Top Data Breaches of October 2026

Last month, the public sector, healthcare, technology, software, and manufacturing were among the top targeted sectors. Ransomware groups like ShinyHunters have targeted public sector organizations like the FBI and Florida DMV.

 

Cyber incidents have also caused massive financial losses, with companies like Bitget (a cryptocurrency exchange) suffering losses of $387.5 million.

 

As cybercriminals use AI to make their modus operandi unpredictable, undetectable, and persistent, organizations face increased pressure to proactively address security and compliance risks before they turn into threats.

 

Here is a look at some of the top breaches of October 2026

October latest data breach news

Let us look at some of the top data breaches of October 2026:

Victim: Convertr

About

Convertr is a London-based software company that offers solutions for lead management, data orchestration, and data optimization.

 

Industry

Software development

 

What happened?

Convertr got hit by a cyber attack in which hackers compromised a shared analytics script to steal shoppers’ payment data.

 

Impact

The data exposed includes payment card numbers, CVV, cardholder name, and CPF tax identification number. The number of data records exposed is currently under investigation.

Source

Victim: Bithumb

About

Bithumb Co., Ltd. is a Seoul-based cryptocurrency exchange that was founded in 2014. It is known for its digital asset trading platform that enables users to buy, sell, and trade cryptocurrencies.

 

Industry

Cryptocurrency

 

What happened?

Bithumb reported that it detected unauthorized access to the information of its employees, partners, and subsidiaries.

 

Impact

Around 6,444 customer records were breached, of which personal information 844 were leaked.

Source

Victim: Mirae Asset Global Investments

About

Mirae Asset Global Investments is a Seoul-based asset management company that was founded in 1997. It is known for its investment solutions across global financial markets.

 

Industry

Financial services

 

What happened?

On 28th October, Mirae Asset Global Investments reported that it suffered a data breach caused by unauthorized access to its systems.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Daishin Securities

About

Daishin Securities Co. Ltd. is a Seoul-based financial services company that was founded in 1962. It is known for its securities brokerage, asset management, and wealth management services.

 

Industry

Financial services & securities brokerage

 

What happened?

On 28th October, Daishin Securities reported that it became a target of a cyber attack that exposed personal data of its customers.

 

Impact

About 38490 customers’ personal data records were exposed, including names, email addresses, and mobile phone numbers.

Source

Victim: Department of Homeland Security

About

The U.S. Department of Homeland Security is a department of the federal government that was founded in 2002. Its responsibilities range from border security to counterterrorism.

 

Industry

Public sector

 

What happened?

The Department of Homeland Security was breached, exposing personally identifiable information of thousands of its employees.

 

Impact

Records belonging to more than 40000 people have been exposed, including names, job titles, phone numbers, and office locations of federal department employees.

Source

Victim: Bandai Namco

About

Bandai Namco is a Minato-based entertainment company that was founded in 2005. It is known for the development and publishing of video games, toys, animation, and other entertainment products.

 

Industry

Video games

 

What happened?

Bandai Namco became a target of a third-party data breach on its email service provider, YmirLink, that exposed the information of its customers.

 

Impact

The data breach exposed email addresses and internal IDs of around 346000 members of the GUNDAM base.

Source

Victim: Ymirlink

About

YMIRLINK Inc. is a Shibuya-based software company that was founded in 1999. It is known for its cloud-based messaging solutions for businesses and organizations.

 

Industry

IT & software

 

What happened?

On 26th October, YMIRLINK Inc. reported that it became a target of a data breach that affected its customers to whom it provides services.

 

Impact

The data breach exposed a total of 51 million cumulative records, including data of the companies it provides services to, including Bandai Namco.

Source

Victim: Allium

About

Allium is a New York-based blockchain data infrastructure company that was founded in 2021. It is known for its platform that collects, standardizes, and reconciles data from multiple blockchain networks.

 

Industry

Blockchain

 

What happened?

