{"updated":"2026-10-19","count":209,"leaks":[{"id":230,"slug":"2026-10-denmark-cpr-pays","when":"Sep 2026, disclosed Oct 2026","sort_date":"2026-10","sector":"gov","sector_label":"Government","who":"Denmark's central population register (CPR), through the search access of Pays ApS","who_link":"Denmark's central population register (CPR)","what_left":"Names, addresses and CPR numbers of about 8.8 million people, living, emigrated and deceased, out of about 11 million records; people registered with name and address protection were not included","how":"A private company's legitimate access to the register misused for automated lookups, about 14 million of them between 10 and 20 September per documents obtained by TV 2. The company, Pays ApS, confirmed its access was exploited. A person claiming the breach told Politiken the account's password was \"123456\"","then":"Found on 2 October through an unusually large invoice; Datatilsynet notified on 4 October and opened a case; access blocked; police investigating. The person claiming the breach says they do not intend to sell or leak the data","source_url":"https://www.bleepingcomputer.com/news/security/denmark-population-registry-data-breach-affects-88-million-people/","more_sources":["https://www.helpnetsecurity.com/?p=386873","https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr","https://en.cryptonomist.ch/2026/10/13/denmark-data-breach-cpr/"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","address","national_id"],"aftermath_tags":[],"via":"Pays ApS","country":"Denmark","scale":8800000,"related_attack_ids":[]},{"id":233,"slug":"2026-10-shinhan-bank-loan-portal","when":"Sep 2026, disclosed Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"Shinhan Bank, South Korea","who_link":"Shinhan Bank, South Korea","what_left":"About 25,000 customers' names, phone numbers, annual income and calculated loan limits; resident registration numbers of 66 customers and identification codes (CI) of 97","how":"An attacker bypassed identity verification on a mobile inquiry service that loan agents use to check the progress of applications","then":"Service suspended and external IP addresses blocked; supervisor FSS sent an inspection team. First of 16 financial firms the FSC named on 14 October as breached in the same wave","source_url":"https://www.koreaherald.com/article/10891104","more_sources":["https://www.koreaherald.com/article/10892290","https://financefeeds.com/south-korea-targets-crypto-firms/"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","phone","wealth","national_id"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":25000,"related_attack_ids":[]},{"id":234,"slug":"2026-10-kb-kookmin-employee-support-system","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"KB Kookmin Bank, South Korea","who_link":"KB Kookmin Bank, South Korea","what_left":"Names, phone numbers, addresses and resident registration numbers of 119 customers","how":"Accessed through an employee mobile support system; method not disclosed","then":"Server and access routes blocked; the bank says banking transactions were unaffected and pledged compensation. One of 16 financial firms the FSC named on 14 October","source_url":"https://www.newkerala.com/news/a/kb-kookmin-bank-suffers-data-breach-403.htm","more_sources":["https://www.koreaherald.com/article/10892290","https://financefeeds.com/south-korea-targets-crypto-firms/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","phone","address","national_id"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":119,"related_attack_ids":[]},{"id":235,"slug":"2026-10-hana-bank-ods","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"Hana Bank, South Korea","who_link":"Hana Bank, South Korea","what_left":"Resident registration numbers, names, addresses, contact details and employer names of 89 customers","how":"Hackers accessed its sales support system (ODS), which the bank says is separate from its internet and mobile banking systems","then":"Intrusion IP blocked; affected customers being notified; the bank says no transaction data left. One of 16 financial firms the FSC named on 14 October","source_url":"https://www.koreaherald.com/article/10892290","more_sources":["https://financefeeds.com/south-korea-targets-crypto-firms/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["national_id","name","address","phone","employment"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":89,"related_attack_ids":[]},{"id":239,"slug":"2026-10-based-card-dashboard","when":"Oct 2026","sort_date":"2026-10","sector":"crypto","sector_label":"Crypto","who":"Based, crypto trading app and Visa card issuer","who_link":"Based","what_left":"Cardholders' KYC records: names, passport or Singapore national ID numbers, dates of birth, nationalities, home addresses, email addresses and phone numbers, tied to wallet addresses per Cryptopolitan; Based gives no count","how":"Unauthorised access on 5 October to the internal dashboard behind its Visa card program; method not disclosed","then":"Reported to Singapore's privacy regulator PDPC and to police; staff contacting affected cardholders. Based says its trading app and self-custody wallets were not affected","source_url":"https://www.cryptopolitan.com/based-founder-responds-breach-exposes-data/","more_sources":["https://phemex.com/news/article/based-reports-crypto-card-data-breach-to-regulators-confirms-trading-platform-unaffected-99502"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","dob","nationality","address","email","phone","wallet"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":243,"slug":"2026-10-ok-savings-bank-loan-application","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"OK Savings Bank, loan application service on its website","who_link":"OK Savings Bank","what_left":"250 customers, per the bank: names, dates of birth, mobile numbers, account numbers, addresses, email addresses, workplace names, business registration numbers, annual income and loan amounts","how":"Abnormal access attempts from 8:44 p.m. on 11 October to 2:14 a.m. on 12 October 2026; not disclosed how","then":"Reported to the Financial Supervisory Service on 13 October; count raised from 183 to 250; customers notified by text and email from 15 October","source_url":"https://www.digitaltoday.co.kr/en/view/114887/ok-savings-bank-confirms-personal-data-leak-of-250-customers-including-account-numbers-and-annual-income","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","phone","bank_account","address","email","employment","wealth"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":250,"related_attack_ids":[]},{"id":244,"slug":"2026-10-ok-savings-bank-deposit-notification","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"OK Savings Bank, page linked to its mobile deposit notification service","who_link":"OK Savings Bank","what_left":"268 customers: names, account numbers, product names, account balances, interest rates and dates of recent transactions","how":"Found during a full system inspection after the first leak; not disclosed how. The IP address differed from those the Korea Financial Security Institute had shared","then":"Reported to the Financial Supervisory Service; customers notified by text and email; IP blocked and account inquiry logic patched","source_url":"https://biz.heraldcorp.com/article/10905462","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","bank_account","balance","transactions"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":268,"related_attack_ids":[]},{"id":246,"slug":"2026-10-asos-snowflake","when":"Oct 2026","sort_date":"2026-10","sector":"other","sector_label":"Other","who":"Asos, online fashion retailer, via a third-party platform it uses to communicate with customers","who_link":"Asos","what_left":"Names and contact information, per Asos; home addresses, phone numbers, email addresses and customer profile notes, per BBC News as relayed by TechCrunch. No count given","how":"Hackers broke into a Snowflake instance by impersonating a trusted contact to obtain login credentials, per BleepingComputer as relayed by TechCrunch","then":"Hackers calling themselves Xuanye Group sent an unauthorised notification through the Asos app: \"Engage with us, or we will leak it\". Asos filed an update with the London Stock Exchange","source_url":"https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/","more_sources":[],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","address","phone","email"],"aftermath_tags":["extortion"],"via":"Snowflake","country":"United Kingdom","scale":null,"related_attack_ids":[]},{"id":259,"slug":"2026-10-telcoe-fcu-claim","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"Telcoe Federal Credit Union, Arkansas","who_link":"Telcoe Federal Credit Union","what_left":"Claimed: data of unknown size, per the Qilin group's posting found on 16 October 2026; no data types or count","how":"Not disclosed","then":"No statement from the credit union found","source_url":"https://www.breachsense.com/breaches/telcoe-federal-credit-union-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":260,"slug":"2026-10-via-credit-union-claim","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"Via Credit Union, Indiana","who_link":"Via Credit Union","what_left":"Claimed: attack by the Qilin group, posted 16 October 2026; no data types, scope or count","how":"Not disclosed","then":"No statement from the credit union found","source_url":"https://www.classaction.org/data-breach-lawsuits/via-credit-union-october-2026","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":261,"slug":"2026-10-coopecaja-claim","when":"Oct 2026","sort_date":"2026-10","sector":"bank","sector_label":"Finance","who":"Coopecaja, financial cooperative in Costa Rica","who_link":"Coopecaja","what_left":"Claimed: data of unknown size, per the INC Ransom group's posting found on 16 October 2026; no data types or count","how":"Not disclosed","then":"No statement from the cooperative found","source_url":"https://www.breachsense.com/breaches/coopecaja-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"Costa Rica","scale":null,"related_attack_ids":[]},{"id":265,"slug":"2026-10-rajasthan-police-claim","when":"Oct 2026","sort_date":"2026-10","sector":"gov","sector_label":"Government","who":"Rajasthan Police, state police in India","who_link":"Rajasthan Police","what_left":"Claimed: data of unknown size, per the SCARLETTGROUP posting found on 16 October 2026; no data types or count","how":"Not disclosed","then":"No news coverage or official statement found","source_url":"https://www.breachsense.com/breaches/rajasthan-police-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"India","scale":null,"related_attack_ids":[]},{"id":267,"slug":"2026-10-mariebelle-claim","when":"Oct 2026","sort_date":"2026-10","sector":"luxury","sector_label":"Luxury","who":"MarieBelle New York, luxury chocolate and food company","who_link":"MarieBelle New York","what_left":"Claimed: complete QuickBooks company file, inventory, and telehealth and clinical files, per the N0n group's posting of 13 October 2026; no customer count","how":"Not disclosed","then":"Claimed: posting marked as not paid and exposed. No statement from the company found","source_url":"https://www.dexpose.io/n0n-ransomware-strikes-mariebelle-new-york/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":["publication"],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":1,"slug":"2026-09-fbi-jobs-portal","when":"Sep 2026","sort_date":"2026-09","sector":"gov","sector_label":"Government","who":"FBI jobs portal, United States","who_link":"FBI","what_left":"Claimed: names, home addresses, phone numbers and spouse details of nearly all FBI employees and applicants, 2 to 3 TB in all. Journalists reviewed a 5,000-record sample","how":"Claimed exploit of the Oracle PeopleSoft HR system behind FBIJobs.gov. The FBI says it is aware of the claim and is investigating","then":"Portal taken offline on 23 September; the FBI then told staff it was [working as if every employee's personal information was compromised](https://abcnews.com/Politics/pentagon-breach-exposed-sensitive-data-3-million-people/story?id=136832909) and began notifying them. The group later said it would not publish the data after all, calling the episode a marketing campaign, a claim ABC News had not verified. The same group extorted dozens of companies in 2026. Unverified beyond the sample","source_url":"https://www.cbsnews.com/news/cybercriminal-group-fbi-data-shinyhunters/","more_sources":[],"leak_type":"theft","vector":"software_flaw","verification":"claimed","data_types":["name","address","phone","family"],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":2,"slug":"2026-09-revolut-emergency-requests","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Revolut","who_link":"Revolut","what_left":"Passports, driving licences, addresses, dates of birth and phone numbers; verification selfies, statements and transaction history may also have been included. Revolut said \"a limited number\" of customers; reports put it at about 680","how":"Fraudulent [emergency data requests](https://www.amlintelligence.com/2026/09/analysis-revolut-breach-puts-renewed-scrutiny-on-fake-law-enforcement-data-requests/), reportedly sent from a genuine government agency email domain. Emergency requests are answered without a court order when a life is said to be at risk","then":"Documents released online in stages with a ransom demand; reported to be aimed at wealthy customers. In October Revolut said it had helped 680 affected clients, would pay for replacement identity documents, and would not pay a ransom","source_url":"https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/","more_sources":["https://www.globalbankingandfinance.com/revolut-cover-costs-customers-hit-data-hack-western-europe/","https://www.govinfosecurity.com/crypto-industry-figures-blackmailed-by-revoluts-hacker-a-32824"],"leak_type":"handover","vector":"fake_legal_request","verification":"confirmed","data_types":["id_document","address","dob","phone","selfie","transactions","bank_account","wallet"],"aftermath_tags":["publication","extortion"],"via":null,"country":null,"scale":680,"related_attack_ids":[]},{"id":3,"slug":"2026-09-trezor-brevo","when":"Sep 2026","sort_date":"2026-09","sector":"crypto","sector_label":"Crypto","who":"Trezor, via email vendor Brevo","who_link":"Trezor","what_left":"About 347,000 newsletter subscriber addresses, per Trezor","how":"Attackers got into Trezor's account at the email vendor and sent a fake security alert from support@trezor.io, asking recipients to enter their wallet backup","then":"The emails passed authentication checks because they left the vendor's own servers; reports put clicks at about 2,500 before the domain was cut. Trezor says its systems were not affected","source_url":"https://techcrunch.com/2026/09/11/scammers-target-hundreds-of-thousands-of-crypto-owners-after-trezor-confirms-data-breach-of-email-provider/","more_sources":["https://therecord.media/trezor-bitbox-cointracking-phishing-crypto-holders"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["email"],"aftermath_tags":["phishing"],"via":"Brevo","country":null,"scale":347000,"related_attack_ids":[]},{"id":4,"slug":"2026-09-idscan","when":"Sep 2026","sort_date":"2026-09","sector":"idv","sector_label":"Identity vendors","who":"IDScan.net, identity vendor","who_link":"IDScan.net","what_left":"More than 153 million US and Canadian driver's licence scans, per KrebsOnSecurity's reporting on the marketplace; IDScan's own notice gives no count","how":"Customer accounts on its cloud platform accessed; IDScan's notice of 4 September says data \"may have been accessed without authorization\" on or around 1 September 2026","then":"Sold by the piece on the Nexus marketplace, which disappeared from the dark web shortly after the report; FBI investigating. IDScan says it is cooperating with federal law enforcement","source_url":"https://www.helpnetsecurity.com/2026/09/11/idscan-net-data-breach-153-million-drivers-licenses/","more_sources":["https://idscan.net/notification-data-security-incident/","https://www.claimdepot.com/data-breach/peoplesbank-2026"],"leak_type":"theft","vector":"account_takeover","verification":"reported","data_types":["id_document","name","dob","national_id"],"aftermath_tags":["sale"],"via":null,"country":"United States","scale":153000000,"related_attack_ids":[]},{"id":32,"slug":"2026-09-pentagon-dmdc","when":"Oct 2025 to Jul 2026, reported Sep 2026","sort_date":"2026-09","sector":"gov","sector_label":"Government","who":"Pentagon personnel database (Defense Manpower Data Center), United States","who_link":"Pentagon","what_left":"2.76 million living people and 294,000 deceased: Social Security numbers and details of the jobs held by military and civilian personnel, per a US defense official","how":"Unauthorised access to a Defense Manpower Data Center system by \"a small number of unauthorized users\" between October 2025 and July 2026, through a vulnerability patched on discovery","then":"Identity protection and credit monitoring offered; defense officials said they had found no evidence of misuse so far. First reported by Military Times","source_url":"https://abcnews.com/Politics/pentagon-breach-exposed-sensitive-data-3-million-people/story?id=136832909","more_sources":[],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["national_id","employment"],"aftermath_tags":[],"via":null,"country":"United States","scale":2760000,"related_attack_ids":[]},{"id":232,"slug":"2026-09-ey-tax-platform-wealth-clients","when":"Mar to Apr 2026, clients notified Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"EY tax services, holding tax files of clients of Goldman Sachs Wealth Management, Man Group