cloud storage bucket, including 600,000 U.S. drivers' license numbers plus rider names, emails and phone numbers. Rather than report it, Uber paid the hackers $100,000 to delete the data and stay quiet, disguising it as a bug-bounty payout. New leadership revealed the concealed breach in November 2017; Uber later paid $148 million to settle with all 50 states and its former security chief was criminally convicted.
Sources justice.gov →npr.org →
1.4 billion records (393 million emails) exposed by a spam operation
A misconfigured backup left the databases of River City Media, a large spam operation, exposed online with no password. A researcher found about 1.4 billion records -- names, email addresses, IP addresses and often physical addresses -- amounting to roughly 393 million unique email addresses. Disclosed in March 2017, it was described at the time as one of the largest single data exposures ever.
Sources haveibeenpwned.com →forbes.com →
147 million consumers' SSNs and IDs exposed
Credit bureau Equifax failed to patch a known Apache Struts vulnerability, letting attackers roam its network for 76 days in 2017 and steal the Social Security numbers, birth dates, addresses, driver's license details, and some credit card numbers of about 147 million people -- roughly half the US population.
Sources consumernotice.org →
nearly 200 million voters' profiles left exposed
In 2017 an analytics firm working for the Republican National Committee left a 1.1TB database on an unsecured cloud server, exposing details on nearly 200 million registered US voters -- names, addresses, birth dates, phone numbers, party, and modeled 'ethnicity' and 'religion' fields used for political profiling.
1.9 million customer records exposed
Canadian telecom Bell disclosed a 2017 breach exposing about 1.9 million customer email addresses, along with some names and phone numbers.
Sources en.wikipedia.org →
57 million riders and drivers, breach concealed for a year
Attackers accessed data on about 57 million Uber riders and drivers in 2016, including names, emails, phone numbers, and around 600,000 US drivers' license numbers. Uber paid the hackers to stay quiet and concealed the breach for more than a year.
Sources app.stationx.net →
87 million voters' records with national IDs exposed
In 2016 a researcher found Mexico's entire voter roll -- about 87 million records including names, addresses, birth dates, and national ID numbers -- sitting in a misconfigured, publicly reachable cloud database. Electoral authorities later fined a political party for failing to secure its copy of the list.
50 million citizens' national ID database posted online
In 2016 an unnamed hacker posted a downloadable database titled 'Turkish Citizenship Database' containing the personal data of roughly 50 million citizens -- names, addresses, parents' names, places and dates of birth, and national ID numbers.
360 million accounts leaked
In 2016 about 360 million MySpace account credentials from a pre-2013 breach appeared for sale online. Though the platform was long past its peak, the reused emails and passwords fueled credential-stuffing attacks on other services for years.
Sources ciodive.com →
55 million voters, with fingerprints, leaked
In the 2016 'Comeleak', the entire voter database of the Philippine Commission on Elections -- about 55 million voters -- was hacked and published, including names, addresses, birth dates, passport data, and fingerprint records.
Sources en.wikipedia.org →
412 million adult-site accounts breached
The adult-networking company FriendFinder Networks (AdultFriendFinder, Cams.com, Penthouse.com and others) was hacked in 2016, exposing about 412 million accounts spanning two decades -- usernames, email addresses, and passwords stored in plaintext or weak SHA-1 hashes. The sensitive nature of the sites made the exposure especially damaging.
Sources computerworld.com →
78.8 million health-insurance records stolen
Health insurer Anthem disclosed in 2015 that attackers stole records on 78.8 million people -- names, dates of birth, Social Security numbers, addresses, and employment data. Anthem settled a class action for a then-record $115 million.
Sources ciodive.com →
22 million federal workers' clearance and fingerprint data stolen
A breach of the US Office of Personnel Management, attributed to Chinese state hackers, exposed the deeply sensitive SF-86 background-investigation files of about 21.5 million security-clearance applicants and relatives, plus 5.6 million fingerprint records -- data that cannot be reissued.
Sources ciodive.com →
32 million users of an affair site exposed and extorted
The 2015 breach of Ashley Madison, a site marketed for extramarital affairs, exposed about 32 million users' account details, including names, email addresses, and payment records. The intensely sensitive nature of the data fueled extortion campaigns and lasting personal harm, and remains a landmark case in how breach data can be weaponized against individuals.
Sources ciodive.com →
15 million credit applicants exposed
A 2015 breach at credit bureau Experian exposed about 15 million people who had applied for T-Mobile service, including names, addresses, birth dates, and the Social Security or ID numbers used for credit checks.
Sources en.wikipedia.org →
10 million members' SSNs and health data
Excellus BlueCross BlueShield disclosed a 2015 breach affecting about 10 million people, exposing names, birth dates, Social Security numbers, and medical claims -- with attacker access traced back to 2013.