On October 25th, Allium detected unauthorized access to its systems that prompted a security response and forced disruptions to some of its services.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Austin Independent School District

About

Austin Independent School District is a Texas-based public school district that offers elementary, middle, and high school educational programs.

 

Industry

Education

 

What happened?

Austin Independent School District got hit by a data breach due to a cyberattack on its third-party software provider.

 

Impact

The data breach exposed personal information of 45,000 current and former Austin Independent School District employees.

Source

Victim: Binance

About

Binance is a Chinese cryptocurrency exchange that was founded in 2017. It is known for its cryptocurrency spot and derivatives trading, digital asset management, and blockchain research.

 

Industry

Cryptocurrency

 

What happened?

Binance reported that it was hit by a cyberattack that affected its systems.

 

Impact

Binance reported on 29th October that its platform has impacted 6.3 billion worth of assets. The nature and quantity of data exposure are currently under investigation.

Source

Victim: Pizza Hut Japan

About

Pizza Hut Japan is a Yokohama-based Japanese operation of the global pizza brand. It was founded in 1973 and is known for its pizza delivery, takeout, and dine-in services.

 

Industry

Food service and restaurant

 

What happened?

On October 19, 2026, Pizza Hut Japan confirmed unauthorized access to its payment API related to its domestic online ordering service and exposure of information.

 

Impact

The impact of the incident is currently under investigation. The company has reported that Customer ID, email address, phone numbers, records of deleted customer information, and transaction records have been exposed.

Source

Victim: India’s Central Board of Film Certification

About

The Central Board of Film Certification is a government organization under India’s Ministry of Information and Broadcasting. It is responsible for the review and certification of films for public exhibition.

 

Industry

Public

 

What happened?

India’s CBFC has reported that it discovered unauthorized access to confidential documents.

 

Impact

The data exposed documents linked to more than 500 film titles, including shooting scripts, censor cut orders, certification files, and private distribution agreements submitted through the e-Cinepramaan portal.

Source

Victim: The Oneonta School

About

The Oneonta City School District is a New York-based public school district that was founded in 1957. It offers kindergarten to grade 12 education.

 

Industry

Education

 

What happened?

Oneonta City School District was forced to temporarily close down due to a ransomware attack that caused disruption of its systems.

 

Impact

The cyber attack forced the school to temporarily close for two days. The complete impact of the incident is currently under investigation.

Source

Victim: Arizona’s Empowerment Scholarship Account

About

Arizona’s Empowerment Scholarship Account program is a government-funded program that is administered by the Arizona Department of Education. It offers eligible families support for approved educational expenses like private school tuition, tutoring, and other services.

 

Industry

Education

 

What happened?

Arizona’s Empowerment Scholarship Account program became a target of a cyberattack.

 

Impact

The complete impact of the cyber incident is currently under investigation.

Source

Victim: Quest diagnostics

About

Quest Diagnostics is a New Jersey-based medical diagnostics company that was founded in 1967. It offers laboratory testing, diagnostic information services, and specialized testing solutions.

 

Industry

Healthcare and medical diagnostics

 

What happened?

On October 21, 2026, Quest Diagnostics Inc. discovered unauthorized access to its Quanum LSM system, which is used for placing test orders and receiving & looking up results.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Parkview Health

About

Parkview Health is a Fort Wayne-based non-profit healthcare system that was founded in 1878. It provides hospital care, primary and specialty care, and other medical services.

 

Industry

Healthcare

 

What happened?

Parkview Health was forced to disable its network in response to a cyberattack.

 

Impact

The complete impact of the incident is currently under investigation.

Source

Victim: Onamae Desktop Cloud

About

Onamae Desktop Cloud is a Tokyo-based cloud-based desktop service provider that offers remotely accessible desktop environments hosted on cloud infrastructure.

 

Industry

Cloud computing

 

What happened?

Onamae discovered that hackers compromised their infrastructure and installed malware on their customers’ servers.