and Tishman Speyer, via an unnamed IT service-management platform","who_link":"EY tax services","what_left":"Names, addresses, tax identifiers, email addresses and financial information, per EY's letters as reported; EY gives no count","how":"An unauthorised third party accessed a third-party IT service-management platform used by EY's tax staff between 28 March and 12 April 2026; support tickets on it held client tax documents. The Financial Times tied it to a flaw in Checkmarx software","then":"EY letter of 13 July filed with the California attorney general; clients of Goldman Sachs Wealth Management, Man Group and Tishman Speyer notified at the end of September. ShinyHunters claimed the breach. Goldman says its own systems were not affected and client assets \"remain safe\"","source_url":"https://www.silicon.co.uk/cybersecurity/goldman-ey-hack-631811","more_sources":["https://www.accountingtimes.com.au/profession/ernst-young-tells-clients-of-third-party-data-breach"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","address","national_id","email","wealth"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":242,"slug":"2026-09-ofx","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"OFX, international money transfer company","who_link":"OFX","what_left":"Names, usernames, addresses, email addresses, phone numbers, dates of birth, occupations, answers to secret questions, some transfer and recipient details, IP addresses and device information, per SMBtech; OFX gives no count and says the files held no copies of identity documents","how":"Unauthorised access on 28 September to files outside the databases behind its client platforms; method not disclosed","then":"Clients and other people, job applicants among them, contacted directly; OFX warns of scams and impersonation and says the data cannot be used to make a payment","source_url":"https://www.ofx.com/en-au/security/incident/","more_sources":["https://smbtech.au/news/ofx-confirms-customer-data-accessed-in-september-cyber-breach/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","email","phone","dob","employment","credentials","transactions","ip_address"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":245,"slug":"2026-10-gopax-customer-accounts","when":"Sep to Oct 2026","sort_date":"2026-09","sector":"crypto","sector_label":"Crypto","who":"Gopax, crypto exchange run by Streami","who_link":"Gopax","what_left":"Nicknames and login histories of nine people: seven customers and two current or former employees","how":"Abnormal access to some customer accounts from early September 2026; not disclosed how","then":"Announced by the Financial Services Commission on 14 October; Gopax disclosed and apologised on 16 October and says no asset losses identified so far","source_url":"https://en.sedaily.com/finance/2026/10/18/crypto-exchange-gopax-apologizes-two-days-after-hack","more_sources":["https://www.altcoinbuzz.io/gopax-operator-streami-among-16-firms-hit-in-south-korea-hack"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["account_id"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":9,"related_attack_ids":[]},{"id":251,"slug":"2026-09-johnson-investment-counsel","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Johnson Investment Counsel, wealth manager in Cincinnati, via its managed service provider","who_link":"Johnson Investment Counsel","what_left":"Employees: names, Social Security numbers, health insurance information and files saved to work drives, per the notice letter. No count; the letter says nothing about client data","how":"Access through the managed service provider's remote management platform, late on 8 September to early 9 September 2026","then":"Filed with the Massachusetts consumer affairs office on 8 October 2026; 24 months of credit monitoring offered; reported to law enforcement. Claimed: the Storm group posted 39.6 GB on 18 September, per ClaimDepot","source_url":"https://www.claimdepot.com/data-breach/johnson-investment-counsel-2026","more_sources":["https://cdn.prod.website-files.com/642f23e5f54b794300ac12a6/6ace48c4b8fea1caac3bcd8c_bNANJO6e4TkYRN-2li_Slfngh9y9XsnkHelXK8XxTPE.pdf"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","national_id","employment"],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":253,"slug":"2026-09-stokr-kyc-register-claim","when":"Sep 2026","sort_date":"2026-09","sector":"crypto","sector_label":"Crypto","who":"STOKR, Luxembourg digital securities platform","who_link":"STOKR","what_left":"Claimed: KYC investor register with full names, email addresses, countries, nationalities, wallet addresses and tax IDs where present, plus a mapping of identities to wallets for investors in six European countries, per the N0n group's posting","how":"Not disclosed","then":"Claimed: group set a deadline of 20 September 2026 and threatened to deliver investor data to the investors' tax authorities. No statement from STOKR or a Luxembourg regulator found","source_url":"https://www.dexpose.io/n0n-ransomware-group-targets-luxembourgs-stokr/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":["name","email","nationality","wallet","national_id"],"aftermath_tags":["extortion"],"via":null,"country":"Luxembourg","scale":null,"related_attack_ids":[]},{"id":254,"slug":"2026-09-receita-federal-claim","when":"Sep 2026","sort_date":"2026-09","sector":"gov","sector_label":"Government","who":"Receita Federal do Brasil, federal tax office","who_link":"Receita Federal","what_left":"Claimed: several thousand documents with personnel and customer data, plus gov.br user data with passwords, per the Emperador group's posting of 23 September 2026; no count","how":"Not disclosed","then":"No confirmation or denial of this claim found","source_url":"https://www.dexpose.io/emperador-targets-receita-federal-do-brasil-in-ransomware-attack/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":["credentials"],"aftermath_tags":[],"via":null,"country":"Brazil","scale":null,"related_attack_ids":[]},{"id":256,"slug":"2026-09-siinqee-bank-claim","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Siinqee Bank, commercial bank","who_link":"Siinqee Bank","what_left":"Claimed: sensitive data, per the LockBit 5.0 group's posting of 21 September 2026; no data types or count","how":"Not disclosed","then":"Group threatened release unless negotiations began. No statement from the bank found","source_url":"https://www.dexpose.io/lockbit-5-0-targets-ethiopian-banking-leader-siinqee-bank/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":["extortion"],"via":null,"country":"Ethiopia","scale":null,"related_attack_ids":[]},{"id":257,"slug":"2026-09-first-secure-bank-trust-claim","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"First Secure Bank and Trust, bank in Illinois","who_link":"First Secure Bank and Trust","what_left":"Claimed: sensitive data, per the Storm group's posting of 18 September 2026; no data types or count","how":"Not disclosed","then":"Group threatened to publish the full leak unless the bank made contact. No statement from the bank found","source_url":"https://www.dexpose.io/storm-ransomware-targets-first-secure-bank-and-trust/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":["extortion"],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":258,"slug":"2026-09-poca-valley-bank-claim","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Poca Valley Bank, community bank in West Virginia","who_link":"Poca Valley Bank","what_left":"Claimed: data of unknown size, per the Storm group's posting found on 29 September 2026; no data types or count","how":"Not disclosed","then":"No statement from the bank found","source_url":"https://www.breachsense.com/breaches/poca-valley-bank-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":262,"slug":"2026-09-guardrisk-claim","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Guardrisk, insurer owned by Momentum","who_link":"Guardrisk","what_left":"Claimed: data of unknown size, per the TheGentlemen group's posting found on 22 September 2026; no data types or count","how":"Not disclosed","then":"No statement from Guardrisk found","source_url":"https://www.breachsense.com/breaches/guardrisk-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"South Africa","scale":null,"related_attack_ids":[]},{"id":263,"slug":"2026-09-taspen-life-claim","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Taspen Life, insurer in Indonesia","who_link":"Taspen Life","what_left":"Claimed: sensitive data, per the LockBit 5.0 group's posting of 22 September 2026; no data types or count","how":"Not disclosed","then":"Group threatened to publish unless the insurer made contact. No statement from Taspen Life found","source_url":"https://www.dexpose.io/lockbit-5-0-targets-indonesian-insurer-taspen-life","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":["extortion"],"via":null,"country":"Indonesia","scale":null,"related_attack_ids":[]},{"id":264,"slug":"2026-09-armada-credit-bureau-claim","when":"Sep 2026","sort_date":"2026-09","sector":"bank","sector_label":"Finance","who":"Armada Credit Bureau, credit reporting firm in Uganda","who_link":"Armada Credit Bureau","what_left":"Claimed: sensitive data, per the Spirals group's posting of 24 September 2026; no data types or count","how":"Not disclosed","then":"Group threatened to publish the full data if no contact was made. No statement from the bureau found","source_url":"https://www.dexpose.io/spirals-ransomware-targets-armada-credit-bureau-in-uganda/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":["extortion"],"via":null,"country":"Uganda","scale":null,"related_attack_ids":[]},{"id":266,"slug":"2026-09-martin-lawrence-galleries-claim","when":"Sep 2026","sort_date":"2026-09","sector":"luxury","sector_label":"Luxury","who":"Martin Lawrence Galleries, fine art dealer and publisher in the US","who_link":"Martin Lawrence Galleries","what_left":"Claimed: 460 GB, per the Pear group's posting found on 25 September 2026; no data types or count","how":"Not disclosed","then":"No statement from the gallery found","source_url":"https://www.breachsense.com/breaches/martin-lawrence-galleries-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":268,"slug":"2026-09-charles-keith-claim","when":"Sep 2026","sort_date":"2026-09","sector":"other","sector_label":"Other","who":"Charles & Keith, Singapore footwear and accessories brand","who_link":"Charles & Keith","what_left":"Claimed: data of unknown size, per the TheGentlemen group's posting found on 25 September 2026; no data types or count","how":"Not disclosed","then":"No statement from the company and no Straits Times or CNA coverage found","source_url":"https://www.breachsense.com/breaches/charles-and-keith-data-breach/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"unconfirmed","data_types":[],"aftermath_tags":[],"via":null,"country":"Singapore","scale":null,"related_attack_ids":[]},{"id":5,"slug":"2026-08-trezor-shipmonk","when":"Aug 2026, widened Sep 2026","sort_date":"2026-08","sector":"crypto","sector_label":"Crypto","who":"Trezor, via shipping vendor ShipMonk","who_link":"Trezor","what_left":"13,689 recent buyers: names, emails, phone numbers, shipping addresses. Then about 67,000 US buyers from 2019 to 2021 orders, 80,689 in total","how":"Unauthorised access at the vendor; notification emails seen by BleepingComputer say the attackers exploited a vulnerability in Metabase, an analytics platform. The older orders had been confirmed deleted in writing under a 90-day policy and were still there","then":"Home addresses of hardware-wallet owners in circulation; Trezor warned of phishing by email, phone and post. ShipMonk received extortion emails from the ShinyHunters group, per BleepingComputer","source_url":"https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident","more_sources":["https://www.bleepingcomputer.com/news/security/trezor-data-breach-impact-now-reaches-81-000-customers/"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","phone","address"],"aftermath_tags":["extortion"],"via":"ShipMonk","country":null,"scale":80689,"related_attack_ids":[]},{"id":236,"slug":"2026-08-safepal-order-tracking","when":"Mar 2025 to Apr 2026, disclosed Aug 2026","sort_date":"2026-08","sector":"crypto","sector_label":"Crypto","who":"SafePal, crypto wallet maker","who_link":"SafePal","what_left":"Names, email addresses, shipping addresses, phone numbers and purchase details of about 39,798 customers who ordered between 2 March 2025 and 11 April 2026","how":"An authorization flaw in a plug-in's order-tracking function let other customers' order details be viewed","then":"Customers emailed on 16 August; SafePal says it took down over 30 fraudulent websites and phishing links. It says seed phrases, keys, bank and card details and ID numbers were not involved","source_url":"https://www.safepal.com/en/blog/security-update","more_sources":["https://www.coindesk.com/tech/2026/08/16/crypto-wallet-safepal-reveals-a-data-breach-exposing-nearly-40-000-customers-order-info"],"leak_type":"exposure","vector":"software_flaw","verification":"confirmed","data_types":["name","email","address","phone","order_history","wallet"],"aftermath_tags":[],"via":null,"country":null,"scale":39798,"related_attack_ids":[]},{"id":237,"slug":"2026-08-bits-of-gold-metabase","when":"Aug 2026","sort_date":"2026-08","sector":"crypto","sector_label":"Crypto","who":"Bits of Gold, crypto broker, Israel, via analytics provider Metabase","who_link":"Bits of Gold","what_left":"Possibly full names, ID numbers, phone numbers, email addresses, IP addresses, bank account details and public crypto wallet addresses; Calcalist put those potentially affected at up to 250,000 registered customers","how":"Attack on an external analytics provider, Metabase, through a security vulnerability; Bits of Gold says the system was a supporting one used for data analysis","then":"Customers notified; reported to the Capital Market Authority, which with the National Cyber Directorate is checking whether other Israeli firms were exposed. Bits of Gold says funds, passwords, card numbers and ID photographs were not exposed","source_url":"http://www.calcalistech.com/ctechnews/article/v90cccn73","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","national_id","phone","email","ip_address","bank_account","wallet"],"aftermath_tags":[],"via":"Metabase","country":"Israel","scale":250000,"related_attack_ids":[]},{"id":240,"slug":"2026-08-dgfip-tax-data","when":"Jun to Jul 2026, disclosed Aug 2026","sort_date":"2026-08","sector":"gov","sector_label":"Government","who":"DGFiP, France's tax administration","who_link":"DGFiP","what_left":"Tax data of 678,000 individuals and businesses, per the DGFiP: reference tax income, family quotient and withholding rate; company name and SIREN number for businesses; cadastral data on property addresses and surface areas. The attacker later claimed records on more than 2 million people","how":"Logins of a DGFiP agent and of an authorised third party used to enter the information system","then":"Theft claimed by the attacker on 12 and 13 August; CNIL notified; the DGFiP said it would file a complaint and contact each person concerned by email or letter. It says taxpayers' online accounts and passwords were not compromised","source_url":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","more_sources":["https://www.impots.gouv.fr/actualite/vol-de-donnees-suite-des-acces-illegitimes-au-systeme-dinformation-de-la-dgfip","https://www.thestack.technology/france-tax-agency-hack-affects-at-least-678-000/"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["wealth","address"],"aftermath_tags":[],"via":null,"country":"France","scale":678000,"related_attack_ids":[]},{"id":250,"slug":"2026-08-citibank-mailing-vendor","when":"Aug 2026, notices Oct 2026","sort_date":"2026-08","sector":"bank","sector_label":"Finance","who":"Citibank, via an unnamed service provider that mails customer communications","who_link":"Citibank","what_left":"Names, addresses and account numbers without the security code, per Citi's notice letter as summarised; no count given","how":"Security incident at a fourth-party service provider supporting the mailing of customer communications; Citi was notified on 13 August 2026","then":"Notice letters dated 6 October 2026, filed with the Massachusetts attorney general","source_url":"https://www.mass.gov/doc/2026-1769-citibank-na/download","more_sources":["https://classactionu.org/current-data-breaches/citibank/"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","address","bank_account"],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":252,"slug":"2026-08-canva-canny","when":"Aug 2026","sort_date":"2026-08","sector":"other","sector_label":"Other","who":"Canva, design platform, via Canny, a feedback tool connected to its Salesforce","who_link":"Canva","what_left":"Business contact data of enterprise customers' staff: names, business email addresses, workplace locations, corporate phone numbers, plus order forms, contracts and invoices, per Turkey's data protection authority. 