Every breach report the desk has published — newest disclosures first. Each report answers four questions: what happened, who is affected, how serious it is, and what to do now. Filter by evidence label, region, month, or the kind of data exposed.
Showing 67 of 67 reports
SEGA said on November 9, 2026 that 2,196,044 email addresses used for its newsletters were leaked through its email provider Arara, including 92,273 records with extra delivery-related information.
Who Gives A Crap told customers on November 7, 2026 that some customers' personal information was accessed without authorisation in a security incident at one of its marketing-software providers, and that names, email addresses, phone numbers, postal addresses and total spending may have been viewed.
Mirae Asset Securities confirmed on November 7, 2026 that external attacks on its mobile login service and internal groupware on November 4 and 5 leaked account numbers for about 3,800 customers and personal data on 35,255 current and former employees and contractors, including names and employee numbers and, for some, email addresses, mobile numbers and encrypted passwords.
Rohto Pharmaceutical confirmed on November 6, 2026 that unauthorised access to its mail-order telephone and customer management systems leaked the names, addresses and telephone numbers of 2,797,545 customers, and that call recordings for 9,715 customers contained payment card numbers and expiry dates.
Gnosis Pay detected unauthorised access to its legacy consumer card system on November 3, 2026, exposing customer information that its notifications to affected customers list as including full payment card numbers, expiration dates, CVV codes, names, home addresses and cryptocurrency wallet addresses linked to their accounts.
NTT Docomo confirmed on November 5, 2026 that unauthorised access to the Docomo Online Shop and My docomo leaked personal information on up to about 300,000 customers, including names, addresses, dates of birth and phone numbers.
SMBC Consumer Finance announced on November 5, 2026 that unauthorised access to its card-loan guarantee system sent data on up to 320,118 people outside the company, including names, dates of birth, addresses, phone numbers, driver’s licence numbers, employers, annual incomes and guaranteed loan amounts.
Iris Plaza said on November 5, 2026 that data on about 7.7 million people stored in an external cloud service may have been viewed or taken, including encrypted passwords.
The developers of Goddess of Victory: NIKKE confirmed that a third party tampered with the game’s PC launcher scripts and issued a client fix on November 4; independent analysis reported the tampered scripts delivered a remote-access agent able to steal game credentials, browser data and files, with code that could target cryptocurrency wallet data.
Chainalysis said on November 4, 2026 that it had discovered names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 statement that it had found no evidence authentication credentials or session tokens were accessed; a separate on-path attack exposed a subset of customer passwords, and every user must reset their password and rotate API keys as services are restored — follow-up to our October 30 report.
MoneySmart said an unauthorised third party accessed its internal IT systems on October 29 and copied personal data of some customers in Singapore and Hong Kong — names, identification numbers, dates of birth, contact details, income ranges and financial profiles; no affected count has been given.
Binance said in a November 3 incident report that the October 29 theft began in September with a fake job interview that tricked a software engineer into running malicious code, spread to two more wallet-infrastructure employees, and reached its wallet signing service; about $2.85 billion is now frozen or intercepted — follow-up to our October 29 report.
Singapore Airlines said about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer numbers; its own systems were not breached — follow-up to our October 28 report.
Chainstack said an attacker who entered through a third-party component reached a customer account database containing organisation names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which the company is treating as exposed.
GitBook said a sophisticated, highly targeted attack using AI agents gave an attacker access to some of its infrastructure credentials on November 2; integration tokens, Git Sync secrets, API tokens and GitBook Assistant visitor questions may have been accessed, and all personal API tokens were revoked.
mSeven Software said an unauthorised actor acquired an encrypted copy of a database holding information on current and former mSecure users who synced through mSecure Cloud, and told customers to change passwords, reset two-factor authentication and remove passkeys.
Northflank said the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations — follow-up to our October 30 report.
Nojima said unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site, detected on November 1, leaked about 7 million member records: names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses; no card data was held, and affected passwords were force-reset on November 3.
DreamHost said an unauthorised third party exploited a vulnerability in its web-based File Manager and accessed the FTP/SFTP usernames and passwords of users who logged in between about August and October 23, 2026, plus webmail credentials for a limited number of users; formal breach notices were filed from November 2.
Malaysia Airlines said customer information processed through Amadeus between August 2023 and September 2026 may have been affected in the Amadeus breach; it gave no affected count and no list of data types, said its own IT systems were not breached, and said there is no evidence financial information was accessed.