 

Impact

The cyber attack impacted up to 27000 customer servers. The complete impact of the incident is currently under investigation.

Source

Victim: H&M

About

H&M is a Stockholm-based global fashion retailer that was founded in 1947. It offers fashion products, footwear, and homeware through physical and online stores.

 

Industry

Clothing

 

What happened?

A threat group called the Xuanye group has claimed to have hacked H&M and stolen its data.

 

Impact

The company is currently investigating the claim and assessing its validity.

Source

Victim: Square Enix

About

Square Enix is a Tokyo-based entertainment and video game publisher that was founded in 2008. It is known for the development, publishing, and distribution of video games.

 

Industry

Video games

 

What happened?

On October 19, Square Enix notified its customers to change their passwords after detecting a wave of unauthorized logins and credential stuffing attacks.

 

Impact

The company has not disclosed the number of accounts affected. The nature and quantity of data exposed are currently under investigation.

Source

Victim: University of Copenhagen

About

The University of Copenhagen is a Denmark-based university that was founded in 1479. It is known for its undergraduate, graduate, and doctoral education.

 

Industry

Education

 

What happened?

The University of Copenhagen confirmed unauthorized access to its test environments containing personal data records.

 

Impact

The data breach exposed personal data belonging to 525000 people and 20000 staff, including full names, CPR(National identity numbers), phone numbers, and email addresses.

Source

Victim: PwC

About

PricewaterhouseCoopers (PwC) is a UK-based global professional services network that was founded in 1998. It offers audit and assurance, tax, legal, and consulting services.

 

Industry

Professional services

 

What happened?

The Everest ransomware group has claimed to have targeted and stolen data from the PwC group.

 

Impact

The group has claimed to have stolen 590.69 GB of data, including 108426 files taken from internal HR and learning systems.

Source

Victim: Sony

About

Sony Group Corporation is a Minato-based multinational company that was founded in 1946. It is known for its products across gaming, music, movies, imaging technology, and financial services.

 

Industry

Electronics, entertainment, and technology

 

What happened?

Sony Group Corporation became a victim of a data breach that exposed its customers’ records.

 

Impact

The data breach has exposed around 2.6 million customer records, including 54401 email addresses, 2141986 So-net membership records, and 443495 records concerning plala (S Course) customers. The data set contained names, numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs.

Source

Victim: The National Institute for Demographic Studies (INED)

About

The National Institute for Demographic Studies (INED) is a French public research institute that was founded in 1945 in Aubervilliers.

 

Industry

Public sector

 

What happened?

On 17th October, the National Institute for Demographic Studies (INED)discovered that it had suffered a cyberattack that forced it to take its systems offline.

 

Impact

The complete impact of the incident, including the data compromised, is currently under investigation.

Source

Victim: Columbia, South Carolina

About

The City of Columbia is a municipal government that is responsible for providing public services to its residents, from managing infrastructure to supporting community development.

 

Industry

Public

 

What happened?

Columbia city became a victim of a cyberattack that forced it to take its systems offline.

 

Impact

The complete impact of the incident is currently under investigation.

Source

Victim: Capcom

About

Capcom Co. Ltd. is an Osaka based video game developer that was founded in 1979. It is known for the production, development, and distribution of PC, mobile, and arcade games.

 

Industry

Video game and entertainment

 

What happened?

Capcom reported that hackers breached its membership service, exposing its customers’ information.

 

Impact

Over 11.7 million customer records have been exposed, including email addresses, account creation date, last login timestamp, login numbers, and IP address.

Source

Victim: Railway

About

Railway is a San Francisco-based software development company that was founded in 2020. It is known for its cloud deployment platform that enables developers to build, deploy, and manage applications.

 

Industry

Cloud computing and development

 

What happened?

Railway issued a warning to its users that it discovered suspicious activity on its systems and confirmed unauthorized access.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Bullhorn

About

Bullhorn is a Boston-based company that was founded in 1999. It offers cloud-based recruitment and staffing solutions. It is known for offering automation tools that help staffing firms manage their recruitment operations.