424 organisations in Turkey; number of people not determined","how":"Unauthorised access at Canny, which told Canva on 29 August 2026","then":"Canva removed Canny's access and says its own platform and accounts were not compromised. Claimed: TheSevenDeadlySins listed Canva on 15 October with more than 200 million database rows, which Escudo Digital calls unverified","source_url":"https://www.turkiyetoday.com/business/third-party-data-breach-linked-to-canva-affects-424-organizations-in-turkiye-3228330","more_sources":["https://www.leto.legal/news/canva-canny-fuite-donnees-clients-entreprises-salesforce-2026","https://www.escudodigital.com/en/cybersecurity/hackers-claim-to-have-stolen-more-than-200-million-database-records-from-canva.html"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","phone","employment"],"aftermath_tags":["extortion"],"via":"Canny","country":null,"scale":null,"related_attack_ids":[]},{"id":6,"slug":"2026-07-liechtenstein-register","when":"Jul 2026","sort_date":"2026-07","sector":"gov","sector_label":"Government","who":"Liechtenstein register of beneficial owners","who_link":"Liechtenstein","what_left":"31,000 records: full name, date of birth, nationality, country of residence, and the share held in companies, foundations and trusts","how":"Copied overnight on 29 to 30 July from the state register kept for anti-money-laundering purposes","then":"Crisis team convened; no ransom demand and no publication reported as of 3 August. A list of who owns what, by name","source_url":"https://www.heise.de/en/news/Cyberattack-on-Liechtenstein-31-000-data-records-affected-11395172.html","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"reported","data_types":["name","dob","nationality","location","wealth"],"aftermath_tags":[],"via":null,"country":"Liechtenstein","scale":31000,"related_attack_ids":[]},{"id":113,"slug":"2026-07-brinks-home","when":"Jul 2026","sort_date":"2026-07","sector":"other","sector_label":"Other","who":"Brinks Home, home security company","who_link":"Brinks Home","what_left":"Brinks Home said it had \"not yet confirmed exactly what information was involved or whose\". ShinyHunters claims more than 1.1 million customer contact rows from Salesforce, more than 3.8 million support chat logs and more than 4,000 employee records. Have I Been Pwned counted more than 732,000 email addresses in the published file, with names, phone numbers, physical addresses, purchases and partial card data","how":"Intrusion identified on 20 July 2026, per Brinks Home. ShinyHunters says it took over an employee's Microsoft Entra account by voice phishing on 13 July","then":"ShinyHunters listed Brinks Home on its leak site and threatened release; data published, per Have I Been Pwned. Brinks Home warned customers of fraudulent messages impersonating it","source_url":"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-brinks-home-breach-threatens-to-leak-stolen-data/","more_sources":["https://haveibeenpwned.com/Breach/BrinksHome"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","phone","address","dob","order_history","bank_account","messages","employment"],"aftermath_tags":["extortion","publication"],"via":null,"country":null,"scale":3800000,"related_attack_ids":[]},{"id":255,"slug":"2026-06-peru-police-dirandro-claim","when":"Jun 2026","sort_date":"2026-06","sector":"gov","sector_label":"Government","who":"National Police of Peru, anti-drug directorate (Dirandro)","who_link":"National Police of Peru","what_left":"Claimed: 300,000 folders, 7.8 GB, with national ID numbers, postal codes and family references of police staff, offered for sale by a group calling itself Latam Fuckers","how":"Not disclosed","then":"Offered for US$700. Police neither confirmed nor ruled out that Dirandro systems were compromised; its website was down for several hours","source_url":"https://caretas.pe/?p=811678","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"claimed","data_types":["national_id","family"],"aftermath_tags":["sale"],"via":null,"country":"Peru","scale":null,"related_attack_ids":[]},{"id":7,"slug":"2026-05-tabiq","when":"May 2026","sort_date":"2026-05","sector":"other","sector_label":"Other","who":"Tabiq hotel check-in system, Japan","who_link":"Tabiq","what_left":"More than 1 million passports, driving licences and check-in selfies of hotel guests worldwide, files dating from 2020","how":"Cloud storage bucket left publicly readable","then":"Taken offline after a researcher and TechCrunch alerted the company; how long it was open, and who read it, is unknown","source_url":"https://techcrunch.com/2026/05/15/a-hotel-check-in-system-left-a-million-passports-and-drivers-licenses-open-for-anyone-to-see/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["id_document","selfie"],"aftermath_tags":[],"via":null,"country":"Japan","scale":1000000,"related_attack_ids":[]},{"id":8,"slug":"2026-05-instructure-canvas","when":"Apr to May 2026","sort_date":"2026-05","sector":"other","sector_label":"Other","who":"Instructure, Canvas learning platform","who_link":"Instructure","what_left":"Claimed: 3.65 TB on about 275 million students and staff at 8,809 institutions, including private messages","how":"Vulnerability in production systems, tied to Free-for-Teacher demo accounts per Bloomberg Law, then a second intrusion during exam week","then":"Login pages defaced; a ransom was reported paid on 11 May 2026. At least seven federal suits filed by 8 May 2026, six of them in Utah","source_url":"https://www.cnn.com/2026/05/07/us/canvas-hack-strands-college-students-finals-week","more_sources":["https://news.bloomberglaw.com/litigation/kkr-instructure-sued-after-data-breach-of-canvas-edtech-tool"],"leak_type":"theft","vector":"software_flaw","verification":"claimed","data_types":["messages"],"aftermath_tags":["extortion"],"via":null,"country":null,"scale":275000000,"related_attack_ids":[]},{"id":37,"slug":"2026-05-addi","when":"Mar 2026, claimed May 2026","sort_date":"2026-05","sector":"bank","sector_label":"Finance","who":"Addi, consumer credit fintech","who_link":"Addi","what_left":"Claimed: more than 16 million user records with personal data, financial information, card transaction history and identity verification records, per ShinyHunters. Addi told users personal information may have been compromised","how":"Unauthorised access to part of the platform, detected on 25 March 2026, per Addi. Addi did not say how","then":"ShinyHunters published a 483 GB file on a restricted platform, per MuchoHacker.lol, which could not confirm its contents. Users warned of calls and messages asking for data","source_url":"https://www.elcolombiano.com/negocios/addi-ciberataque-hackeo-datos-filtracion-datos-usuarios-BB35164432","more_sources":["https://muchohacker.lol/2026/05/ciberatacantes-afirman-haber-robado-datos-de-usuarios-de-addi/"],"leak_type":"theft","vector":"undisclosed","verification":"claimed","data_types":["name","transactions"],"aftermath_tags":["publication"],"via":null,"country":"Colombia","scale":16000000,"related_attack_ids":[]},{"id":56,"slug":"2026-05-charter-salesforce","when":"Apr 2026, confirmed May 2026","sort_date":"2026-05","sector":"other","sector_label":"Other","who":"Charter Communications, United States","who_link":"Charter Communications","what_left":"4.9 million customer records with names, email addresses, phone numbers and home addresses, per Have I Been Pwned; ShinyHunters claimed more than 42 million. Charter says no sensitive personal information was taken","how":"Per ShinyHunters, voice phishing of an employee's Microsoft account on 1 April, then an export from Charter's Salesforce instance","then":"Extortion deadline of 27 May passed unpaid and the data was posted publicly","source_url":"https://www.bleepingcomputer.com/news/security/charter-confirms-data-breach-after-shinyhunters-extortion-threat/","more_sources":["https://www.theregister.com/cyber-crime/2026/05/29/shinyhunters-adds-charter-to-trophy-shelf-after-49m-customer-records-leak/5248281"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","email","phone","address","employment"],"aftermath_tags":["extortion","publication"],"via":null,"country":"United States","scale":4900000,"related_attack_ids":[]},{"id":241,"slug":"2026-05-ecuador-registro-civil-photos","when":"May 2026","sort_date":"2026-05","sector":"gov","sector_label":"Government","who":"Registro Civil (DIGERCIC), Ecuador's civil registry","who_link":"Registro Civil (DIGERCIC)","what_left":"Claimed: 14.8 million records and more than 10.6 million identity-card face photos, about 165 GB, per the forum advertisement as reported by Primicias; a monitoring firm said fingerprints, signatures and facial biometrics may be included","how":"Not disclosed. The Registro Civil says it detected no breach of its current repository","then":"Advertised on a criminal forum on 4 May 2026; the data protection superintendency SPDP said it had not yet received a technical report ruling out a breach","source_url":"https://www.primicias.ec/ciencia-tecnologia/filtracion-registro-civil-ecuador-fotos-cedula-datos-biometricos-122005/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"disputed","data_types":["selfie","national_id","name"],"aftermath_tags":["sale"],"via":null,"country":"Ecuador","scale":14800000,"related_attack_ids":[]},{"id":38,"slug":"2026-04-canada-life","when":"Apr 2026","sort_date":"2026-04","sector":"bank","sector_label":"Finance","who":"Canada Life, insurer","who_link":"Canada Life","what_left":"Names, dates of birth, mailing addresses, gender and annual income levels of up to 70,000 people, most of them members of one large corporate group benefits plan","how":"Unauthorised access to certain applications through an employee account, per Canada Life","then":"ShinyHunters claimed it on 17 April and later published the data with a download link","source_url":"https://www.theglobeandmail.com/business/article-hackers-personal-information-70000-people-canada-life-data-breach/","more_sources":["https://www.hrreporter.com/focus-areas/compensation-and-benefits/canada-life-breach-exposes-data-of-up-to-70000-people-mostly-customers/394331","https://www.ctvnews.ca/canada/article/cybersecurity-incident-at-canada-life-reportedly-impacts-thousands/","https://cybernews.com/news/shinyhunters-myteresa-zara-carnival-7eleven-data-leak/"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","dob","address","wealth"],"aftermath_tags":["publication"],"via":null,"country":"Canada","scale":70000,"related_attack_ids":[]},{"id":39,"slug":"2026-04-kemper","when":"Apr 2026","sort_date":"2026-04","sector":"bank","sector_label":"Finance","who":"Kemper, insurer","who_link":"Kemper","what_left":"Claimed: over 13 million records and at least 29 GB from Kemper's Salesforce account, per ShinyHunters. A sample reviewed by Cybernews held employee names, email addresses and roles, and Stripe payment logs with customers' full names and amounts paid. Have I Been Pwned counted 269,000 unique email addresses with names, phone numbers, physical addresses and partial payment card data","how":"Not disclosed. Kemper confirmed a cybersecurity incident. Have I Been Pwned says the attackers allegedly reached Kemper's Salesforce environment through social engineering","then":"ShinyHunters posted the data on its leak site on 15 April after failed negotiations. Kemper notified law enforcement; class actions filed","source_url":"https://cybernews.com/security/kemper-insurance-data-leak-shinyhunters/","more_sources":["https://www.law360.com/articles/2471497/kemper-catches-more-legal-heat-over-data-hack","https://haveibeenpwned.com/Breach/Kemper"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","employment","transactions","phone","address"],"aftermath_tags":["extortion","publication"],"via":null,"country":"United States","scale":13000000,"related_attack_ids":[]},{"id":41,"slug":"2026-04-adt","when":"Apr 2026","sort_date":"2026-04","sector":"other","sector_label":"Other","who":"ADT, home security company","who_link":"ADT","what_left":"Names, phone numbers and addresses of customers and prospective customers; in a small percentage of cases dates of birth and the last four digits of Social Security or tax ID numbers, per ADT. About 5.5 million unique email addresses per Have I Been Pwned","how":"Unauthorised access to certain cloud-based environments, detected on 20 April 2026, per ADT. ShinyHunters said it socially engineered an employee's Okta account and took data from Salesforce","then":"ShinyHunters listed ADT for extortion and posted a file it says holds more than 10 million records. ADT notified those affected and offered identity protection. Proposed class action filed in Florida federal court in April 2026","source_url":"https://newsroom.adt.com/corporate-news/adt-detects-cybersecurity-incident","more_sources":["https://www.helpnetsecurity.com/2026/04/27/adt-systems-data-breach/","https://www.bankinfosecurity.com/home-security-firm-adt-breach-55m-customers-data-exposed-a-31511","https://news.bloomberglaw.com/ip-law/adt-sued-for-data-breach-affecting-more-than-5-million-customers"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","phone","address","dob","national_id","email"],"aftermath_tags":["extortion","publication"],"via":null,"country":null,"scale":5500000,"related_attack_ids":[]},{"id":66,"slug":"2026-04-kraken-support-insiders","when":"Feb 2025, disclosed Apr 2026","sort_date":"2026-04","sector":"crypto","sector_label":"Crypto","who":"Kraken","who_link":"Kraken","what_left":"About 2,000 accounts, 0.02% of users, per Kraken: client support data","how":"Two cases of improper access by support employees; one had been recruited by the criminal group, per Kraken","then":"Criminal group threatened to release videos of internal systems showing client data; Kraken said it would not pay; affected users notified","source_url":"https://www.bleepingcomputer.com/news/security/crypto-exchange-kraken-extorted-by-hackers-after-insider-breach/","more_sources":[],"leak_type":"insider","vector":"bribed_insider","verification":"confirmed","data_types":["messages"],"aftermath_tags":["extortion"],"via":null,"country":"United States","scale":2000,"related_attack_ids":[]},{"id":238,"slug":"2026-04-duc-app-duales","when":"Sep 2020 to Apr 2026","sort_date":"2026-04","sector":"bank","sector_label":"Finance","who":"Duales, Toronto fintech behind the money-transfer app Duc","who_link":"Duales","what_left":"Driver's licences, passports and selfies uploaded for identity checks, and spreadsheets of customer names, home addresses and transactions; the server listed over 360,000 files, and the number of people is not established","how":"Amazon-hosted storage server readable by anyone with its web address, without a password; files dated back to September 2020. Duales called it a staging site","then":"Closed after TechCrunch alerted the chief executive; Canada's privacy commissioner contacted the company. Duales would not say whether it has logs showing who accessed the files","source_url":"https://techcrunch.com/2026/04/02/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"confirmed","data_types":["id_document","selfie","name","address","transactions"],"aftermath_tags":[],"via":null,"country":"Canada","scale":null,"related_attack_ids":[]},{"id":36,"slug":"2026-03-ameriprise","when":"Mar 2026","sort_date":"2026-03","sector":"bank","sector_label":"Finance","who":"Ameriprise Financial","who_link":"Ameriprise Financial","what_left":"47,876 people, per the filing with the Maine attorney general; reported to include names, addresses, financial account details and in some cases Social Security numbers","how":"An unauthorised person gained access to stored data and files from 2 March 2026; Ameriprise blocked it on discovery on 18 March. Ameriprise did not say how","then":"ShinyHunters claimed Salesforce customer records and over 200 GB of SharePoint data and set a ransom deadline of 25 March. Notified from 17 April 2026 with 12 months of credit monitoring; lawsuits filed","source_url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621953","more_sources":["https://oag.ca.gov/system/files/Ameriprise%20-%20Individual%20Notification%20Letter%20-%20Sample.pdf","https://www.advisorhub.com/ameriprise-discloses-second-data-breach-in-less-than-six-months/","https://www.foxnews.com/tech/ameriprise-data-breach-hits-48000-customers","https://cybernews.com/security/shinyhunters-ameriprise-financial-data-breach/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","bank_account","national_id"],"aftermath_tags":["extortion"],"via":null,"country":"United States","scale":47876,"related_attack_ids":[]},{"id":51,"slug":"2026-03-odido-customer-service","when":"Feb 2026, published Mar 2026","sort_date":"2026-03","sector":"other","sector_label":"Other","who":"Odido, Dutch telecom, with its brand Ben","who_link":"Odido","what_left":"6.2 million accounts per Odido: full names, addresses, phone numbers, customer numbers, email addresses, bank account numbers, dates of birth, and passport or driving licence numbers with expiry dates. The published set held at least 6.5 million people and 600,000 companies, per a NOS analysis","how":"Attackers phoned customer service posing as the IT department, obtained staff logins, and exported records from the customer contact system","then":"ShinyHunters demanded about 1 million euros, then 500,000; Odido refused. Data published in stages from 26 February, the rest on 1 March, including more than 5 million identity document numbers and customer service notes. Security firm Hackify counted 61 phishing emails in 150 days to two addresses used only for Odido accounts. Dutch police said in July 2026 there were strong indications that Dutch hackers were involved","source_url":"https://nos.nl/artikel/2604461-odido-hackers-publiceren-resterende-klantdata-ook-miljoenen-id-nummers","more_sources":["https://nos.nl/artikel/2602080-hack-bij-odido-gegevens-miljoenen-klanten-in-handen-van-criminelen","https://nos.nl/artikel/2603784-cybercriminelen-dreigen-met-publiceren-gestolen-data-odido","https://nos.nl/artikel/2604072-odido-betaalt-geen-losgeld-criminelen-publiceren-deel-gestolen-klantgegevens","https://www.bright.nl/nieuws/2117556/piek-van-phishingmails-na-odido-datalek-lijkt-voorbij.html","https://www.bleepingcomputer.com/news/security/police-suspects-dutch-hackers-were-involved-in-odido-breach/"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","address","phone","account_id","email","bank_account","dob","national_id","messages"],"aftermath_tags":["extortion","publication","phishing"],"via":null,"country":"Netherlands","scale":6500000,"related_attack_ids":[]},{"id":67,"slug":"2026-03-intesa-sanpaolo-employee-lookups","when":"Feb 