Binance said it has covered about 95% of the roughly $6.3 billion stolen on October 29 and is resuming withdrawals in phases from November 1 across 15 networks, and the FBI attributed the theft to North Korea’s TraderTraitor unit.
Club Tourism said unauthorized access to part of its servers may have leaked personal information of about 4.32 million online members — names, addresses, phone numbers, email addresses and emergency contacts; passwords, passport, credit card and bank account details were not included.
Cathay Pacific said the unauthorised access at Amadeus affected about 53,000 of its bookings from August 2023 to September 2026, covering booking references, passenger names and flight details, with contact details, travel document information and frequent flyer numbers in a smaller subset.
Ryohin Keikaku said unauthorised access to the official MUJI App may have leaked up to about 27.26 million records — email addresses, dates of birth and gender, including former members — while names, addresses, phone numbers and card details were not included.
All Nippon Airways said unauthorised access at Amadeus may have exposed reservation data for about 37,800 customers — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included.
A password for an internal Applebee’s customer database was hidden inside its Android app, giving anyone who extracted it access to names, email addresses, dates of birth, phone numbers and ZIP codes; the flaw is fixed and the company says it has found no evidence of unauthorised access.
Northflank disclosed a security incident on October 30 and told all customers to assume their environment variables had been decrypted and rotate every stored secret immediately, after users reported unauthorised use of AI API keys stored on the platform; no root cause or affected count has been given.
Chainalysis said an external actor using what it calls ‘offensive agentic techniques’ gained unauthorised access to its systems and internal tools in October, and accessed user IDs, full names, email addresses and organisation role labels for platform users; it says investigation content, clear-text passwords, MFA secrets and session tokens were not accessed.
Binance confirmed attackers breached its systems, including a DevOps engineer’s laptop, and drained about $6.3 billion from its wallets in about 20 minutes on October 29; deposits and withdrawals were suspended, about $2.7 billion has been frozen, and the exchange says user funds are safe and all losses will be covered.
A compromised third-party monitoring script hijacked logged-in traders’ sessions on Polymarket.com, liquidated positions and drained crypto assets; Polymarket halted trading for about an hour and promises full reimbursement to affected traders.
Good Smile Company said malicious software on its official online shop’s payment page may have leaked the full card details of about 2,800 customers who entered a card between October 21 and 23, and that partial details for 402,466 saved cards and order information for 7,673 customers may also have been exposed.
The Florida Department of Education said unauthorised criminal access to its Florida Student Financial Aid website may have impacted about 4.9 million people; its FAQ says the compromised information includes Social Security numbers.
Revolve said an unauthorized actor may have obtained, through automated means, the names, contact information, payment card numbers and expiration dates of customers who saved payment information in their online shopping accounts; state notices put the number notified at at least 179,259 people.
Fore Coffee said an unauthorised party accessed its customer-data platform, exposing data from up to 5.7 million customer accounts, including names, contact details, dates of birth, addresses, hashed PINs and purchase history; payment data was not involved.
Japan Airlines and Japan Transocean Air said unauthorised access to Amadeus’s passenger service system left traces suggesting reservation data for about 92,000 customers may have been viewed, including contact details and passport numbers for about 2,000 customers.
Coinbase said a security incident at its analytics vendor Amplitude impacted a small subset of its customers' contact data; a spokesperson said contact and limited transaction data were impacted, with no evidence Coinbase's own systems were accessed and customer funds not impacted.
Daishin Securities said personal and credit information on 38,490 customers was leaked in a hack of a server linked to account openings, including names, email addresses and mobile phone numbers.
TFG London’s October 28 customer email confirmed some personal data was accessed in the October 11 attack on Phase Eight, Hobbs and Whistles — contact and delivery details, order information and, in some cases, the last four digits of a payment card.
Sony Network Communications said unauthorised access to its So-net member database exposed 2,585,481 So-net and plala member records, and that email addresses and passwords for 54,401 email accounts also leaked; it reset those email passwords on October 27.
ENGIE said attackers stole customer data after breaching a marketing platform used by its business partners in France; its internal systems were not compromised and no banking data was affected.
Keystone said its website breach exposed 25,964 buyer records and the WebAuth key used to verify its devices, so it will destroy 18,835 unsold devices, suspend shipments, and direct customers who received a device after October 20 to seek extra verification.
Foundation said attackers compromised its backend and sent phishing emails from its official domains; some messages included customers' mailing addresses or phone numbers, and attackers could access legacy records containing about 5,600 mailing addresses and 5,200 phone numbers.