 

Industry

Information technology

 

What happened?

Bullhorn became a victim of a cyberattack that caused a systemwide outage and forced it to disable access to its platform.

 

Impact

The complete impact of the incident is currently under investigation.

Source

Victim: The U.K. Housing Ombudsman Service

About

The Housing Ombudsman Service is the United Kingdom’s primary public body that was founded in 1997. It is primarily responsible for independently investigating and resolving complaints between residents and social housing landlords.

 

Industry

Public sector

 

What happened?

On 13 October, the U.K. Housing Ombudsman became a victim of a third-party breach that impacted its case management systems.

 

Impact

The impact of the incident is currently under investigation.

Source

Victim: Jerome School District

About

Jerome Joint School District is an Idaho-based school district that offers K-12 education, student support services, special education, and other programs.

 

Industry

Education

 

What happened?

Jerome Joint School District got hit by a cyberattack that forced it to take several of its systems offline.

 

Impact

The nature and quantity of data exposed and the impact of the incident are currently under investigation.

Source

Victim: Richmond Public Schools

About

Richmond Public Schools is a Virginia-based group of schools that offer K-12 education through neighborhood schools and specialized academic programs.

 

Industry

Education

 

What happened?

Richmond Public Schools became a victim of a cyberattack that forced it to take some of its systems offline.

 

Impact

The full impact of the incident is currently under investigation.

Source

Victim: TAKKT Food services

About

TAKKT is a German wholesale equipment supplier for industrial and packaging, office furniture & displays, and food services industries. It operates through an Ohio-based unit offering foodservice and food retail equipment.

 

Industry

Commercial foodservice

 

What happened?

TAKKT’s Ohio unit got hit by a cyberattack that affected several aspects of its operations.

 

Impact

The cyberattack affected its customer service and delivery operations.

Source

Victim: Zeabur

About

Zeabur is a Taiwan-based software development company that was founded in 2022. It is known for its cloud-based application deployment platform.

 

Industry

Cloud computing/Software development

 

What happened?

Zeabur became a victim of a second cyber attack carried out using leaked internal credentials stored in plaintext that caused a compromise of its infrastructure.

 

Impact

The cybersecurity incident caused a complete compromise of its infrastructure, exposing 3.2 million environment variable records and information belonging to 321810 accounts. It was the second time the company was attacked, which forced the company to shut down.

Source

Victim: Ahold Delhaize

About

Ahold Delhaize N.V. is a Zaandam-based retail company that was founded in 2016. It is known for its supermarkets, hypermarkets, convenience stores, and liquor stores.

 

Industry

Retail

 

What happened?

Alhold Delhaize became a victim of a data breach that forced it to take some of its systems offline.

 

Impact

The incident affected multiple chains of grocery stores across the United States. The complete impact of the incident is currently under investigation.

Source

Victim: Poole Group

About

The Poole Group is a Sunshine Coast-based accounting services provider that was founded in 1981. It is known for its accounting services like tax and accounting, audit & assurance, and insurance.

 

Industry

Accounting

 

What happened?

Poole Group became a target of a ransomware attack that affected its IT environment.

 

Impact

The full impact of the incident is currently under investigation.

Source

Victim: SBI

About

State Bank of India is a Mumbai-based financial services and banking institution that was founded in 1955. It is known for its retail and corporate banking, loans, digital banking, investment services, wealth management, and other financial products.

 

Industry

Banking

 

What happened?

A threat actor identified as Siriusim has claimed to have exposed customer records and documents linked to SBI and its subsidiaries.

 

Impact

The threat actor has claimed to have stolen and published 375000 customer records and 2722 PDF documents. The authenticity and source remain unconfirmed.

Source

Victim: Daiichi Kosho

About

Daiichi Kosho is a Minato-based entertainment and karaoke company that was founded in 1973. It is known for its commercial karaoke systems and karaoke & restaurant venues.