2022 to Apr 2024, fined Mar 2026","sort_date":"2026-03","sector":"bank","sector_label":"Finance","who":"Intesa Sanpaolo, Italy","who_link":"Intesa Sanpaolo","what_left":"Banking information of 3,573 customers, viewed in more than 6,600 lookups, per the Italian data protection authority; politicians and public figures among them","how":"One branch employee queried customer accounts without justification for more than two years; the bank's controls did not detect it","then":"Fine of 31.8 million euros; the bank's first notification in July 2024 named 9 customers; customers told only after an order from the authority on 2 November 2024","source_url":"https://www.milanofinanza.it/news/intesa-sanpaolo-multa-di-31-8-milioni-dal-garante-della-privacy-accesso-ingiustificato-ai-dati-di-3-573-202603301942443150","more_sources":["https://ppc.land/italys-garante-fines-intesa-sanpaolo-eu31-8m-one-employee-3-573-victims/","https://www.cybersecurity360.it/?p=101890"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["balance","transactions"],"aftermath_tags":[],"via":null,"country":"Italy","scale":3573,"related_attack_ids":[]},{"id":100,"slug":"2026-03-lotte-card","when":"2025, fined Mar 2026","sort_date":"2026-03","sector":"bank","sector_label":"Finance","who":"Lotte Card, card issuer, South Korea","who_link":"Lotte Card","what_left":"Personal credit information of about 2.97 million people, including the resident registration numbers of 450,000","how":"A hack of the online simple payment system exposed log files in which personal data had been recorded in plain text","then":"South Korea's privacy regulator fined Lotte Card 9.62 billion won in March 2026 and ordered corrections","source_url":"https://www.koreajoongangdaily.com/business/lotte-card-fined-96-billion-won-for-leaking-users-social-registration-numbers/12524086","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["national_id"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":2970000,"related_attack_ids":[]},{"id":9,"slug":"2026-02-sumsub","when":"Jul 2024, disclosed Feb 2026","sort_date":"2026-02","sector":"idv","sector_label":"Identity vendors","who":"Sumsub, identity vendor","who_link":"Sumsub","what_left":"Names; a smaller subset of records also held email addresses or phone numbers. Sumsub says biometric data, ID document images and bank or payment details were not accessed, and gives no count beyond \"a limited number of customer accounts\"","how":"An outsider submitted a malicious attachment through a third-party support ticketing platform in July 2024, per Sumsub","then":"Undetected for eighteen months: found during a security review in January 2026 and disclosed on 4 February 2026","source_url":"https://sumsub.com/newsroom/security-incident-update/","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","phone"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":34,"slug":"2026-02-figure","when":"Jan 2026, published Feb 2026","sort_date":"2026-02","sector":"bank","sector_label":"Finance","who":"Figure Technology Solutions, fintech lender","who_link":"Figure Technology Solutions","what_left":"Names, home addresses, dates of birth and phone numbers; 967,200 accounts per Have I Been Pwned. Figure said \"a limited number of files\" were taken","how":"An employee was tricked by a social engineering attack, which let the attackers in, per Figure","then":"ShinyHunters claimed the theft, said Figure refused to pay, and published about 2.5 GB of data from loan applicants. Credit monitoring offered","source_url":"https://www.bleepingcomputer.com/news/security/data-breach-at-fintech-firm-figure-affects-nearly-1-million-accounts/","more_sources":["https://techcrunch.com/2026/02/13/fintech-lending-giant-figure-confirms-data-breach","https://www.mass.gov/doc/2026-267-figure-technology-solutions-inc/download"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","email","address","dob","phone"],"aftermath_tags":["extortion","publication"],"via":null,"country":null,"scale":967200,"related_attack_ids":[]},{"id":35,"slug":"2026-02-mercer-advisors","when":"Jan 2026, published Feb 2026","sort_date":"2026-02","sector":"bank","sector_label":"Finance","who":"Mercer Advisors, wealth management firm","who_link":"Mercer Advisors","what_left":"Names, postal and email addresses, phone numbers, driving licence and passport or other government ID numbers, dates of birth and account numbers, varying by client per Mercer Advisors. ShinyHunters claimed about 5.7 million client records","how":"Unauthorised access to systems used to store client data, on or around 22 January 2026. Mercer Advisors did not say how","then":"Ransom demand; after Mercer Advisors refused, ShinyHunters published the data. Clients notified from 31 March 2026 with two years of credit monitoring; class action filed in Colorado","source_url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621099","more_sources":["https://oag.ca.gov/system/files/Mercer%20-%20Sample%20Individual%20Notice%20%2803%2031%2026%29%20%28CA%29.pdf","https://www.wealthmanagement.com/ria-news/in-class-action-mercer-client-faults-firms-data-protection-amid-shinyhunters-cyber-attack","https://www.financial-planning.com/news/cyberattack-on-client-data-lands-mercer-in-federal-lawsuit"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","email","phone","national_id","dob","account_id"],"aftermath_tags":["extortion","publication"],"via":null,"country":null,"scale":5700000,"related_attack_ids":[]},{"id":40,"slug":"2026-02-university-of-pennsylvania-donors","when":"Oct 2025, published Feb 2026","sort_date":"2026-02","sector":"other","sector_label":"Other","who":"University of Pennsylvania donor database","who_link":"University of Pennsylvania","what_left":"Claimed: about 1.2 million donor records with names, dates of birth, addresses, phone numbers, estimated net worth, donation history and demographic details, per the attackers. Penn says the 1.2 million figure overstates the impact","how":"An employee's single sign-on account was obtained through \"a sophisticated identity impersonation\", per Penn; the attackers then reached Salesforce, SharePoint and other systems","then":"Offensive emails sent to about 700,000 students and alumni from Penn systems; $1 million ransom demand refused; files released in November 2025 and February 2026","source_url":"https://www.bleepingcomputer.com/news/security/university-of-pennsylvania-confirms-data-stolen-in-cyberattack/","more_sources":["https://www.bleepingcomputer.com/news/security/university-of-pennsylvania-hacker-claims-1.2-million-donor-data-breach/","https://www.inquirer.com/education/penn-data-breach-hack-update-20251117.html","https://www.thedp.com/article/2026/02/penn-hack-donor-data-ransom-one-million-shinyhunters-gse-emai","https://www.thedp.com/article/2026/02/penn-hack-gse-internal-files-antisemitism-documents"],"leak_type":"theft","vector":"pretexting","verification":"claimed","data_types":["name","dob","address","phone","wealth","employment"],"aftermath_tags":["extortion","publication","impersonation"],"via":null,"country":null,"scale":1200000,"related_attack_ids":[]},{"id":103,"slug":"2026-02-ficoba","when":"Jan to Feb 2026","sort_date":"2026-02","sector":"gov","sector_label":"Government","who":"FICOBA, France's national register of bank accounts, run by the tax administration","who_link":"FICOBA","what_left":"About 1.2 million accounts consulted: bank details (RIB and IBAN), the account holder's identity and address","how":"An attacker used the stolen login of an official who had access through exchanges between ministries, from the end of January 2026","then":"Access restricted; CNIL notified and a criminal complaint filed; account holders told individually and banks asked to warn customers","source_url":"https://impots.gouv.fr/actualite/acces-illegitimes-au-fichier-national-des-comptes-bancaires-ficoba","more_sources":[],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["bank_account","name","address"],"aftermath_tags":[],"via":null,"country":"France","scale":1200000,"related_attack_ids":[]},{"id":248,"slug":"2026-02-advantest","when":"Feb 2026, notices Oct 2026","sort_date":"2026-02","sector":"other","sector_label":"Other","who":"Advantest Corporation, Japanese maker of chip test equipment, and its subsidiaries","who_link":"Advantest","what_left":"No count given. The notice template lists contact information, dates of birth, Social Security numbers, national ID numbers, driver's licence and passport numbers, medical and financial information, filled in per person","how":"An unauthorised third party accessed Advantest systems and extracted data from its servers; Advantest became aware in February 2026","then":"Notice letters dated 6 October 2026 filed with the California attorney general; 18 months of Kroll monitoring offered. Advantest says it has no information that the data was disclosed publicly or misused","source_url":"https://oag.ca.gov/system/files/Advantest%20Corporation%20-%20Notice%20of%20Data%20Breach%20-%20Individual%20Letter.pdf","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["dob","national_id","wealth"],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":10,"slug":"2026-01-ledger-global-e","when":"Jan 2026","sort_date":"2026-01","sector":"crypto","sector_label":"Crypto","who":"Ledger, via checkout vendor Global-e","who_link":"Ledger","what_left":"Names, contact details and order data of Ledger buyers. Neither company has said how many","how":"Unauthorised access to a Global-e cloud system holding shopper order data from several brands","then":"Disclosed on 5 January 2026; Ledger told buyers to expect phishing and never to disclose their 24 words. A phishing email addressed to \"Ledger User\" from \"Katie at E-Global\" was reported the next day, per The Register","source_url":"https://www.bleepingcomputer.com/news/security/ledger-customers-impacted-by-third-party-global-e-data-breach/","more_sources":["https://www.theregister.com/2026/01/06/ledger_globale_breach/"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","order_history"],"aftermath_tags":["phishing"],"via":"Global-e","country":"France","scale":null,"related_attack_ids":[]},{"id":33,"slug":"2026-01-betterment","when":"Jan 2026","sort_date":"2026-01","sector":"bank","sector_label":"Finance","who":"Betterment, investment platform","who_link":"Betterment","what_left":"Names, email and postal addresses, phone numbers and dates of birth of a subset of customers; about 1.4 million unique email addresses per Have I Been Pwned. Betterment says no customer accounts were accessed","how":"An outsider used \"identity impersonation and deception\" to gain access to third-party platforms Betterment uses for marketing and operations, per Betterment","then":"The attacker sent customers a crypto message impersonating Betterment, offering to triple crypto sent to attacker wallets; ShinyHunters claimed the theft. Customers notified","source_url":"https://www.betterment.com/customer-update","more_sources":["https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/","https://www.securityweek.com/robo-advisor-betterment-discloses-data-breach/","https://www.americanbanker.com/news/1-4-million-data-breach-betterment-shinyhunters-salesforce"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","email","address","phone","dob"],"aftermath_tags":["impersonation","phishing"],"via":null,"country":null,"scale":1400000,"related_attack_ids":[]},{"id":109,"slug":"2026-01-france-travail","when":"Early 2024, fined Jan 2026","sort_date":"2026-01","sector":"gov","sector_label":"Government","who":"France Travail, French public employment agency","who_link":"France Travail","what_left":"No count on the CNIL page: everyone registered with the agency, or registered in the past 20 years. Social security numbers, email and postal addresses, phone numbers","how":"In the first quarter of 2024 attackers used social engineering to take over accounts of Cap Emploi advisers, who had access to France Travail's information system","then":"The CNIL fined France Travail 5 million euros on 22 January 2026 for inadequate security","source_url":"https://cnil.fr/fr/violation-de-donnees-sanction-5millions-france-travail","more_sources":[],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["national_id","email","address","phone"],"aftermath_tags":[],"via":null,"country":"France","scale":null,"related_attack_ids":[]},{"id":52,"slug":"2025-12-pass-sport-ministry","when":"Dec 2025","sort_date":"2025-12","sector":"gov","sector_label":"Government","who":"French ministry of sports, Pass'Sport scheme for young people","who_link":"French ministry of sports","what_left":"3.5 million households per the ministry: identity, address, email and phone number; dates of birth in some records. 6.4 million accounts per Have I Been Pwned","how":"Data exfiltrated from one of the ministry's information systems, linked to the Pass'Sport scheme. Method not disclosed","then":"A 15 GB file was posted to a criminal forum in mid December, first attributed to the family benefits agency CAF, which denied it. Ministry filed a complaint and notified the CNIL","source_url":"https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/le-ministere-des-sports-victime-d-une-cyberattaque-3-5-millions-de-foyers-concernes_7690192.html","more_sources":["https://www.sports.gouv.fr/exfiltration-de-donnees-provenant-d-un-des-systemes-d-information-du-ministere-10048","https://cyberinsider.com/passsport-data-breach-exposed-6-4-million-account-holders-in-france/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","email","phone","dob"],"aftermath_tags":["publication"],"via":null,"country":"France","scale":6400000,"related_attack_ids":[]},{"id":61,"slug":"2025-12-charter-emergency-request","when":"Sep 2025, reported Dec 2025","sort_date":"2025-12","sector":"other","sector_label":"Other","who":"Charter Communications, United States","who_link":"Charter Communications","what_left":"One customer's name, home address, phone numbers and email address","how":"Emergency data request emailed in the name of a sheriff's office officer and answered within minutes; the sender says he used a lookalike domain and a spoofed phone number","then":"Charter declined to comment. The sender belongs to a group selling doxing as a service and says it has made up to 500 successful requests to US companies","source_url":"https://www.wired.com/story/doxers-posing-as-cops-are-tricking-big-tech-firms-into-sharing-peoples-private-data/","more_sources":[],"leak_type":"handover","vector":"fake_legal_request","verification":"reported","data_types":["name","address","phone","email"],"aftermath_tags":[],"via":null,"country":"United States","scale":1,"related_attack_ids":[]},{"id":247,"slug":"2025-12-his-thailand-passports","when":"Dec 2025, disclosed Oct 2026","sort_date":"2025-12","sector":"other","sector_label":"Other","who":"H.I.S., Japanese travel agency, file server of its Thai subsidiary H.I.S. Tours","who_link":"H.I.S.","what_left":"Up to 627 people, per H.I.S.: passport data (name in the Latin alphabet, sex, date of birth, passport number, expiry date); some allergy information","how":"Unauthorised access to the Thai subsidiary's file server, detected on 11 December 2025; not disclosed how","then":"Reported to the Personal Information Protection Commission and JIPDEC; disclosed on 7 October 2026, about ten months after detection; customers contacted individually","source_url":"https://atmarkit.itmedia.co.jp/ait/articles/2610/10/news006.html","more_sources":["https://www.travelvoice.jp/20261007-160643"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","national_id"],"aftermath_tags":[],"via":null,"country":"Japan","scale":627,"related_attack_ids":[]},{"id":11,"slug":"2025-11-idmerit","when":"Nov 2025","sort_date":"2025-11","sector":"idv","sector_label":"Identity vendors","who":"IDmerit, identity vendor","who_link":"IDmerit","what_left":"About 1 billion records from 26 countries, more than 203 million of them from the United States: names, home addresses, dates of birth, national ID numbers, phone numbers, email addresses","how":"Password-free database found open on the internet by Cybernews on 11 November 2025; reportedly secured the following day","then":"IDmerit says it does not \"own, control or store customer data or the underlying data maintained by independent data sources\" and that its systems have never been compromised. No public evidence that criminals downloaded the data, per Fox News","source_url":"https://www.foxnews.com/tech/1-billion-identity-records-exposed-id-verification-data-leak","more_sources":["https://cybernews.com/security/global-data-leak-exposes-billion-records/"],"leak_type":"exposure","vector":"open_storage","verification":"disputed","data_types":["name","address","dob","national_id","phone","email"],"aftermath_tags":[],"via":null,"country":null,"scale":1000000000,"related_attack_ids":[]},{"id":12,"slug":"2025-11-veriff","when":"Nov 2025","sort_date":"2025-11","sector":"idv","sector_label":"Identity vendors","who":"Veriff, identity vendor, holding files for Total Wireless","who_link":"Veriff","what_left":"8,583 Total Wireless customers: government ID images; for some, postal addresses and dates of birth","how":"Per Veriff, a customer's employee entered credentials on a phishing site; an unauthorised party then took the files from Veriff's systems, per Total Wireless","then":"Veriff told Total Wireless on 10 December 2025; Total Wireless notified customers on 9 January 2026 with one year of credit monitoring and told law