Our analysts' picks from recent disclosures. Labels show what's confirmed: Confirmed means the organization or a regulator filing confirmed it; Reported means credible press reports the organization hasn't confirmed; Attacker claim means a criminal group's claim not yet verified.
FinanceConfirmedOct 19, 2026
Citizens Bank notifies customers of data breach exposing Social Security numbers
Citizens Bank, N.A. (Citizens Financial Group) · United States
Citizens Bank said an unauthorized third party accessed a system containing customers' personal information, and that it identified the incident on September 10, 2026. The bank said it found no evidence the data was examined or misused and that the issue is fully remediated. Cybernews describes this as the bank's second incident of 2026; in April, Citizens said data was taken from a third-party vendor, mostly masked test data affecting a small number of customers.
- Affected
- Not disclosed in the customer notice
- Data exposed
- Names, Social Security numbers, dates of birth, phone numbers, email addresses
- How it happened
- Not disclosed (unauthorized access to a system holding customer data)
Why it matters: Keep a current inventory of every system that holds Social Security numbers and monitor access to it closely.
EducationConfirmedOct 16, 2026
One compromised login exposes California student testing records at ETS
Educational Testing Service (ETS) / California Department of Education · United States
According to the California Department of Education, an unauthorized party used a compromised login to access and copy student files from a file-transfer (SFTP) site run by ETS, the state's testing contractor, between May 22 and September 18, 2026. ETS detected the activity on September 25, took the site offline and built a replacement with stronger controls. ETS said it has found no evidence the data has been published.
- Affected
- Not given as a number; includes, but is not limited to, all students enrolled in the past three school years
- Data exposed
- Names, dates of birth, addresses, school and grade, student IDs, demographics, disability and Section 504 status, testing accommodations and results. No SSNs, financial data or passwords, per the notice.
- How it happened
- Compromised login credential for the vendor's SFTP site
Why it matters: Require multi-factor sign-in and monitoring on vendor file-transfer accounts that hold bulk sensitive data; here a compromised login was used over nearly four months before the activity was detected.
Consumer techConfirmedOct 7, 2026
Discord bot Double Counter breached through a forgotten server
Double Counter (Discord security bot, operated by Tellter) · Operator reported to France's CNIL
Double Counter's operator said an attacker broke into its cloud systems on October 4, 2026, copied about 12 GB of database records, and used a stolen bot token to post unwanted invitations in about 50 large Discord servers. The operator said the attack is contained and that it notified France's data protection regulator. Discord said it was not a breach of Discord itself and disabled new installs of the app.
- Affected
- About 28 million Discord IDs and roughly 1 million unique emails, per the operator's own estimates; Have I Been Pwned lists about 275,000 emails in released data
- Data exposed
- Discord IDs and usernames, IP addresses with approximate location, email addresses (no passwords or card numbers, per the operator)
- How it happened
- A retired server still exposed an analytics tool online; the attacker forged an admin session and used cloud credentials left on the machine
Why it matters: Fully decommission retired servers and remove their credentials; a 'disconnected' machine can still hold the keys to production.
RetailConfirmedOct 6, 2026
ASOS confirms customer data breach after hackers push 'HACKED' app alerts
ASOS · United Kingdom
ASOS said third-party platforms it uses to communicate with customers were accessed after an employee was tricked into handing over login credentials. A group calling itself 'Xuanye' pushed alerts through the ASOS app claiming it had compromised ASOS's Snowflake account and threatening to leak data. ASOS has not confirmed the Snowflake claim, and Snowflake says its platform was not compromised.
- Affected
- Not disclosed
- Data exposed
- Per ASOS: names and contact details, not payment cards or passwords. A sample the attackers gave the BBC also showed addresses, dates of birth and search history.
- How it happened
- Social engineering: an employee's credentials were phished and used to access customer-communication platforms
Why it matters: Use phishing-resistant MFA and least-privilege access on SaaS data and customer-messaging tools; one phished employee login was enough to reach customer data held on third-party platforms.
GovernmentConfirmedOct 5, 2026
Denmark's national CPR register breach exposes 8.8 million people
Danish Central Person Register (CPR) · Denmark
Danish authorities said unauthorized parties misused a Danish company's lawful access to search the national civil registration system during September 2026. The CPR administration called it a serious security incident, blocked the company's access and notified the data protection agency. Police are investigating.