 

Industry

Entertainment and Karaoke

 

What happened?

Nippon Columbia Group, one of Daiichi Kosho’s suppliers, got hit by a cyber attack that compromised personal information of its customers.

 

Impact

The data breach exposed personal information of almost 9 million (8.72 million) customers, including their registered names, genders, dates of birth, email addresses, and telephone numbers.

Source

Victim: Adventure Inc. (Skyticket)

About

Adventure Inc. is a Tokyo-based travel technology company that was founded in 2006. It is known for its range of tourism and travel services, from accommodation-related services to car rentals, bus, and ferry-related services.

 

Industry

Travel & tourism

 

What happened?

Adventure Inc. became a victim of a cyber attack which resulted in the exposure of its customers’ information.

 

Impact

The data breach exposed 14.64 million personal records, including names, dates of birth, email addresses, phone numbers, postal addresses, and hashed login passwords.

Source

Victim: Yakiniku King

About

Yakiniku King is an Ishikawa-based grilled meat restaurant that was founded in 2007. It is known for its wide selection of grilled meats. It is operated by Monogatari Corporation.

 

Industry

Food service/restuarant

 

What happened?

On October 5, Monogatari Corporation disclosed that it experienced a data breach that exposed the data of its members.

 

Impact

The data breach exposed the data of 10,788,963 members of its official app.

Source

Victim: GMO Research and AI

About

GMO Research & AI Inc. is a Shibuya-based market research company that was founded in 2002. It is known for its market research services involving the collection of insights.

 

Industry

Market research and technology

 

What happened?

GMO Research & AI Inc. was hit by a cyberattack that exposed its members’ data.

 

Impact

The cyber attack exposed data of up to 948500 members, including their names, email, and home addresses.

Source

Victim: Mr.Max Holdings

About

Mr.Max Holdings is a Fukuoka-based retail holding company that was founded in 1925. It is known for its chain of discount stores and shopping centers.

 

Industry

Retail

 

What happened?

On October 6, Mr. Max reported that it identified unauthorized access to its servers. 

 

Impact

The data breach exposed personal data of 1735154 members, including their member ID, names, email addresses, and phone numbers.

Source

Victim: Scala Communications

About

Scala Communications Inc. is a Shibuya-based software development company that was founded in 2004. It is known for its range of software products for the improvement of business operations.

 

Industry

Information technology and software

 

What happened?

On October 5, Scala Communications reported that it became a victim of a data breach due to unauthorized access to its FAQ system.

 

Impact

The data breach exposed up to 713126 customer inquiry records and information belonging to more than five of its client companies.

Source

Victim: Senture

About

Senture is a Kentucky-based government services contractor that is known for its customer support and business process services.

 

Industry

Business process outsourcing

 

What happened?

The Department of Transportation was forced to take its systems offline due to an attack on Senture, its contractor.

 

Impact

The complete impact of the incident is currently under investigation.

Source

Victim: BankMobile

About

BankMobile is a North Carolina-based digital banking company that was founded in 2015. It is known for its digital financial, online banking, and payment services for college students and other consumers.

 

Industry

Digital banking

 

What happened?

BankMobile identified unauthorized access to its systems that exposed data.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Nissui

About

Nissui Corporation is a Tokyo-based food and marine products company that was founded in 1911. It is known for its seafood and processed food products.

 

Industry

Food processing/sea food/marine products

 

What happened?

Nissui detected unauthorized access to its third-party data centre.

 

Impact

The cyber attack forced the company to take several systems offline.

Source

Victim: Heber City

About

Heber City is a Utah-based municipality that oversees municipal services, community development, and recreational facilities.

 

Industry

Public sector

 

What happened?

On 10 October, Heber City got hit by a cyber attack that impacted its systems.

 

Impact

The cyber attack forced the city to take some of its systems offline.

Source

Victim: Double Counter

About

Double Counter is Discord’s verification and security service that helps online communities identify alternate/automated accounts, prevent ban evasion, a nd reduce spam and abuse.