enforcement","source_url":"https://cyberinsider.com/verizon-owned-brand-total-wireless-suffers-breach-exposing-customer-data/","more_sources":["https://www.emeryreddy.com/wp-content/uploads/2026/01/Total_Wireless.pdf"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["id_document","address","dob"],"aftermath_tags":[],"via":null,"country":null,"scale":8583,"related_attack_ids":[]},{"id":13,"slug":"2025-11-coupang","when":"Jun 2025, disclosed Nov 2025","sort_date":"2025-11","sector":"other","sector_label":"Other","who":"Coupang, South Korea's largest retailer","who_link":"Coupang","what_left":"33.7 million customers: names, phone numbers, emails, home addresses, order histories. The data protection authority later counted about 37.5 million people, 33.2 million members and 4.3 million others","how":"Reported: a former employee using access tokens that were never revoked; undetected for five months","then":"Largest breach in South Korea's history; vouchers offered to every affected account. The Personal Information Protection Commission fined Coupang 624.7 billion won in June 2026, 423.6 billion of it for the breach, and said the cause was Coupang's inadequate safety management, not sophisticated hacking. Coupang said it would clarify the facts through legal procedures","source_url":"https://www.bleepingcomputer.com/news/security/retail-giant-coupang-suffers-data-breach-impacting-337-million-people/","more_sources":["https://www.upi.com/Top_News/World-News/2026/06/11/Coupang-fined-record-6247-billion-won-over-massive-data-breach-unauthorized-data-collection/6531781169687/","https://www.teiss.co.uk/news/south-korea-slaps-coupang-with-a-record-6247-billion-data-breach-penalty-17667"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["name","phone","email","address","order_history"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":37500000,"related_attack_ids":[]},{"id":118,"slug":"2025-11-tisza-vilag-app","when":"Oct to Nov 2025","sort_date":"2025-11","sector":"other","sector_label":"Other","who":"Tisza Világ, app of the Hungarian opposition party Tisza","who_link":"Tisza Világ","what_left":"A database of about 200,000 rows on users of the party's app: names, phone numbers, email addresses and home addresses. Tisza says \"the database isn't ours\" and that it holds manipulated elements","how":"Not disclosed. Published online by unknown perpetrators; the data protection authority NAIH opened an investigation in early November 2025","then":"A searchable [interactive map](https://telex.hu/belfold/2025/11/07/naih-tisza-vilag-alkalmazas-jogsertes-terkep) of the people in the file followed. Pro-government outlets linked to it or listed names, and a governing-party spokesperson appeared in a video outside the home of a person on the list. NAIH said the map's creator appears to have committed a crime and in May 2026 fined publisher Mediaworks 50 million forints for linking to it","source_url":"https://telex.hu/english/2025/12/16/data-protection-authority-visits-tisza-party-headquarters","more_sources":["https://telex.hu/belfold/2025/11/07/naih-tisza-vilag-alkalmazas-jogsertes-terkep","https://telex.hu/belfold/2026/05/26/naih-birsag-50-millio-forint-mediaworks-tisza-vilag-applikacio-adatok","https://dailynewshungary.com/tisza-supporters-mapped-online-fidesz"],"leak_type":"unknown","vector":"undisclosed","verification":"disputed","data_types":["name","phone","email","address","location"],"aftermath_tags":["publication"],"via":null,"country":"Hungary","scale":200000,"related_attack_ids":[]},{"id":14,"slug":"2025-10-discord-5ca","when":"Oct 2025","sort_date":"2025-10","sector":"other","sector_label":"Other","who":"Discord, via support vendor 5CA","who_link":"Discord","what_left":"About 70,000 users' government ID photos, per Discord; for a wider set of users who had contacted support, names, usernames, emails, IP addresses, limited billing information and messages with support agents","how":"Discord says a support agent at its vendor was socially engineered; 5CA says its systems were not involved","then":"Ransom demanded from Discord. People claiming involvement posted samples, including photos of people holding ID cards, in a Telegram channel, per NBC News, which had not verified them","source_url":"https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service","more_sources":["https://www.nbcnews.com/tech/tech-news/70000-government-id-photos-exposed-discord-user-hack-rcna236714","https://www.cyberdaily.au/security/12777-third-party-named-by-discord-over-id-breach-denies-its-systems-were-hacked"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["id_document","name","email","ip_address","messages"],"aftermath_tags":["publication","extortion"],"via":"5CA","country":null,"scale":70000,"related_attack_ids":[]},{"id":15,"slug":"2025-10-qantas","when":"Jun to Oct 2025","sort_date":"2025-10","sector":"other","sector_label":"Other","who":"Qantas","who_link":"Qantas","what_left":"5.7 million customers: names, emails, frequent-flyer numbers; for many, phone numbers, postal addresses and dates of birth. The privacy regulator counted about 5.67 million customer records, about 5.12 million of them Australians","how":"Voice phishing of a Manila call-centre operator with access to the airline's customer platform; the caller posed as Qantas IT support, per the regulator","then":"Published in October 2025 after a ransom was refused. The Australian privacy regulator closed its preliminary inquiries in July 2026 without a formal investigation or penalty","source_url":"https://www.abc.net.au/news/2025-10-13/frustration-mounts-among-qantas-customers-over-data-breach/105885312","more_sources":["https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas","https://ia.acs.org.au/article/2026/qantas-goes-unpunished-for-staggering-data-breach.html"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","email","account_id","phone","address","dob"],"aftermath_tags":["publication","extortion"],"via":null,"country":"Australia","scale":5700000,"related_attack_ids":[]},{"id":249,"slug":"2025-10-ncx-exchange-open-database","when":"Oct 2025","sort_date":"2025-10","sector":"crypto","sector_label":"Crypto","who":"NCX, crypto trading platform","who_link":"NCX","what_left":"More than five million records in eight collections, about 1 GB: names, usernames, dates of birth, email addresses, KYC documents, 2FA codes and recovery URLs, API and secret keys, wallet addresses, transaction histories, hashed passwords, IP addresses","how":"Unsecured MongoDB database accessible without authentication, found by independent researchers; it stayed open for months","then":"Researchers notified NCX; no response or fix reported despite repeated outreach","source_url":"https://dailysecurityreview.com/cyber-security/ncx-exchange-data-leak-exposes-user-wallets-passwords-and-authentication-keys/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","dob","email","id_document","credentials","wallet","transactions","ip_address","account_id"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":132,"slug":"2025-09-kering-gucci-balenciaga","when":"Jun 2025, disclosed Sep 2025","sort_date":"2025-09","sector":"luxury","sector_label":"Luxury","who":"Kering, owner of Gucci, Balenciaga and Alexander McQueen","who_link":"Kering","what_left":"Customer data from the three brands. ShinyHunters claimed records tied to 7.4 million unique email addresses, reportedly with how much each customer had spent; Kering said limited customer data and no financial information","how":"An unauthorised third party gained temporary access to Kering's system in June 2025, per Kering; ShinyHunters said it got in through Kering in April","then":"ShinyHunters said it contacted Kering in June to negotiate a ransom; Kering denied any conversation with the attackers","source_url":"https://www.infosecurity-magazine.com/news/gucci-mcqueen-customer-breach/","more_sources":["https://www.bbc.co.uk/news/articles/crl5j8ld615o"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["email","order_history"],"aftermath_tags":["extortion"],"via":null,"country":null,"scale":7400000,"related_attack_ids":[]},{"id":133,"slug":"2025-09-harrods-supplier","when":"Sep 2025","sort_date":"2025-09","sector":"luxury","sector_label":"Luxury","who":"Harrods, via an unnamed supplier","who_link":"Harrods","what_left":"430,000 e-commerce customer records: names and contact details, some with internal marketing labels such as loyalty tier or a Harrods co-branded card","how":"Breach at a third-party provider, which Harrods did not name","then":"The attacker contacted Harrods, which said it would not engage; affected customers and the authorities were informed","source_url":"https://www.bleepingcomputer.com/news/security/harrods-suffers-new-data-breach-exposing-430-000-customer-records/","more_sources":["https://www.theregister.com/2025/09/29/harrods_blames_thirdparty_supplier_after"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","account_id"],"aftermath_tags":[],"via":null,"country":null,"scale":430000,"related_attack_ids":[]},{"id":53,"slug":"2025-08-miljodata","when":"Aug 2025","sort_date":"2025-08","sector":"other","sector_label":"Other","who":"Miljödata, IT supplier to most Swedish municipalities","who_link":"Miljödata","what_left":"2.2 million people per the company: personal identity numbers, contact details, and records of sick leave, rehabilitation and incidents involving school pupils. Have I Been Pwned counted 870,000 email addresses with names, addresses, phones and dates of birth","how":"Unauthorised access to the company's systems. Method not disclosed","then":"Ransom of 1.5 bitcoin demanded; the Datacarry group published the data on 13 September. Swedish data protection authority fined Miljödata SEK 1.8 million in 2026","source_url":"https://www.imy.se/en/news/administrative-fine-against-miljodata","more_sources":["https://www.bleepingcomputer.com/news/security/data-breach-at-major-swedish-software-supplier-impacts-15-million/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["national_id","name","address","phone","email","dob","employment"],"aftermath_tags":["extortion","publication"],"via":null,"country":"Sweden","scale":2200000,"related_attack_ids":[]},{"id":55,"slug":"2025-08-bouygues-telecom","when":"Aug 2025","sort_date":"2025-08","sector":"other","sector_label":"Other","who":"Bouygues Telecom, France","who_link":"Bouygues Telecom","what_left":"6.4 million customer accounts: contact details, contract data, civil status (company data for business customers) and IBANs. No card numbers or passwords, per Bouygues","how":"Unauthorised access detected on 4 August; Bouygues attributed it to a known criminal group that targeted specific internal resources. Method not disclosed","then":"Customers notified by email or SMS; complaint filed and the CNIL notified. Bouygues warned customers not to give credentials to callers","source_url":"https://www.corporate.bouyguestelecom.fr/archives-communique-presse/bouygues-telecom-annonce-avoir-ete-victime-dune-cyberattaque/","more_sources":["https://www.bleepingcomputer.com/news/security/bouygues-telecom-confirms-data-breach-impacting-64-million-customers/","https://techcrunch.com/2025/08/07/data-breach-at-french-telecom-giant-bouygues-affects-millions-of-customers/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","bank_account"],"aftermath_tags":[],"via":null,"country":"France","scale":6400000,"related_attack_ids":[]},{"id":85,"slug":"2025-07-bitcoin-depot","when":"2024, disclosed Jul 2025","sort_date":"2025-07","sector":"crypto","sector_label":"Crypto","who":"Bitcoin Depot, Bitcoin ATM operator","who_link":"Bitcoin Depot","what_left":"26,732 people, per regulatory filings: names, phone numbers, addresses, emails and driver's licence numbers","how":"Stolen in a cyberattack about a year before disclosure; Bitcoin Depot did not say how. Its investigation ended on 18 July 2024","then":"Customers were told a year later, after a federal law enforcement agency finished its inquiry; no identity theft protection was offered","source_url":"https://therecord.media/bitcoin-depot-cryptocurrency-atm-company-data-breach","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","phone","address","email","national_id"],"aftermath_tags":[],"via":null,"country":null,"scale":26732,"related_attack_ids":[]},{"id":134,"slug":"2025-07-louis-vuitton","when":"Jun 2025, discovered Jul 2025","sort_date":"2025-07","sector":"luxury","sector_label":"Luxury","who":"Louis Vuitton, via a third-party service provider","who_link":"Louis Vuitton","what_left":"142,995 customers in Turkey, per the notice there; customers in South Korea and the United Kingdom, no count given. Names, contact information and other data provided by customers; [the UK notice](https://www.infosecurity-magazine.com/news/louis-vuitton-uk-retailer-data/) lists postal address, date of birth, purchases and preferences as possibly included","how":"The service account of a third-party service provider was breached on 7 June 2025; discovered on 2 July","then":"Customers told to distrust unexpected contact; Louis Vuitton said it had no evidence of misuse and notified the UK regulator","source_url":"https://therecord.media/louis-vuitton-says-customers-impacted-by-data-breaches","more_sources":["https://www.infosecurity-magazine.com/news/louis-vuitton-uk-retailer-data/"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","phone","address","dob","order_history","location"],"aftermath_tags":[],"via":null,"country":null,"scale":142995,"related_attack_ids":[]},{"id":231,"slug":"2025-07-copenhagen-municipality-cpr-lookups","when":"Charged Jul 2025","sort_date":"2025-07","sector":"gov","sector_label":"Government","who":"Copenhagen Municipality, culture and leisure administration, Denmark","who_link":"Copenhagen Municipality","what_left":"Addresses and other personal details from the CPR register; about 1,700 lookups, of which about 200 were work-related","how":"Charged: a former student assistant used his register access and sold addresses and other personal details to criminals, per the police charge","then":"Charged with misusing the register and with complicity; the national special crime unit NSK says the lookups enabled one attempted murder and 66 cases of extortion. The municipality says such access cannot be controlled","source_url":"https://ing.dk/artikel/cpr-sag-kun-200-ud-af-1700-opslag-var-ikke-mistaenkelige","more_sources":[],"leak_type":"insider","vector":"bribed_insider","verification":"reported","data_types":["address"],"aftermath_tags":["extortion","physical_attack"],"via":null,"country":"Denmark","scale":1700,"related_attack_ids":[]},{"id":16,"slug":"2025-06-bobigny-tax-office","when":"Jun 2025","sort_date":"2025-06","sector":"gov","sector_label":"Government","who":"Bobigny tax office, France","who_link":"Bobigny tax office","what_left":"Home addresses and financial details of cryptocurrency investors, a billionaire, prison officers and a judge, per the investigation","how":"An employee searching the tax database for crypto holders and other targets","then":"Reportedly sold to criminal contacts, who used one file for a home attack; the employee has been held since 30 June 2025","source_url":"https://protos.com/no-release-for-french-tax-agent-who-gave-crypto-investor-details-to-gangs/","more_sources":[],"leak_type":"insider","vector":"rogue_insider","verification":"reported","data_types":["address","wealth"],"aftermath_tags":["sale","physical_attack"],"via":null,"country":"France","scale":null,"related_attack_ids":[]},{"id":137,"slug":"2025-06-cartier","when":"Jun 2025","sort_date":"2025-06","sector":"luxury","sector_label":"Luxury","who":"Cartier","who_link":"Cartier","what_left":"Names, email addresses and countries of clients; no count given","how":"An unauthorised party gained temporary access to Cartier's system and obtained limited client information, per its notice. Method not disclosed","then":"Clients notified; Cartier said no passwords, card details or banking information were affected","source_url":"https://securityaffairs.com/178601/data-breach/cartier-disclosed-a-data-breach-following-a-cyber-attack.html","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","location"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":17,"slug":"2025-05-coinbase","when":"Dec 2024 to May 2025","sort_date":"2025-05","sector":"crypto","sector_label":"Crypto","who":"Coinbase, via support vendor TaskUs","who_link":"Coinbase","what_left":"69,461 customers: names, addresses, ID images, partial social security numbers, balance snapshots","how":"Overseas support contractors bribed, reportedly for about $200 a record","then":"$20 million extortion demand; customers impersonated; cost estimated at up to $400 million. A former support agent was arrested in Hyderabad, India, in December 2025; a class action filed in New York in September 2025 names the vendor TaskUs","source_url":"https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists","more_sources":["https://www.bleepingcomputer.com/news/security/former-coinbase-support-agent-arrested-for-helping-hackers/","https://www.theblock.co/post/383790/coinbase-ceo-announces-first-arrest-in-india-over-insider-data-breach-more-still-to-come","https://www.infosecurity-magazine.com/news/taskus-employee-coinbase-breach/"],"leak_type":"insider","vector":"bribed_insider","verification":"confirmed","data_types":["name","address","id_document","national_id","balance"],"aftermath_tags":["extortion","impersonation"],"via":"TaskUs","country":"United States","scale":69461,"related_attack_ids":[]},{"id":108,"slug":"2025-05-uk-legal-aid-agency","when":"Apr to May 2025","sort_date":"2025-05","sector":"gov","sector_label":"Government","who":"Legal Aid Agency, United Kingdom","who_link":"Legal Aid Agency, United Kingdom","what_left":"No