Sources en.wikipedia.org →
145 million accounts accessed via employee credentials
Attackers used stolen employee credentials to reach eBay's corporate network in 2014 and exfiltrate about 145 million account records, including names, encrypted passwords, and contact information, prompting a company-wide password reset.
Sources learn.g2.com →
76 million households' data accessed
A 2014 intrusion at JPMorgan Chase reached the contact information of about 76 million households and 7 million small businesses -- names, addresses, phone numbers, and emails -- one of the largest breaches of a US bank.
Sources cloudskope.com →
56 million payment cards stolen
Point-of-sale malware at Home Depot in 2014 compromised about 56 million payment cards along with tens of millions of email addresses, one of the largest retail card breaches on record.
Sources consumernotice.org →
4.5 million patients' SSNs stolen
Community Health Systems, one of the largest US hospital operators, disclosed a 2014 breach -- attributed to a group exploiting the Heartbleed flaw -- that stole names, addresses, birth dates, and Social Security numbers of about 4.5 million patients.
Sources en.wikipedia.org →
35 million records sold by an insider
Japanese education company Benesse suffered a 2014 insider breach in which a contractor copied and sold data on about 35 million customers, largely families of students, including names, addresses, and children's details.
Sources en.wikipedia.org →
500 million accounts stolen in a second breach
Separate from its record 2013 breach, Yahoo suffered a 2014 intrusion by state-sponsored attackers that stole data on about 500 million accounts -- names, email addresses, phone numbers, birth dates, hashed passwords, and security questions. The full scope was not disclosed until 2016.
Sources csoonline.com →
all 3 billion user accounts compromised
Russian state-linked hackers breached Yahoo starting in 2013, ultimately compromising all 3 billion user accounts -- names, email addresses, phone numbers, dates of birth, and hashed passwords. Yahoo did not disclose the full scope until 2017, and it remains the largest confirmed breach on record.
Sources huntress.com →
153 million accounts and credentials stolen
Adobe's 2013 breach, first thought to affect 3 million users, ultimately exposed more than 153 million accounts -- email addresses, poorly encrypted passwords, password hints, and some credit card details -- a landmark example of weak encryption practices.
Sources huntress.com →
40 million cards and 70 million customers' data stolen
Point-of-sale malware at Target during the 2013 holiday season stole about 40 million credit and debit card numbers and the personal information of up to 70 million customers, a landmark retail breach that reshaped payment security.
Sources consumernotice.org →
50 million users forced to reset passwords
Note-taking service Evernote forced a password reset for about 50 million users in 2013 after attackers accessed usernames, email addresses, and hashed passwords.
Sources en.wikipedia.org →
50 million customers breached
The daily-deals site LivingSocial disclosed a 2013 breach affecting about 50 million customers, exposing names, email addresses, birth dates, and salted password hashes.
Sources en.wikipedia.org →
68 million user credentials stolen
A 2012 Dropbox breach exposed about 68 million users' email addresses and hashed passwords; the full scale only became clear in 2016 when the data surfaced online, a classic case of credential reuse fueling later attacks.
Sources breachsense.com →
14 million gaming accounts breached
A 2012 breach of Blizzard Entertainment's Battle.net service exposed data on about 14 million accounts, including email addresses, security-question answers, and scrambled passwords.
Sources en.wikipedia.org →
6.4 million taxpayers' SSNs stolen
Hackers stole about 6.4 million South Carolina taxpayer records in 2012 after an employee fell for a phishing email, exposing Social Security numbers and hundreds of thousands of credit and debit card numbers.
Sources en.wikipedia.org →
117 million accounts stolen
A 2012 breach of LinkedIn, first reported as only a few million, ultimately exposed about 117 million members' email addresses and unsalted SHA-1 password hashes, which surfaced for sale years later.
Sources csoonline.com →
360,000 credit card accounts breached
Attackers walked through Citi's Account Online web platform in May 2011 by manipulating account numbers in the browser's address bar, harvesting data from 360,083 U.S. credit-card accounts. Names, account numbers and contact details including email addresses were taken; Citi said Social Security numbers, birth dates, card expiration dates and CVV codes were not exposed. The bank waited about three weeks to notify customers and reissued cards on affected accounts.
customer names and emails exposed across 75+ major brands
Epsilon, then the world's largest permission-based email marketing firm, said an intrusion detected on March 30, 2011 exposed the names and email addresses of customers belonging to a subset of its 2,500+ corporate clients -- among them Chase, Citi, Capital One, Best Buy, Walgreens and Verizon. No financial data was taken, but the exposure across dozens of major brands was called one of the largest breaches in history at the time and drove a wave of targeted phishing. Prosecutors later tied it to a spam ring that blasted stolen addresses.
77 million accounts compromised
The 2011 breach of Sony's PlayStation Network exposed about 77 million accounts -- names, addresses, emails, birth dates, logins, and in some cases card data -- and forced the gaming service offline for weeks, a landmark early mega-breach.