 

Industry

Online community management

 

What happened?

Double Counter became a target of a cyber attack that exposed information of Discord’s users.

 

Impact

The data breach exposed 275000 unique email addresses and Discord usernames.

Source

Victim: Icon Oncology Cancer

About

Icon Oncology is one of Australia’s largest healthcare providers, founded in 2015. It is known for its radiation therapy, chemotherapy, and managed care solutions.

 

Industry

Healthcare

 

What happened?

Icon Oncology Group became a target of a cyberattack that exposed its patients’ data.

 

Impact

The data breach has exposed more than 31,000 documents containing patient data. The exact quantity of data exposed is currently under investigation.

Source

Victim: Intermarché

About

Intermarché is a Jean-Pierre Le Roch-based supermarket brand that was founded in 1969. It has over 3000 stores across five countries.

 

Industry

Retail

 

What happened?

Multiple major French supermarket chains were hit by a cyber attack that affected multiple parts of their operations.

 

Impact

The cyberattack affected multiple aspects of operations across 100s of stores, including a sharp rise in refrigerator temperatures, forcing food spoilage.

Source

Victim: Coopérative U

About

Coopérative U is a Rungis-based retail chain that was founded in 1894. It operates through a chain of independent supermarkets and hypermarkets across more than 15 countries globally.

 

Industry

Retail

 

What happened?

Multiple major French supermarket chains, including Coopérative U, were hit by a cyberattack that affected multiple parts of their operations.

 

Impact

The cyber attack affected multiple aspects of operations across 100s of stores, including a temperature spike in refrigerators forcing spoilage of food.

Source

Victim: The Foschini Group (Hobbs and Whistles)

About

The Foschini Group is a Cape Town-based retail clothing group that was founded in 1924. It is the parent company of British retail chains Hobbs and Whistles.

 

Industry

Retail

 

What happened?

The Foschini Group got hit by a cyber attack that affected some of its IT systems.

 

Impact

The full impact of the cyber attack is currently under investigation.

Source

Victim: Phase Eight

About

Phase Eight is a London-based womenswear brand that was founded in 1979. It is known for its occasion and bridal wear.

 

Industry

Clothing

 

What happened?

Phase Eight became a target of a cyber attack that forced it to take some of its systems offline.

 

Impact

The complete impact of the incident is currently under investigation.

Source

Victim: Ampath Laboratories

About

Ampath Laboratories is a Centurion-based private pathology services provider that was founded in 1996. It operates through 127 laboratories across South Africa and Mozambique.

 

Industry

Pathology

 

What happened?

Ampath Laboratories became a victim of a ransomware attack that was orchestrated by the BytetoBreach ransomware group.

 

Impact

The threat actor, BytetoBreach, has claimed to have stolen 80 million patient records, including names, surnames, identity numbers, dates of birth, age, sex, language, physical address, email address, and mobile numbers.

Source

Victim: IDCF Frontier

About

IDC Frontier is a Tokyo-based data centre and cloud services provider that is owned by SoftBank Corp. It launched IDCF Cloud in 2014 and joined SoftBank Group in 2018.

 

Industry

Data centre and cloud services

 

What happened?

IDCF Cloud service became a victim of a ransomware attack that forced it to shut down its systems and networks.

 

Impact

The cyberattack impacted 495 companies and local governments that used the company’s services. The threat actor has claimed to have encrypted 225 databases, including 3.6 PB of data.

Source

Victim: East Japan Railway (JR East)

About

East Japan Railway Company is a Tokyo-based railway company that was founded in 1987. It is the largest passenger railway company in Japan, serving over 17 million passengers a day.

 

Industry

Railway

 

What happened?

JR East became a victim of a data breach due to a cyberattack on its cloud services provider, IDC Frontier.

 

Impact

JR East reported that around 6.09 million customer records have been compromised due to the attack on IDC Frontier.