count given: \"a significant amount of personal data\" of people who applied for legal aid from 2007 to 16 May 2025. Contact details and addresses, dates of birth, national ID numbers, criminal history, employment status, and financial data such as contribution amounts, debts and payments","how":"A group accessed and downloaded the data from the agency's digital service; the agency learned of the attack on 23 April 2025 and of its extent on 16 May","then":"Online services taken offline; a court injunction prohibits sharing the data","source_url":"https://www.gov.uk/government/news/legal-aid-agency-data-breach","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["address","dob","national_id","employment","wealth","family"],"aftermath_tags":[],"via":null,"country":"United Kingdom","scale":null,"related_attack_ids":[]},{"id":135,"slug":"2025-05-dior","when":"Jan 2025, discovered May 2025","sort_date":"2025-05","sector":"luxury","sector_label":"Luxury","who":"Dior","who_link":"Dior","what_left":"Client names, contact details, addresses and dates of birth; in some cases passport or government ID numbers and Social Security numbers, per the US notice. In South Korea names, phone numbers, email addresses and [purchase records](https://www.koreajoongangdaily.com/korea/tiffany-dior-suffer-data-breaches-and-report-them-weeks-later/12197047). No count given","how":"An unauthorised party gained access to a Dior client database on 26 January 2025; Dior became aware on 7 May. Method not disclosed","then":"Korean regulator told on 10 May and a website notice posted on 13 May; US customers notified in July 2025","source_url":"https://www.bleepingcomputer.com/news/security/dior-begins-sending-data-breach-notifications-to-us-customers/","more_sources":["https://www.koreajoongangdaily.com/korea/tiffany-dior-suffer-data-breaches-and-report-them-weeks-later/12197047","https://www.govinfosecurity.com/tiffany-dior-suffer-south-korean-customer-data-breaches-a-28548"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","dob","national_id","phone","email","order_history"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":136,"slug":"2025-05-tiffany-korea","when":"Apr 2025, discovered May 2025","sort_date":"2025-05","sector":"luxury","sector_label":"Luxury","who":"Tiffany & Co. Korea, via a third-party application","who_link":"Tiffany & Co. Korea","what_left":"Names, addresses, phone numbers, email addresses and sales data of customers in South Korea; no count given","how":"Suspicious activity on a third-party application managing global customer data, per Tiffany Korea; the breach occurred on 8 April 2025 and was found on 9 May","then":"Affected customers told by email only; made public on 26 May 2025","source_url":"https://www.koreajoongangdaily.com/korea/tiffany-dior-suffer-data-breaches-and-report-them-weeks-later/12197047","more_sources":["https://www.govinfosecurity.com/tiffany-dior-suffer-south-korean-customer-data-breaches-a-28548"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","address","phone","email","order_history"],"aftermath_tags":[],"via":null,"country":"South Korea","scale":null,"related_attack_ids":[]},{"id":18,"slug":"2025-04-crypto-compilation-18m","when":"Apr 2025","sort_date":"2025-04","sector":"crypto","sector_label":"Crypto","who":"One file advertised as containing customers of 20 platforms, including Crypto.com, Gemini, Binance US, Coinbase and Ledger","who_link":"One file","what_left":"18 million records: name, email, phone, address, per the seller's listing","how":"Compiled from earlier breaches, per the listing; none of the named platforms confirmed a new breach","then":"Offered as one file for $10,000","source_url":"https://beincrypto.com/cryptocurrency-user-data-sale-dark-web/","more_sources":[],"leak_type":"compilation","vector":"compilation","verification":"claimed","data_types":["name","email","phone","address"],"aftermath_tags":["sale"],"via":null,"country":null,"scale":18000000,"related_attack_ids":[]},{"id":19,"slug":"2025-03-have-i-been-drained","when":"Mar 2025","sort_date":"2025-03","sector":"crypto","sector_label":"Crypto","who":"One file named \"Have I Been Drained\", reported as compiled from eight earlier crypto breaches, including Nexo, Binance US, CoinMarketCap and Gemini","who_link":"One file","what_left":"About 13.5 million rows, mostly email addresses and phone numbers; a few thousand carry a home address, wallet address or account balance, per DataBreach.com's index","how":"Reportedly compiled from earlier breaches and posted on a hacking forum on 10 March 2025; none of the named platforms confirmed it","then":"No passwords in the file. DataBreach.com describes its use as a contact list of likely cryptocurrency holders","source_url":"https://cyberpress.org/knox-cryptocurrency-data-breach/","more_sources":["https://databreach.com/breach/have-i-been-drained-2025","https://heroic.com/darkhive-breaches/crypto-phishing-easier-have-i-been-drained-hit-10-7m/"],"leak_type":"compilation","vector":"compilation","verification":"reported","data_types":["email","phone","address","wallet","balance"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":13500000,"related_attack_ids":[]},{"id":54,"slug":"2025-03-turknet","when":"Feb to Mar 2025","sort_date":"2025-03","sector":"other","sector_label":"Other","who":"TurkNet, internet provider, Turkey","who_link":"TurkNet","what_left":"244,396 subscribers per the data protection authority; first reports said about 1.5 million customers. Names, phone numbers, subscription numbers, national ID numbers, addresses and static IP addresses","how":"SQL injection attack on one of the company's services, running from 26 February until it was found on 11 March through a complaint to the telecoms regulator","then":"Reportedly a ransom of 3 bitcoin demanded. TurkNet and the data protection authority notified the public","source_url":"https://www.hurriyetdailynews.com/customer-data-stolen-in-cyberattack-against-turkish-internet-provider-206891","more_sources":["https://www.memurlar.net/haber/1130673/kvkk-turknet-veri-ihlalini-resmi-olarak-duyurdu.html","https://www.log.com.tr/kvkk-buyuk-turknet-veri-sizintisi-hakkinda-resmi-aciklama-yapti/"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","phone","account_id","national_id","address","ip_address"],"aftermath_tags":["extortion"],"via":null,"country":"Turkey","scale":1500000,"related_attack_ids":[]},{"id":45,"slug":"2025-01-zacks","when":"Jun 2024, leaked Jan 2025","sort_date":"2025-01","sector":"bank","sector_label":"Finance","who":"Zacks Investment Research","who_link":"Zacks Investment Research","what_left":"12 million email addresses with full names, usernames, physical addresses, phone numbers, IP addresses and unsalted SHA-256 password hashes","how":"The seller claimed domain administrator access to the company's Active Directory in June 2024; Zacks did not respond","then":"Samples published on a criminal forum in late January 2025 in exchange for cryptocurrency; most email addresses were already in earlier breaches","source_url":"https://www.bleepingcomputer.com/news/security/hacker-leaks-account-data-of-12-million-zacks-investment-users/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"reported","data_types":["name","email","address","phone","ip_address","credentials"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":12000000,"related_attack_ids":[]},{"id":20,"slug":"2024-11-byte-federal","when":"Nov 2024","sort_date":"2024-11","sector":"crypto","sector_label":"Crypto","who":"Byte Federal, Bitcoin ATM operator","who_link":"Byte Federal","what_left":"58,000 customers: names, dates of birth, addresses, phone numbers, emails, social security numbers, government IDs, user photographs, transaction activity","how":"A vulnerability in GitLab, a developer platform, opened one of its servers; discovered on 18 November 2024","then":"Platform shut down and every customer account reset; Byte Federal said it had no evidence the data was misused. Two proposed class actions filed in Florida federal court in December 2024","source_url":"https://www.bleepingcomputer.com/news/security/bitcoin-atm-firm-byte-federal-hacked-via-gitlab-flaw-58k-users-exposed/","more_sources":["https://www.securityweek.com/hackers-possibly-stole-personal-data-from-bitcoin-atm-operator-byte-federal/","https://news.bloomberglaw.com/litigation/bitcoin-atm-operator-hit-with-class-actions-over-data-breach"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","dob","address","phone","email","national_id","id_document","selfie","transactions"],"aftermath_tags":[],"via":null,"country":null,"scale":58000,"related_attack_ids":[]},{"id":21,"slug":"2024-11-bitnob","when":"Sep 2024, reported Nov 2024","sort_date":"2024-11","sector":"crypto","sector_label":"Crypto","who":"Bitnob, Bitcoin payments app, Nigeria","who_link":"Bitnob","what_left":"More than 250,000 files of verification documents: photos of passports, national IDs and driving licences, with names, dates of birth and ID numbers","how":"Cloud storage bucket left publicly readable, found by Cybernews researchers on 11 September 2024","then":"Closed after the researchers contacted the company several times; Bitnob gave no comment, and who else read the bucket is unknown","source_url":"https://cybernews.com/security/bitnob-data-leak/","more_sources":["https://crypto.news/bitnob-crypto-exchange-data-breach-250k-kyc-documents-at-risk/"],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["id_document","name","dob","national_id"],"aftermath_tags":[],"via":null,"country":"Nigeria","scale":250000,"related_attack_ids":[]},{"id":22,"slug":"2024-10-transak","when":"Oct 2024","sort_date":"2024-10","sector":"crypto","sector_label":"Crypto","who":"Transak, crypto payments provider, via its identity vendor","who_link":"Transak","what_left":"92,554 users: names, dates of birth, passports and other ID documents, verification selfies","how":"Phishing of an employee's laptop; the stolen credentials opened the system of the third-party vendor that runs Transak's identity checks","then":"Regulators in the UK, the EU and the US notified; Transak said it saw no sign of misuse. The Stormous ransomware group claimed the theft, said it held 300 GB, and posted some of the records on its site, per The Block","source_url":"https://www.infosecurity-magazine.com/news/phishing-attack-impacts-over-92000/","more_sources":["https://www.theblock.co/post/322263/transak-discloses-data-breach-affecting-over-57000-users-stormous-ransomware-gang-claims-responsibility"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","dob","id_document","selfie"],"aftermath_tags":["publication"],"via":null,"country":"United States","scale":92554,"related_attack_ids":[]},{"id":42,"slug":"2024-10-free","when":"Sep to Oct 2024","sort_date":"2024-10","sector":"other","sector_label":"Other","who":"Free and Free Mobile, internet and mobile provider, France","who_link":"Free and Free Mobile","what_left":"24 million subscriber contracts, per the CNIL: names, email and postal addresses, phone numbers, subscriber IDs, contract data; dates and places of birth; IBANs of customers with both services. The seller claimed 5.11 million IBANs","how":"Attacker entered through the company VPN, whose authentication the CNIL found too weak, and searched the subscriber management tool between 28 September and 22 October 2024","then":"Auctioned on a criminal forum; customers notified; criminal complaint filed. The CNIL fined Free Mobile 27 million euros and Free 15 million euros in January 2026","source_url":"https://www.cnil.fr/fr/sanction-free-2026","more_sources":["https://www.bleepingcomputer.com/news/security/free-frances-second-largest-isp-confirms-data-breach-after-leak/","https://www.theregister.com/2026/01/14/france_fines_free_free_mobile/","https://www.macg.co/services/2024/10/free-confirme-un-vol-de-donnees-de-ses-clients-146785"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","address","phone","account_id","dob","bank_account"],"aftermath_tags":["sale"],"via":null,"country":"France","scale":24000000,"related_attack_ids":[]},{"id":92,"slug":"2024-09-moneygram","when":"Sep 2024","sort_date":"2024-09","sector":"bank","sector_label":"Finance","who":"MoneyGram, money transfer firm","who_link":"MoneyGram","what_left":"No count given. Names, phone numbers, email and postal addresses, dates of birth, copies of government-issued identity documents such as driver's licences, utility bills, bank account numbers, transaction dates and amounts, a limited number of Social Security numbers","how":"An unauthorised third party accessed and acquired the data between 20 and 22 September 2024; MoneyGram did not say how","then":"Systems taken offline, interrupting service; consumers notified on 7 October 2024","source_url":"https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/11/MoneyGram-Enclosures-2-10-07-24.pdf","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","phone","email","address","dob","id_document","national_id","bank_account","account_id","transactions"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":112,"slug":"2024-08-national-public-data","when":"Dec 2023, disclosed Aug 2024","sort_date":"2024-08","sector":"other","sector_label":"Other","who":"National Public Data, owned by Jerico Pictures","who_link":"National Public Data","what_left":"2.9 billion records, per the hacker's listing; 1.3 million people, per the company's filing with Maine regulators. Names, Social Security numbers, phone numbers, addresses and dates of birth","how":"Breach in late December 2023, per the company; the source read does not give the method","then":"Posted on a criminal marketplace on 7 April 2024 and sold again through the summer. The parent company filed for bankruptcy on 2 October 2024","source_url":"https://therecord.media/national-public-data-bankruptcy-cyberattack","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","phone","address","dob"],"aftermath_tags":["sale"],"via":null,"country":"United States","scale":2900000000,"related_attack_ids":[]},{"id":82,"slug":"2024-07-fractal-id","when":"Jul 2024","sort_date":"2024-07","sector":"idv","sector_label":"Identity vendors","who":"Fractal ID, identity vendor for crypto projects","who_link":"Fractal ID","what_left":"About 0.5% of roughly 1 million users, per the co-founder; a later report puts it at 6,300. Names, residence, email addresses, passports and licences, liveness selfie scans","how":"A single operator account was breached on 14 July 2024; the company suspected a password taken in other hacks","then":"Gnosis Pay named among the affected clients. In October 2024 the Stormous ransomware group claimed KYC data of more than 300,000 users; Fractal ID had said its logs showed no further extraction","source_url":"https://www.theblock.co/post/305873/gnosis-pay-and-other-crypto-projects-impacted-in-fractal-id-data-breach","more_sources":["https://www.cyberdaily.au/security/11251-exclusive-stormous-ransomware-claims-hack-of-blockchain-identity-firm-fractal-id"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","location","email","id_document","selfie"],"aftermath_tags":[],"via":null,"country":null,"scale":6300,"related_attack_ids":[]},{"id":90,"slug":"2024-07-evolve-bank","when":"Feb to May 2024, disclosed Jul 2024","sort_date":"2024-07","sector":"bank","sector_label":"Finance","who":"Evolve Bank & Trust, partner bank to fintech firms","who_link":"Evolve Bank & Trust","what_left":"7,640,112 people, per the filing with the Maine attorney general: names, Social Security numbers, bank account numbers and contact information, including customers of its fintech partners","how":"LockBit ransomware attack found on 29 May 2024; the attackers had been in the network since at least February. Entry point not given in the sources read","then":"No ransom was paid and the stolen data was leaked online. Affirm and Wise said in filings that their customers' data was affected","source_url":"https://www.securityweek.com/evolve-bank-data-breach-impacts-7-6-million-people/","more_sources":["https://www.theregister.com/2024/07/09/evolve_lockbit_attack"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","bank_account","email","phone"],"aftermath_tags":["publication","extortion"],"via":null,"country":"United States","scale":7640112,"related_attack_ids":[]},{"id":23,"slug":"2024-06-gemini","when":"Jun 2024","sort_date":"2024-06","sector":"crypto","sector_label":"Crypto","who":"Gemini","who_link":"Gemini","what_left":"About 15,000 customers: names, bank account and routing numbers, per Gemini's notice","how":"Third-party banking vendor breached between 3 and 7 June 2024","then":"Customers notified; Gemini said it found no evidence of misuse","source_url":"https://www.bleepingcomputer.com/news/security/crypto-exchange-gemini-discloses-third-party-data-breach/","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","bank_account","phone","location"],"aftermath_tags":["sale"],"via":null,"country":null,"scale":15000,"related_attack_ids":[]},{"id":68,"slug":"2024-06-bangladesh-ntmc-police-sales","when":"Reported Jun 2024","sort_date":"2024-06","sector":"gov","sector_label":"Government","who":"National Telecommunications Monitoring Center (NTMC), Bangladesh","who_link":"National Telecommunications Monitoring Center (NTMC)","what_left":"National identity details and cell phone call records of citizens, with other \"classified secret information\", per an NTMC letter; no count given","how":"Two senior police officials with accounts on the NTMC's National Intelligence Platform allegedly passed data to the administrator of at least one Telegram group in exchange for money","then":"The Telegram administrator attempted to sell it, per the NTMC; departmental investigation; platform access suspended