Sources breachsense.com →
4.9 million military health records lost
Backup tapes holding the health records of about 4.9 million US military members, retirees, and their families in the Tricare program were lost in 2011, exposing Social Security numbers, addresses, phone numbers, and clinical data.
Sources en.wikipedia.org →
6 million developer accounts with plaintext passwords
China Software Developer Network, a major Chinese programming portal, was breached in 2011, exposing about 6 million usernames, email addresses, and passwords that had been stored in plain text.
Sources en.wikipedia.org →
1.3 million commenter accounts leaked by Gnosis
A group calling itself Gnosis broke into Gawker Media's servers in December 2010, dumping about 1.3 million commenter usernames, email addresses, and weakly hashed passwords -- plus the site's source code -- onto file-sharing networks. The old DES-based hashes were quickly cracked, and reused credentials were used to hijack thousands of Twitter accounts for spam. The breach hit Gizmodo, Lifehacker, Kotaku, Jezebel, and other Gawker sites.
Sources forbes.com →grahamcluley.com →
3.3 million student-loan borrowers' data stolen
Portable media holding the names, addresses, dates of birth, and Social Security numbers of about 3.3 million federal student-loan borrowers was physically stolen from the Minnesota headquarters of guaranty agency ECMC in March 2010. No bank-account data was included. The media was later recovered and investigators said they found no evidence of misuse, but the theft ranked among the largest identity-data losses of the year.
Sources spectrum.ieee.org →nbcnews.com →
32 million accounts with plaintext passwords exposed
A hacker exploiting a basic SQL-injection flaw pulled the entire user database of RockYou, a maker of social-media widgets and games, in December 2009 -- about 32 million accounts. The passwords were stored in plain text with no hashing, and because users often reused their email credentials, the exposure reached well beyond the site. The leaked list became 'rockyou.txt,' still the most widely used password-cracking wordlist.
Sources techcrunch.com →scworld.com →
130 million payment cards stolen
One of the largest U.S. card processors disclosed on January 20, 2009 that malware planted through a SQL-injection attack had captured unencrypted card data in transit through its network during 2008. Prosecutors later put the total at roughly 130 million credit- and debit-card accounts, the largest payment-card breach reported at the time. Albert Gonzalez, mastermind of the TJX breach, was indicted for it and sentenced to 20 years.
~2 million mortgage applicants' records stolen and sold by an insider
Rene Rebollo, a senior financial analyst in Countrywide's subprime lending division, spent about two years copying roughly 20,000 customer records a week onto a USB drive and selling the data. The FBI arrested him in August 2008; an estimated 2 million mortgage applicants' records -- names, Social Security numbers, addresses and financial-account details -- were taken. A later class-action settlement covered about 17 million people whose data sat in the affected systems.
4.2 million credit and debit card numbers stolen
Malware planted on servers at more than 300 Hannaford and Sweetbay grocery stores captured credit- and debit-card numbers in transit during card authorization between December 2007 and March 2008. About 4.2 million unique card numbers were exposed and at least 1,800 fraud cases were tied to the breach. Only card numbers and expiration dates were taken; it was an early, widely studied case of card data stolen in transit.
8.5 million consumer records stolen and sold by an insider
A senior database administrator at Certegy Check Services, a Fidelity National Information Services unit, stole 8.5 million consumer records over roughly five years and sold them to data brokers who resold them to direct marketers. The records included names, addresses, dates of birth, checking-account numbers and, for about 1.5 million people, credit-card details. Fidelity first disclosed 2.3 million records in July 2007, then raised the figure to 8.5 million in an SEC filing.
up to 94 million payment cards stolen
Hackers led by Albert Gonzalez broke into TJX's networks through a poorly secured store Wi-Fi connection in 2005 and installed sniffer software that captured payment-card 'track' data for about 18 months before the intrusion was found in December 2006. TJX disclosed it in January 2007 and acknowledged at least 45.7 million cards; court filings citing Visa and MasterCard put the exposure at up to 94 million accounts, the largest retail card breach reported at the time.
Sources nbcnews.com →huntress.com →
Counts reflect the most complete figures reported to date. Several are still under investigation and may grow. "Undisclosed" means the organization hasn't released a victim count. Missing one? Submit a sourced breach.
You can't un-leak data, but you can shut down most of the ways it gets used against you. Start here.
General guidance, not legal or financial advice. If a breach notice offers free credit monitoring, it costs you nothing to accept. For health-data breaches, also review benefits statements for care or claims you don't recognize.
Every breach on this page started with data somebody collected.
You can't leak what you never log. vp.net is a privacy network with no activity logs and no identity database to steal -- hardware-verified, not policy-promised. Nothing stored, nothing breached.
Visit vp.net →
Every breach notice lands in your inbox. So do the phishers who follow it.
Leaked address books become phishing lists. bmail is verifiably private email that can't read your mail or mine your address book, so your inbox is a dead end for data thieves, not a directory.
Visit bmail.ag →