Source

Victim: Scala Inc.

About

Scala Inc. is a Shibuya-based IT company that was founded in 1991. It is known for its IT, AI, IoT, DX, and customer support services across education, e-commerce, and other industries.

 

Industry

Information technology

 

What happened?

On October 6, Scala Inc. reported unauthorized access to its FAQ and inquiry-management system.

 

Impact

The company has reported that over 713,126 inquiry records have been exposed, spanning records from up to five companies.

Source

Victim: Citizen Watch

About

Citizen Watch is a Tokyo-based watchmaking company that was founded in 1918. It is known for its range of watches, machine tools, and electronic devices.

 

Industry

Precision equipment

 

What happened?

Citizen Watch became a target of a data breach due to an attack on its vendor for inquiry operations, Scala Communications.

 

Impact

The data breach exposed information belonging to 100,000 customers, including personal information like names, addresses, phone numbers, and email addresses, and bank and credit card information.

Source

Victim: Daiwa Security

About

Daiwa Securities Group Inc. is a Tokyo-based investment bank that was founded in 1943. It is known for its securities and investment-related services.

 

Industry

Investment banking

 

What happened?

Daiwa Securities Group reported that information about its clients was exposed due to a data breach at an external vendor.

 

Impact

The company reported that records belonging to more than 110000 clients were exposed, including names and account numbers.

Source

Victim: University of Illinois Chicago

About

The University of Illinois is a Chicago based public research university that was founded in 1867. It offers a range of undergraduate and graduate programs to over 59000 students in the United States.

 

Industry

Education

 

What happened?

The University of Illinois’ College of Medicine was forced to take some of its systems offline due to a cyberattack. The Booba Project ransomware group has claimed to have targeted the university.

 

Impact

The cyberattack exposed 344 GB of data, including personal, research, and academic information.

Source

Victim: Asos

About

ASOS plc is a London-based fast fashion and cosmetics company that was founded in 2000. It is known for its range of clothing and accessories across 196 countries.

 

Industry

Clothing industry

 

What happened?

ASOS plc reported to its customers that it discovered unauthorized access to its database.

 

Impact

The data exposed includes personal information, including names and contact details. The quantity of data exposed is currently under investigation.

Source

Victim: Nueva EPS (Colombia’s largest healthcare system)

About

NUEVA EPS is a Colombian health insurance organization that was founded in 2007. It operates as an Entidad Promotora de Salud (EPS) and manages health insurance and healthcare risk for members. With over 11.46 million affiliates, it is the largest EPS in Colombia.

 

Industry

Health insurance

 

What happened?

On October 4th, a hacker listed Nueva EPS’ database on a hacking forum containing health and personal information.

 

Impact

Health and personal information of over 11 million people has been exposed, including names, dates of birth, gender, national identification numbers, addresses, email addresses, healthcare provider & insurance information, ethnic & indigenous identity, medical conditions, and disabilities & mental health information.

Source

Victim: Georgia Power

About

Georgia Power is an Atlanta-based electric utility that was founded nearly 140 years ago. It is a subsidiary of Southern Company and generates & distributes electricity to 2.7 million customers across Georgia.

 

Industry

Energy

 

What happened?

Georgia Power discovered that an unauthorized third party gained access to some of its accounts.

 

Impact

The company reported that the cyberattack exposed some of its data connected to its accounts, including names, addresses, numbers, emails, and the last four digits of SSNs. The quantity of data exposed is currently under investigation.

Source

Victim: Denmark Central Population Registry

About

Denmark’s Central Person Register (CPR) is its nationwide civil registration system that was founded in 1968. It assigns its citizens a unique 10-digit CPR number and records their information.

 

Industry

Public sector

 

What happened?

Denmark’s Central Person Register suffered a data breach that exposed personal records of its citizens.

 

Impact

The data breach exposed personal information of 8.8 million people, including people who have moved abroad and those who have died. It includes names, addresses, and CPR numbers.