for both police units","source_url":"https://techcrunch.com/2024/06/06/bangladeshi-police-agents-accused-of-selling-citizens-personal-information-on-telegram/","more_sources":["https://thefinancialexpress.com.bd/home/two-cops-accused-of-selling-citizens-personal-data-to-criminals"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["national_id"],"aftermath_tags":["sale"],"via":null,"country":"Bangladesh","scale":null,"related_attack_ids":[]},{"id":95,"slug":"2024-06-infosys-mccamish","when":"Nov 2023, disclosed Feb to Jun 2024","sort_date":"2024-06","sector":"bank","sector_label":"Finance","who":"Bank of America and other financial firms, via service provider Infosys McCamish Systems","who_link":"Infosys McCamish Systems","what_left":"A little over 6 million people, per the provider's notice, among them 57,028 people in deferred compensation plans serviced by Bank of America: Social Security numbers, dates of birth, financial account and payment card information, passport and driver's licence numbers, biometric data, medical information, varying by person","how":"Ransomware attack on the provider in November 2023, claimed by LockBit","then":"Notified in stages from February 2024; two years of identity protection offered","source_url":"https://www.bleepingcomputer.com/news/security/infosys-mccamish-says-lockbit-stole-data-of-6-million-people/","more_sources":["https://www.theregister.com/2024/02/13/infosys_bank_of_america_leak/"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","address","email","national_id","dob","bank_account","selfie","credentials"],"aftermath_tags":[],"via":"Infosys McCamish Systems","country":null,"scale":6000000,"related_attack_ids":[]},{"id":131,"slug":"2024-06-coingecko-getresponse","when":"Jun 2024","sort_date":"2024-06","sector":"crypto","sector_label":"Crypto","who":"CoinGecko, via email vendor GetResponse","who_link":"CoinGecko","what_left":"1,916,596 contacts: names, email addresses, IP addresses, location of email opens, sign-up dates and subscription plans","how":"A GetResponse employee's account was compromised on 5 June 2024 and CoinGecko's contact list was exported","then":"23,723 phishing emails sent from another GetResponse client's account","source_url":"https://cointelegraph.com/news/coingecko-confirms-email-provider-data-breach","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","ip_address","location"],"aftermath_tags":["phishing"],"via":"GetResponse","country":null,"scale":1916596,"related_attack_ids":[]},{"id":43,"slug":"2024-05-neiman-marcus-snowflake","when":"Apr to May 2024","sort_date":"2024-05","sector":"luxury","sector_label":"Luxury","who":"Neiman Marcus, luxury retailer, via its Snowflake account","who_link":"Neiman Marcus","what_left":"64,472 people per the company's notice to the Maine attorney general: names, contact information, dates of birth, gift card numbers. Have I Been Pwned later counted more than 31 million customer email addresses","how":"Unauthorised access to the company's account at cloud database provider Snowflake in April and May 2024","then":"Offered for sale on a hacking forum for $150,000; the seller said an extortion demand had been refused. Customers notified. A $3.5 million class settlement received final approval in October 2025. A Canadian man pleaded guilty in August 2026 to the Snowflake extortion scheme, in which Neiman Marcus is named among the companies hit","source_url":"https://www.bleepingcomputer.com/news/security/neiman-marcus-confirms-data-breach-after-snowflake-account-hack/","more_sources":["https://securityaffairs.com/165492/data-breach/neiman-marcus-data-breach-2.html","https://news.bloomberglaw.com/litigation/advance-auto-neiman-marcus-settle-snowflake-data-breach-suits","https://therecord.media/guilty-plea-snowflake-hack-connor-riley-moucka","https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","dob","account_id"],"aftermath_tags":["sale","extortion"],"via":"Snowflake","country":null,"scale":31000000,"related_attack_ids":[]},{"id":96,"slug":"2024-05-santander","when":"May 2024","sort_date":"2024-05","sector":"bank","sector_label":"Finance","who":"Santander, customers in Chile, Spain and Uruguay, via a third-party database provider","who_link":"Santander","what_left":"Information on customers of Santander Chile, Spain and Uruguay and on current and some former staff; the bank gave no count. The sellers claimed bank details of 30 million customers, balances of 6 million accounts and 28 million credit card numbers","how":"Unauthorised access to a Santander database hosted by a third-party provider","then":"[ShinyHunters listed the data](https://www.bankingdive.com/news/hackers-breach-santander-customer-data-threaten-sell-2-million-ticketmaster-snowflake-shinyhunters/717807/) on a hacker forum for $2 million","source_url":"https://www.santander.com/en/stories/statement","more_sources":["https://www.bankingdive.com/news/hackers-breach-santander-customer-data-threaten-sell-2-million-ticketmaster-snowflake-shinyhunters/717807/","https://therecord.media/snowflake-response-reported-breach-santander-ticketmaster"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["bank_account","balance","employment"],"aftermath_tags":["sale"],"via":null,"country":null,"scale":30000000,"related_attack_ids":[]},{"id":139,"slug":"2024-05-christies","when":"May 2024","sort_date":"2024-05","sector":"luxury","sector_label":"Luxury","who":"Christie's, auction house","who_link":"Christie's","what_left":"45,798 people: names and ID document numbers, per Christie's filing with the Maine attorney general","how":"An unauthorised actor accessed some systems and files on 8 and 9 May 2024. Method not disclosed","then":"RansomHub, which claimed data on more than 500,000 clients, posted a sample and later said it had auctioned the data; Christie's told clients it believed the information had not been misused","source_url":"https://www.theregister.com/2024/06/10/christies_clients_data_stolen/","more_sources":["https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7d04d0f1-25d1-45b1-b1d0-87ba72a4d343.shtml","https://www.securityweek.com/christies-says-ransomware-attack-impacts-45000-people/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":45798,"related_attack_ids":[]},{"id":83,"slug":"2024-04-world-check","when":"Mar 2024, reported Apr 2024","sort_date":"2024-04","sector":"idv","sector_label":"Identity vendors","who":"World-Check screening database (LSEG), via an unnamed firm with access to it","who_link":"World-Check screening database","what_left":"5.3 million records, per the hackers. The portion seen by TechCrunch held records on thousands of people: names, passport numbers, Social Security numbers, online crypto account identifiers","how":"Taken in March from a Singapore-based firm with access to the database, per the hackers. LSEG said a third party's copy of the data file was illegally obtained and its own systems were not breached","then":"The group, calling itself GhostR, threatened to publish the data online","source_url":"https://techcrunch.com/2024/04/18/world-check-database-leaked-sanctions-financial-crimes-watchlist","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","national_id","account_id"],"aftermath_tags":[],"via":null,"country":null,"scale":5300000,"related_attack_ids":[]},{"id":60,"slug":"2024-03-att-2019-data-set","when":"Offered 2021, released Mar 2024","sort_date":"2024-03","sector":"other","sector_label":"Other","who":"AT&T, United States","who_link":"AT&T","what_left":"About 7.6 million current and 65.4 million former account holders, data from 2019 or earlier: names, email and mailing addresses, phone numbers, dates of birth, Social Security numbers and encrypted account passcodes. More than 51 million people notified","how":"Not disclosed. AT&T says it is not known whether the data came from AT&T or a vendor, and it has no evidence of unauthorised access to its systems","then":"Offered for sale by ShinyHunters in 2021, when AT&T said it did not come from its systems; released in full in March 2024. AT&T reset passcodes after a researcher showed they could be guessed, and offered credit monitoring. A $177 million class settlement over this and a second 2024 AT&T breach received final approval, reported in October 2026","source_url":"https://techcrunch.com/2024/04/10/att-notifies-regulators-after-customer-data-breach/","more_sources":["https://www.prnewswire.com/news-releases/att-addresses-recent-data-set-released-on-the-dark-web-302103937.html","https://techcrunch.com/2024/03/30/att-reset-account-passcodes-customer-data/","https://www.bankinfosecurity.com/after-70m-individuals-data-leaks-att-denies-being-source-a-24639","https://www.fox9.com/news/att-data-breach-settlement-gets-final-approval-how-much-will-customers-get"],"leak_type":"unknown","vector":"undisclosed","verification":"confirmed","data_types":["name","email","address","phone","dob","national_id","account_id","credentials"],"aftermath_tags":["sale","publication"],"via":null,"country":"United States","scale":65400000,"related_attack_ids":[]},{"id":24,"slug":"2024-01-trezor-support-portal","when":"Jan 2024","sort_date":"2024-01","sector":"crypto","sector_label":"Crypto","who":"Trezor, via support ticketing vendor","who_link":"Trezor","what_left":"About 66,000 support users: names or nicknames and email addresses","how":"Unauthorised access to the third-party support portal","then":"Phishing emails asking for recovery seeds followed within days","source_url":"https://www.bleepingcomputer.com/news/security/trezor-support-site-breach-exposes-personal-data-of-66-000-customers/","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email"],"aftermath_tags":["phishing"],"via":null,"country":null,"scale":66000,"related_attack_ids":[]},{"id":94,"slug":"2024-01-loandepot","when":"Jan 2024","sort_date":"2024-01","sector":"bank","sector_label":"Finance","who":"loanDepot, mortgage lender","who_link":"loanDepot","what_left":"16.9 million people: names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers and financial account numbers","how":"Ransomware attack with unauthorised access from 3 to 5 January 2024; entry point not disclosed","then":"The ALPHV/BlackCat group listed loanDepot on its leak site and said it planned to sell the data","source_url":"https://www.securityweek.com/loandepot-ransomware-attack-exposed-16-9-million-individuals/","more_sources":["https://www.bleepingcomputer.com/news/security/alphv-ransomware-claims-loandepot-prudential-financial-breaches/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","email","phone","dob","national_id","bank_account"],"aftermath_tags":["extortion"],"via":null,"country":null,"scale":16900000,"related_attack_ids":[]},{"id":62,"slug":"2023-12-verizon-forged-warrant","when":"2023, reported Dec 2023","sort_date":"2023-12","sector":"other","sector_label":"Other","who":"Verizon Wireless","who_link":"Verizon Wireless","what_left":"One customer's address and phone logs","how":"Released to a man who posed as a police detective by email and phone and sent fake search warrants carrying a judge's name; he wrote from a ProtonMail address","then":"He contacted the customer's family, friends and workplace, sent threatening messages and drove from New Mexico to Raleigh, where police arrested him with a knife in Nov 2023. [Sentenced to five years](https://www.wbtv.com/2025/04/15/new-mexico-man-sentenced-after-stalking-threatening-raleigh-woman-he-met-online/) in Apr 2025","source_url":"https://www.404media.co/verizon-gave-phone-data-to-stalker-edrs-search-warrant-pose-as-cop/","more_sources":["https://www.404media.co/verizon-gave-her-data-to-a-stalker-this-has-completely-changed-my-life/","https://www.wbtv.com/2025/04/15/new-mexico-man-sentenced-after-stalking-threatening-raleigh-woman-he-met-online/","https://www.eff.org/deeplinks/2024/01/companies-make-it-too-easy-thieves-impersonate-police-and-steal-our-data"],"leak_type":"handover","vector":"fake_legal_request","verification":"confirmed","data_types":["address","phone"],"aftermath_tags":["physical_threat"],"via":null,"country":null,"scale":1,"related_attack_ids":[]},{"id":69,"slug":"2023-10-ntt-west-temporary-worker","when":"Disclosed Oct 2023","sort_date":"2023-10","sector":"other","sector_label":"Other","who":"NTT West, Japanese telecom, via subsidiary NTT Business Solutions","who_link":"NTT West","what_left":"Data on 9.28 million customers","how":"A temporary employee at the subsidiary stole the data and sold it to a third party, per NTT West; believed to have gone on for a decade","then":"Former employee arrested and indicted in February 2024; regulator issued corrective recommendations to two subsidiaries; NTT West's president resigned","source_url":"https://www.theregister.com/2024/03/01/ntt_boss_resigns_dataleak/","more_sources":["https://www.mlex.com/mlex/articles/2046033","https://www.fukuoka-now.com/en/news/ntt-west-japan-subsidiary-data-breach/"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["name","address","dob","phone"],"aftermath_tags":["sale"],"via":"NTT Business Solutions","country":"Japan","scale":9280000,"related_attack_ids":[]},{"id":70,"slug":"2023-09-irs-contractor-tax-returns","when":"2019 to 2020, charged Sep 2023","sort_date":"2023-09","sector":"gov","sector_label":"Government","who":"Internal Revenue Service, United States","who_link":"Internal Revenue Service","what_left":"Tax returns and return information of thousands of the nation's wealthiest individuals, and of a high-ranking government official","how":"A contractor working for the IRS queried its database with broad search terms to avoid detection and uploaded the results to a private website","then":"Passed to two news organizations; one published nearly 50 articles using the data; the contractor pleaded guilty in October 2023","source_url":"https://www.tigta.gov/articles/investigations/irs-contractor-pleads-guilty-disclosing-tax-return-information-news","more_sources":["https://www.justice.gov/archives/opa/pr/irs-contractor-pleads-guilty-disclosing-tax-return-information-news-organizations","https://www.tigta.gov/articles/investigations/former-irs-contractor-sentenced-disclosing-tax-return-information","https://www.justice.gov/archives/opa/pr/former-irs-contractor-sentenced-disclosing-tax-return-information-news-organizations"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["wealth"],"aftermath_tags":["publication"],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":25,"slug":"2023-08-kroll-ftx-blockfi-genesis","when":"Aug 2023","sort_date":"2023-08","sector":"crypto","sector_label":"Crypto","who":"FTX, BlockFi and Genesis creditors, via claims agent Kroll","who_link":"Kroll","what_left":"Names, addresses and email addresses of people with claims in the three bankruptcies, with FTX account balances and Genesis claim amounts","how":"T-Mobile moved a Kroll employee's phone number to the attacker's phone (a SIM swap), which opened the files Kroll held for the three cases","then":"Phishing emails posing as FTX followed; Kroll agreed in August 2024 to pay the FTX estate [$3.3 million](https://news.bloomberglaw.com/bankruptcy-law/ftx-gets-3-3-million-in-deal-over-2023-customer-data-breach), and creditors later sued Kroll over continuing scam emails. In July 2026 a US magistrate judge recommended sending the FTX claimants' claims to arbitration and dismissing those of BlockFi claimants","source_url":"https://www.helpnetsecurity.com/2023/08/28/kroll-sim-swapping-attack/","more_sources":["https://www.tradingview.com/news/cointelegraph:f89ac411c094b:0-kroll-faces-class-action-suit-as-ftx-creditors-allege-daily-scam-emails/","https://news.bloomberglaw.com/bankruptcy-law/kroll-data-breach-suits-must-be-tossed-or-arbitrated-judge-says"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","address","email","balance"],"aftermath_tags":["phishing"],"via":"Kroll","country":null,"scale":null,"related_attack_ids":[]},{"id":26,"slug":"2023-08-coinflip","when":"Aug 2023","sort_date":"2023-08","sector":"crypto","sector_label":"Crypto","who":"CoinFlip, Bitcoin ATM operator","who_link":"CoinFlip","what_left":"36,646 US customers: names, addresses, social security numbers, driving licence and other government ID numbers, per reports of the breach notice","how":"Social engineering of an employee on 7 August 2023, which opened an email account and then internal systems","then":"Customers notified on 20 October 2023; a class action settled for [$475,000](https://www.claimdepot.com/settlements/crypto-data-breach-settlement), approved in October 2025","source_url":"https://www.jdsupra.com/legalnews/coinflip-announces-data-breach-after-3547415/","more_sources":["https://cybernews.com/crypto/coinflip-data-breach-exposes-thousands/"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","address","national_id"],"aftermath_tags":[],"via":null,"country":null,"scale":36646,"related_attack_ids":[]},{"id":44,"slug":"2023-06-zacks-2020-data","when":"May 2020, published Jun 2023","sort_date":"2023-06","sector":"bank","sector_label":"Finance","who":"Zacks Investment Research","who_link":"Zacks Investment Research","what_left":"About 8.8 million users: names, addresses, phone numbers, email addresses, usernames, unsalted SHA-256 password hashes","how":"Not disclosed. The newest entry in the file dates from May 2020; Zacks had disclosed a smaller, separate breach in January 2023","then":"Posted on a hacking forum in June 2023; Zacks said no customer financial information was accessed","source_url":"https://www.bleepingcomputer.com/news/security/have-i-been-pwned-warns-of-new-zacks-data-breach-impacting-8-million/","more_sources":["https://www.securityweek.com/data-of-8-8-million-zacks-users-emerges-online/"],"leak_type":"unknown","vector":"undisclosed","verification":"reported","data_types":["name","address","phone","email","credentials"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":8800000,"related_attack_ids":[]},{"id":111,"slug":"2023-06-louisiana-omv-moveit","when":"Jun 