- Affected
- About 8.8 million people (records include emigrants and deceased people), per Danish authorities
- Data exposed
- Names, addresses, CPR (national ID) numbers, and possibly marital status and family relationships; people with address protection were not exposed
- How it happened
- Misuse of a third-party company's legitimate access to the register
Why it matters: Monitor how much data each third party with legitimate access pulls, so bulk lookups outside its normal use are flagged quickly.
HealthcareConfirmedOct 2, 2026
Oracle Health's legacy Cerner breach tally climbs to nearly 20 million
Oracle Health (Cerner) · United States
Oracle's customer notice confirmed unauthorized access to Cerner data on a legacy server not yet migrated to Oracle Cloud, sometime after January 22, 2025. A Texas Attorney General filing updated on October 2, 2026, first reported by Bloomberg, puts the total at nearly 20 million; Oracle has not publicly confirmed that figure. Sources told BleepingComputer the extortion attempts came from an individual actor known as "Andrew," who has not claimed ties to any established gang.
- Affected
- Nearly 20 million, per Texas AG data (not confirmed by Oracle), including about 3 million Texans
- Data exposed
- Names, Social Security numbers, medical record numbers, doctors, diagnoses, medications, test results, images and treatment details
- How it happened
- Stolen customer credentials used on legacy Cerner servers awaiting migration
Why it matters: Systems awaiting migration after an acquisition still hold live sensitive data; keep them under the same access controls and monitoring until they are retired.
GovernmentConfirmedSep 18, 2026
Pentagon personnel records agency breach affects about 3 million people
Defense Manpower Data Center (DMDC), U.S. Department of Defense · United States
DMDC's notification letter said a vulnerability in a DMDC file-sharing system let unauthorized users access files containing unencrypted personal data from October 2025 until the flaw was discovered on July 16, 2026. DMDC patched and restored the system and said it has no indication the information has been misused. No known group has claimed the attack.
- Affected
- About 3 million (2.76 million living and 294,000 deceased people), per a Defense Department official speaking to CNN
- Data exposed
- Social Security numbers, names, dates of birth, contact information, demographic data and military occupational specialty
- How it happened
- Vulnerability in a file-sharing system (product not named)
Why it matters: Monitor file-sharing systems for unusual access and encrypt stored personal data; here unauthorized access continued for about nine months before it was discovered.
Supply chainConfirmedSep 17, 2026
Stolen app key used to take shopper data from BigCommerce stores
BigCommerce merchants via the Ribon apps · United States
BigCommerce confirmed on September 17, 2026, that API credentials for the third-party apps Ribon and Ribon 1.5 had been compromised and used to pull customer data and inject malicious scripts into a small number of merchant storefronts; one affected retailer said the key was misused from September 13 to 17. BigCommerce said its own platform was not breached, revoked the key, removed the apps and notified affected merchants.
- Affected
- Not disclosed; BigCommerce says a small number of storefronts had scripts injected
- Data exposed
- Customer names, email addresses, phone numbers and physical addresses (one retailer said passwords and payment data were not accessed)
- How it happened
- Supply-chain compromise: an application key held by the third-party app developer was stolen (BigCommerce attributed it to a compromise at Fastr, which owns the developer)
Why it matters: Limit what third-party plug-ins can access, rotate their API keys, and watch for bulk data pulls from app integrations.
HealthcareConfirmedSep 14, 2026
Medi-Cal billing vendor Paradigm breach affects about 970,000 members
Paradigm Healthcare Services · United States
Paradigm, which processes Medi-Cal billing for California's Department of Health Care Services, said it became aware of unauthorized access to its network on October 13, 2025, with access occurring from October 8 to 15, 2025. Its investigation determined on August 18, 2026, that health information was potentially accessed. Paradigm said it took systems offline, notified law enforcement and has no evidence of fraud.
- Affected
- 970,403 people, per the company's California Attorney General filing
- Data exposed
- Names, dates of birth, gender and Medi-Cal member ID numbers
- How it happened
- Unauthorized access to its network (method not disclosed)
Why it matters: Vendors handling government health data should scope breaches faster; here about 11 months passed between detecting the intrusion and notifying people.
