Confirmado
Nueva School: files accessed and copied
Files on the network were accessed and copied without authorisation between June 13 and 22, 2026.
Filtraciones de datos
Filtraciones de datos
Fuentes primero · Las cifras corresponden a esta base de datos, no al total mundial.
En investigación
NCH Corporation reports possible file theft
On March 9, 2026, NCH learned an unauthorised actor may have taken files containing names, SSNs, taxpayer IDs and driver’s licence numbers.
Confirmado
Baanx US: Crypto Life user data accessed
Between about September 23 and 28 and around October 17, 2026, unknown parties accessed personal information of some US Crypto Life users, including via a third-party service provider.
Confirmado
El Camino Health: documents copied from Microsoft 365 accounts
Four employees’ Microsoft 365 accounts were intermittently accessed August 26–September 2, 2026 and documents were copied or downloaded.
Confirmado
Central Ohio Primary Care: vishing attack accessed PHI files
A voice-phishing attack let a criminal actor access files containing protected health information.
Confirmado
Marathon Health: personal data obtained via employee account
After an alert on August 24, 2026 about an employee account, Marathon Health validated on September 9 that personal information was obtained by an unauthorised person.
Confirmado
2rinkan reports 489,564 customers’ email addresses exposed through Blastmail
A breach at email provider Blastmail exposed email addresses for 489,564 customers. The November 4 second report no longer qualifies this as the maximum used in the initial notice.
Confirmado
Arara Message data exfiltration; roughly 81 million email-address scope includes possible acquisition
Arara confirmed exfiltration through unauthorized access to its email-delivery platform. Its November 6 deduplicated scope of 81,329,467 email addresses also includes addresses that may have been acquired.
Confirmado
Santa Lolla discloses unauthorised access to ecommerce customer and order data
Unauthorised access during September 23–24 involved customer names, CPF identifiers, email, phones, delivery addresses and order numbers. Access to passwords or payment data was not identified.
En investigación
Photon Health reports possible data acquisition via Metabase zero-day
A zero-day in self-hosted Metabase was exploited and data may have been acquired on August 9–10, 2026.
Confirmado
Animate: 140,443 email addresses leaked via mail-delivery provider
A breach at Yumirulink’s Cuenote FC leaked 140,443 email addresses of some newsletter subscribers and campaign entrants. An October 30 update corrected the initial notice: sex, prefecture and member codes were not leaked.
Confirmado
Hitec Group USA: online-store customer data accessed via third-party app
Between September 13 and 17, 2026, online-store data was accessed through a third-party application, including names, emails, addresses, phones and order history.
Confirmado
So-net member database breach
Member names, email addresses, phone numbers and other fields were exposed.
En investigación
Sarku Japan reports possible employee-data exposure
On September 7, 2026, parts of systems became inaccessible in a cybersecurity incident; employment-related personal data may have been affected.
Confirmado
Navigate360: data copied from system
An unauthorised third party accessed a system and obtained copies of data between November 21, 2025 and March 5, 2026.
En investigación
Lexitas reports possible exposure from misconfigured DepositionNet server
Possible data leak: A server configuration error made OnDemand (DepositionNet) files accessible without authentication since around September 2019; they may contain names with SSNs or driver’s licence numbers.
En investigación
BASS Medical Group reports possible PHI access
Personal and/or protected health information may have been accessed or acquired without authorisation.
Confirmado
Dorsata: Metabase flaw allowed database access
A Metabase vulnerability allowed unauthorised access to the database platform from August 10 to 12, 2026; affected data contained patients’ PHI but not SSNs.
Confirmado
Blastmail breach: all subscriber-account data and some delivery lists taken
Unauthorised access at subsidiary RAKUS Light Cloud’s Blastmail led to removal of all customer-account records including company/contact names, contacts and contract/payment histories; some delivery lists were also leaked.
Confirmado
Toyo Tire Holdings of Americas: files taken in intrusion
Files were taken in a network intrusion and contained names and other data; the listing gives January 6 and February 4, 2026 as breach dates.