Source

Victim: The Technical University of Denmark (DTU)

About

The Technical University of Denmark is a Kongens Lyngby-based public technical university that was established in 1829. It is known for its polytechnic courses and programs.

 

Industry

Education

 

What happened?

The Technical University of Denmark reported that it discovered unauthorized access to its identity and access management (IAM) systems and exfiltration of large quantities of data.

 

Impact

DTU has reported that information belonging to 200,000 people has been exposed, including Danish civil registration numbers, full names, home addresses, profile pictures, office locations, employment-related details, telephone numbers, and relationships.

Source

Victim: MetaMask

About

MetaMask is a Fort Worth-based cryptocurrency platform provider that was founded in 2016. It is known for its non-custodial digital wallet that enables all users to store, send, receive, and swap cryptocurrencies.

 

Industry

Cryptocurrency

 

What happened?

On 1st October, MetaMask disclosed that it became a target of a cyberattack that affected some of its infrastructure.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: City of Vicksburg

About

The City of Vicksburg is a municipal government that offers a range of services to its residents that include public safety, public works, community development, and building and inspection services.

 

Industry

Public sector

 

What happened?

The City of Vicksburg became a victim of a cyberattack that forced it to take some of its systems offline.

 

Impact

The cyberattack forced the city to take some of its systems offline and affected its utility payments service.

Source

Victim: Frontline Education

About

Frontline Education is a Pennsylvania-based education technology company that was founded in 1998. It is known for its software and services that are made for school administration.

 

Industry

Education

 

What happened?

Frontline Education discovered that hackers exploited a vulnerability in third-party software to gain unauthorized access to their systems.

 

Impact

The data exposed includes data of all the employees who were affected, including their SSNs, email addresses, and physical addresses. The quantity of data exposed is currently under investigation.

Source

Victim: Granja Avicola La Ponderosa

About

Granja Avicola La Ponderosa, C.A. is a San Antonio-based poultry company that is known for its poultry breeding, processing, and commercialization of chicken.

 

Industry

Agriculture

 

What happened?

Granja Avicola La Ponderosa became a target of a ransomware attack that was carried out by the Emperador ransomware group.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Ömür Hirdavat

About

Ömür Hirdavat is an Istanbul-based hardware company that was founded in 1997. It is known for the wholesale and retail trade of hardware and hand tools, including lock tools, door hardware, and occupational safety equipment.

 

Industry

Hardware

 

What happened?

Ömür Hırdavat became a target of a ransomware attack that was orchestrated by the Emperador ransomware group.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: Titus Germany

About

Titus is a German skateboarding company that was founded in 1978 in North Rhine-Westphalia. It is known for selling skateboards, skate shoes, streetwear, and sneakers.

 

Industry

Retail

 

What happened?

The Play ransomware group has claimed to have stolen data from Titus.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

Victim: City of Radford

About

The City of Radford is a government organization in virginia that offers public and digital services to its residents and businesses, including permits, maps, government-related information, and city documents.

 

Industry

Public sector

 

What happened?

The City of Radford is investigating a cyber incident after discovering an internet outage that disabled its office email and phone lines.

 

Impact

The cyberattack has caused an internet outage and has impacted several operations across the city.

Source

Victim: The Japan Times

About

The Japan Times is a Tokyo-based media and publishing company that was founded in 1897. It is known for its digital and print English-language newspaper.

 

Industry

Media

 

What happened?

Eclipse ransomware group has claimed to have targeted the Japan Times on a data breach forum. The organization has not yet confirmed the attack.

 

Impact

The nature and quantity of data exposed are currently under investigation.

Source

To be continued

In September, we saw how some of the most devastating data breaches impacted some of the biggest companies. Keep checking this space as we update our list of October’s top data breaches with a closer look at how they happened and their impact.

 

Note: Our list only highlights the breaches that have either occurred in 2026 or been reported/disclosed in 2026. All breaches reported in previous years, as of 2026, will be excluded from the list.