Mirae Asset Life said a breach of its customer insurance application system and parts of its website leaked customer personal and credit information; how many customers are affected is still under investigation.
Alliance Healthcare Group said a third party gained unauthorised access to Alliance Medinet's membership-database system and compromised personal data of about 110,000 members, including names, personal identification numbers and contact information.
Keystone said a third party obtained customer names, contact details, shipping addresses and order details from its official website store; payment details, recovery phrases and private keys were not involved.
GMO Internet confirmed on October 24 that customer information was taken from its Onamae.com Desktop Cloud service in Japan, after malware was planted on customer servers and saved trading-account logins were misused for unauthorised trades; up to 26,739 servers are in scope and payment data was not stored on the servers.
The University of Copenhagen said hackers gained access to one of its test environments holding a database with information on approximately 525,000 individuals, including full names, national identity (CPR) numbers, work and home telephone numbers and personal email addresses.
Navigate360 said an unauthorized third party accessed one of its systems and obtained copies of data between November 21, 2025 and March 5, 2026; Washoe County School District, summarising the investigation, says the incident involved approximately 8.3 million data records across the United States and Canada.
Capcom said a third party accessed its CAPCOM ID membership service and reached 11,774,247 records worldwide, including email addresses and last-login IP addresses, and changed passwords without authorization on 196 accounts.
Marathon Health said an unauthorised individual posing as an IT worker tricked an employee into disclosing credentials on August 24 and exported information from a cloud application, including names, contact information, dates of birth and Social Security numbers, with medical and health insurance information also reported compromised; notification letters began October 20.
Zeabur said an attacker using leaked internal credentials broke into its shared clusters, dedicated servers and internal systems on October 14-15, 2026 and read its platform database, including 3,218,965 environment-variable records and account data tied to 321,810 accounts.
TeamUpdraft said unauthorised access to teamupdraft.com over October 17-18 led it to believe its customer database was accessed, including connection keys for UpdraftCentral that attackers have since used to install backdoor plugins on connected WordPress sites.
Hollys said unauthorised access to a cloud service holding its membership information leaked about 2.76 million customer records — cumulative member data from 2009 to February 11, 2020, including duplicate members — with member IDs and passwords among the leaked items.
Napoleon Perdis said an unauthorised party had access to customer records held by its third-party provider Retail Express between November 2025 and June 2026, and that about 339,055 customer records were accessed.
The California Department of Education said an unauthorised party used a compromised login credential to copy student files from Educational Testing Service’s file-transfer site between May 22 and September 18, 2026, covering all students enrolled in the three previous school years.
Yamato Transport said about 5.31 million personal information records of users of its Kuroneko deferred payment service had been leaked following unauthorised access to the service’s system.
Nikkei said stolen authentication credentials were used to access a cloud service in the early hours of October 7, 2026, leaking about 1.83 million personal data records.
More Rewards found unauthorised activity on one of its servers on October 13, 2026, and confirmed on October 16 that members’ names and, where provided, addresses, phone numbers, email addresses and dates of birth were accessed.
SourceNext said a third party used an API for retrieving member information to reach its member information management system between October 9 and 13, 2026, potentially exposing up to 22,519,960 member records.
BK Japan said an outside party accessed the system that manages member information for its official app between October 2 and 7, 2026 and took data on about 11.18 million members.
Malware on a contractor’s computer put records for about 8,631,000 customers and 93,000 employees at risk; Daiichi Kosho’s own systems were not breached and no data theft or leak has been confirmed.
ASOS said an unauthorised party impersonated a trusted contact to obtain an employee’s login credentials, then used them to reach customer information held on third-party platforms the retailer uses.
Denmark’s Ministry of Digital Affairs said unauthorised parties misused a legally authorised company’s access to the CPR register, the national population registry; police opened an investigation.
An unauthorised party accessed DriveWealth’s network on September 4–5, 2026 and exfiltrated personal information of people for whom it had opened brokerage accounts.
Bromcom identified an incident involving legacy single sign-on registration functions; it says there is no evidence its school MIS database was accessed and no successful account takeover was identified.
An unauthorised actor downloaded certain files from United Underwriters’ systems on May 1, 2026; after a forensic investigation, notification letters were mailed starting September 21, 2026.
An unauthorised party obtained credentials from a third-party vendor and used them through a limited application interface to download copies of patient personal data for a small number of Veradigm’s customers.
No reports match those filters. Clear the filters