2023","sort_date":"2023-06","sector":"gov","sector_label":"Government","who":"Louisiana Office of Motor Vehicles, via the MOVEit Transfer file tool","who_link":"Louisiana Office of Motor Vehicles","what_left":"No count given: all Louisianans with a state driver's licence, ID or car registration likely had their data exposed. Name, address, Social Security number, birth date, height, eye colour, driver's licence number, vehicle registration information","how":"The Clop ransomware group exploited a zero-day flaw in MOVEit Transfer, the file transfer software the office used","then":"The office said there was no indication Clop had used, sold, shared or released the data; Clop told a reporter it erased government data, which is unverified","source_url":"https://www.bleepingcomputer.com/news/security/millions-of-oregon-louisiana-state-ids-stolen-in-moveit-breach/","more_sources":[],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","address","national_id","dob","wealth"],"aftermath_tags":[],"via":"MOVEit Transfer","country":"United States","scale":null,"related_attack_ids":[]},{"id":50,"slug":"2023-03-hdb-financial-services","when":"May 2022 to Feb 2023, published Mar 2023","sort_date":"2023-03","sector":"bank","sector_label":"Finance","who":"HDB Financial Services, HDFC Bank's lending arm, via a service provider","who_link":"HDB Financial Services","what_left":"Loan customers' names, phone numbers, email addresses, addresses, dates of birth, credit scores, EMI amounts, marital status, vehicle details. Claimed: about 70 million entries, mostly duplicates; one estimate puts customers at about 600,000","how":"Breach at an unnamed service provider that processes some of HDB's customer information, per HDB; HDB first said its own systems had not been breached","then":"Posted on a hacker forum on 6 March 2023","source_url":"https://www.medianama.com/2023/03/223-hdfc-bank-hdb-financial-services-data-breach/","more_sources":["https://www.cio.inc/hdb-financial-services-finds-breach-at-data-processor-a-21393"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","phone","email","address","dob","wealth","family"],"aftermath_tags":["publication"],"via":null,"country":"India","scale":70000000,"related_attack_ids":[]},{"id":58,"slug":"2023-03-dc-health-link","when":"Mar 2023","sort_date":"2023-03","sector":"gov","sector_label":"Government","who":"DC Health Link, Washington DC health insurance exchange","who_link":"DC Health Link","what_left":"56,415 current and past customers, including 17 members of the House and 585 House staff: names, dates of birth and Social Security numbers, per the exchange","how":"A server that generated and stored weekly reports was misconfigured to allow access without authentication; two reports were taken","then":"Eleven records posted on BreachForums as an advertisement and the data offered for sale; a version was later posted for anyone to access. Customers offered identity theft protection","source_url":"https://oversight.house.gov/wp-content/uploads/2023/04/Mila-Kofman-Written-Testimony-April-19-2023.pdf","more_sources":["https://statescoop.com/dc-health-link-data-breach-house-testimony/","https://www.techtarget.com/searchsecurity/news/365535577/DC-Health-Link-breach-caused-by-misconfigured-server","https://www.nbcnews.com/tech/security/fbi-arrests-alleged-operator-site-hosted-hacked-congressional-health-d-rcna76562"],"leak_type":"exposure","vector":"open_storage","verification":"confirmed","data_types":["name","dob","national_id","family"],"aftermath_tags":["sale","publication"],"via":null,"country":"United States","scale":56415,"related_attack_ids":[]},{"id":97,"slug":"2023-03-tmx-finance","when":"Dec 2022 to Feb 2023, disclosed Mar 2023","sort_date":"2023-03","sector":"bank","sector_label":"Finance","who":"TMX Finance, lender behind TitleMax, TitleBucks and InstaLoan","who_link":"TMX Finance","what_left":"Over 4.8 million customers; may have included name, date of birth, passport number, driver's licence number, government ID and tax ID numbers, Social Security number, financial account information, phone, address and email","how":"Not disclosed. The intrusion likely began in early December 2022 and was found on 13 February 2023; data may have been acquired between 3 and 14 February","then":"FBI notified; 12 months of credit monitoring offered","source_url":"https://www.infosecurity-magazine.com/news/consumer-loans-tmx-reveals-major/","more_sources":["https://americanbanker.com/news/titlemax-hack-exposes-4-8-million-customers-data"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","national_id","bank_account","phone","address","email"],"aftermath_tags":[],"via":null,"country":"United States","scale":4800000,"related_attack_ids":[]},{"id":98,"slug":"2023-03-latitude-financial","when":"Mar 2023","sort_date":"2023-03","sector":"bank","sector_label":"Finance","who":"Latitude Financial, consumer lender, Australia and New Zealand","who_link":"Latitude Financial","what_left":"Approximately 7.9 million driver licence numbers, 53,000 passport numbers, 103,000 copies of driver licences or passports, 308,000 bank account numbers, 143,000 credit card numbers, and income and expense information from about 900,000 loan applications","how":"Cyber attack in March 2023; Latitude's page does not say how the attacker got in","then":"A ransom was demanded and refused, per Latitude's 11 April 2023 announcement as [summarised by a law firm](https://www.brightlaw.com.au/latitude-financial-data-breach/); Australian and New Zealand privacy regulators opened a joint investigation","source_url":"https://www.latitudefinancial.com.au/latitude-cyber-incident/","more_sources":["https://asic.gov.au/about-asic/news-centre/news-items/guidance-for-consumers-impacted-by-the-latitude-financial-services-data-breach/","https://www.brightlaw.com.au/latitude-financial-data-breach/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["national_id","id_document","name","address","phone","dob","bank_account","wealth","transactions"],"aftermath_tags":["extortion"],"via":null,"country":"Australia","scale":7900000,"related_attack_ids":[]},{"id":140,"slug":"2023-03-ferrari","when":"Mar 2023","sort_date":"2023-03","sector":"luxury","sector_label":"Luxury","who":"Ferrari","who_link":"Ferrari","what_left":"Client names, addresses, email addresses and telephone numbers; no count given","how":"A threat actor accessed a limited number of systems in Ferrari's IT environment. Method not disclosed","then":"Ransom demand over the client contact details, disclosed by Ferrari on 20 March 2023","source_url":"https://www.bleepingcomputer.com/news/security/ferrari-discloses-data-breach-after-receiving-ransom-demand/","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","email","phone"],"aftermath_tags":["extortion"],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":93,"slug":"2023-01-paypal-credential-stuffing","when":"Dec 2022, disclosed Jan 2023","sort_date":"2023-01","sector":"bank","sector_label":"Finance","who":"PayPal","who_link":"PayPal","what_left":"34,942 people, per the filing with the Maine attorney general: names, addresses, phone numbers, Social Security numbers, individual tax identification numbers and dates of birth","how":"Credential stuffing between 6 and 8 December 2022: logins with customers' own credentials, which PayPal said were not obtained from its systems","then":"PayPal said it had no information suggesting the data was misused or that unauthorised transactions took place","source_url":"https://www.securityweek.com/paypal-warns-35000-users-credential-stuffing-attacks/","more_sources":["https://www.theregister.com/2023/01/19/paypal_data_breach/"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","address","phone","national_id","dob"],"aftermath_tags":[],"via":null,"country":"United States","scale":34942,"related_attack_ids":[]},{"id":46,"slug":"2022-12-gemini-vendor","when":"Dec 2022","sort_date":"2022-12","sector":"crypto","sector_label":"Crypto","who":"Gemini, via an unnamed third-party vendor","who_link":"Gemini","what_left":"Customer email addresses and partial phone numbers, per Gemini; reports put the file at about 5.7 million rows, with duplicates","how":"Incident at a third-party vendor, per Gemini; Gemini said its own systems and accounts were not affected","then":"Gemini said customers were targeted by phishing campaigns it attributed to the incident; the file was reportedly offered for sale and then released free. In March 2025 about 100,000 customer records were offered for sale again; a Gemini spokesperson [traced them to this incident](https://cointelegraph.com/news/hackers-selling-leaked-gemini-binance-user-information) and said \"There was no breach of any Gemini systems\"","source_url":"https://www.gemini.com/blog/protecting-our-customers-from-phishing-campaigns","more_sources":["https://cointelegraph.com/news/crypto-users-claim-gemini-email-leak-occurred-much-earlier-than-first-reported","https://www.theblock.co/post/195083/gemini-reports-third-party-phishing-campaign-that-affected-some-customer-data","https://www.malwarebytes.com/blog/news/2022/12/millions-of-gemini-cryptocurrency-exchange-user-details-leaked","https://cointelegraph.com/news/hackers-selling-leaked-gemini-binance-user-information"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["email","phone"],"aftermath_tags":["phishing","sale","publication"],"via":null,"country":null,"scale":5700000,"related_attack_ids":[]},{"id":119,"slug":"2022-12-cointracker-sendgrid","when":"Dec 2022","sort_date":"2022-12","sector":"crypto","sector_label":"Crypto","who":"CoinTracker, crypto tax and portfolio tracker, via email vendor SendGrid","who_link":"CoinTracker","what_left":"Email addresses of CoinTracker users, per the company, which gives no count; more than 1.5 million per Have I Been Pwned. The file found online also held partial phone numbers, which CoinTracker says it does not collect and which matched none of its users in a sample","how":"Breach of SendGrid's database after an employee of its parent Twilio had corporate credentials exposed, per CoinTracker, which said its own database was not breached","then":"File circulated online. CoinTracker emailed affected users and told them to watch for phishing","source_url":"https://www.cointracker.io/blog/sendgrid-data-breach","more_sources":["https://haveibeenpwned.com/Breach/CoinTracker"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["email","phone"],"aftermath_tags":["publication"],"via":"SendGrid","country":null,"scale":1500000,"related_attack_ids":[]},{"id":89,"slug":"2022-10-celsius-court-filing","when":"Oct 2022","sort_date":"2022-10","sector":"crypto","sector_label":"Crypto","who":"Celsius Network, crypto lender, in its own bankruptcy filing","who_link":"Celsius Network","what_left":"Names of Celsius users with 90 days of their transactions, dates and amounts, and creditor names with claim amounts, in a filing of more than 14,000 pages. Home and email addresses were left out","how":"Filed on the public bankruptcy court docket after the judge refused Celsius's request to redact customer names","then":"Gizmodo uploaded the filing to the Internet Archive; creditors voiced fears of doxxing and hacks","source_url":"https://www.theblock.co/post/175445/celsius-provides-users-names-and-trading-history-in-legal-filing","more_sources":["https://www.theblock.co/post/175701/celsius-creditors-face-fallout-from-u-s-bankruptcy-disclosure-process"],"leak_type":"exposure","vector":"undisclosed","verification":"confirmed","data_types":["name","transactions","balance"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":104,"slug":"2022-10-uk-electoral-commission","when":"Aug 2021 to Oct 2022","sort_date":"2022-10","sector":"gov","sector_label":"Government","who":"Electoral Commission, United Kingdom, copies of the electoral register","who_link":"Electoral Commission","what_left":"Names and home addresses of approximately 40 million people on the electoral register","how":"Attackers impersonated a user account and exploited known, unpatched flaws in a Microsoft Exchange server, and kept access for over a year","then":"ICO reprimand on 30 July 2024; the ICO said it had no reason to believe the data was misused","source_url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/07/ico-reprimands-the-electoral-commission-after-cyber-attack-compromises-servers","more_sources":[],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","address"],"aftermath_tags":[],"via":null,"country":"United Kingdom","scale":40000000,"related_attack_ids":[]},{"id":99,"slug":"2022-09-revolut-social-engineering","when":"Sep 2022","sort_date":"2022-09","sector":"bank","sector_label":"Finance","who":"Revolut","who_link":"Revolut","what_left":"50,150 customers worldwide, 20,687 of them in the European Economic Area, per Revolut's disclosure to the Lithuanian data protection authority: names, addresses, email addresses, phone numbers and likely partial card payment data","how":"Social engineering of an employee; Revolut found the access late on 11 September 2022 and cut it off the next morning","then":"Revolut put the share at 0.16% of customers and warned them about phishing emails","source_url":"https://techcrunch.com/2022/09/20/revolut-cyberattack-thousands-exposed","more_sources":["https://vdai.lrv.lt/en/news/the-state-data-protection-inspectorate-has-initiated-an-investigation-regarding-personal-data-breach-in-revolut"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","address","email","phone","bank_account"],"aftermath_tags":[],"via":null,"country":null,"scale":50150,"related_attack_ids":[]},{"id":110,"slug":"2022-09-optus","when":"Sep 2022","sort_date":"2022-09","sector":"other","sector_label":"Other","who":"Optus, telecom, Australia","who_link":"Optus","what_left":"Approximately 9.5 million people: names, dates of birth, home addresses, phone numbers and email addresses; passport, driver's licence and Medicare card numbers","how":"Cyberattack made public on 22 September 2022; the regulator's announcement does not describe the method","then":"Some of the data was later released on the dark web. The Australian Information Commissioner filed civil penalty proceedings in the Federal Court in August 2025","source_url":"https://www.oaic.gov.au/news/media-centre/australian-information-commissioner-takes-civil-penalty-action-against-optus","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","address","phone","email","national_id"],"aftermath_tags":["publication"],"via":null,"country":"Australia","scale":9500000,"related_attack_ids":[]},{"id":130,"slug":"2022-08-klaviyo-crypto-lists","when":"Aug 2022","sort_date":"2022-08","sector":"crypto","sector_label":"Crypto","who":"Klaviyo, email marketing vendor, lists of its cryptocurrency-related clients","who_link":"Klaviyo","what_left":"List or segment information downloaded from 38 client accounts: names, email addresses, phone numbers and some account-specific profile properties, per Klaviyo. The clients are not named","how":"An employee's login credentials were compromised on 3 August 2022, which opened internal support tools; 44 accounts were viewed","then":"Reported on 9 August 2022; the source reports no use of the lists","source_url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/marketing-lists-for-crypto-customers-stolen-in-data-breach-at-marketing-platform-klaviyo","more_sources":[],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","email","phone"],"aftermath_tags":[],"via":"Klaviyo","country":null,"scale":null,"related_attack_ids":[]},{"id":129,"slug":"2022-07-opensea-celsius-customer-io","when":"Jun to Jul 2022","sort_date":"2022-07","sector":"crypto","sector_label":"Crypto","who":"OpenSea and Celsius, via email vendor Customer.io","who_link":"OpenSea and Celsius","what_left":"Email addresses of OpenSea users and newsletter subscribers, and a list of Celsius customer email addresses. Neither company gave a count","how":"A Customer.io senior engineer with legitimate access downloaded the addresses and passed them to an outside party; five other Customer.io clients were affected","then":"OpenSea warned of a heightened likelihood of phishing on 29 June 2022. Customer.io told Celsius on 30 June that its data was untouched and reversed that on 8 July; the engineer was dismissed","source_url":"https://www.theblock.co/post/160148/celsius-also-hit-by-costumer-io-email-data-breach","more_sources":["https://www.theblock.co/news/business/2022-06-29-opensea-hit-by-data-breach-155010","https://www.theblock.co/post/155010/opensea-hit-by-data-breach"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["email"],"aftermath_tags":[],"via":"Customer.io","country":null,"scale":null,"related_attack_ids":[]},{"id":107,"slug":"2022-06-california-doj-firearms-dashboard","when":"Jun 2022","sort_date":"2022-06","sector":"gov","sector_label":"Government","who":"California Department of Justice, concealed carry weapon permit records","who_link":"California Department of Justice","what_left":"Roughly 192,000 people who applied for a concealed carry weapon permit from about 2012 to 2021: names, birthdays, addresses and other details","how":"The department's new Firearms Dashboard, published on 27 June 2022, let the public download the underlying data set; an analyst had wrongly believed the public could not reach it","then":"Downloaded [more than 2,700 times](https://www.govtech.com/security/california-doj-exposed-data-for-190k-concealed-weapons-applicants) before removal on 28 June; an independent investigation reported in November 2022","source_url":"https://www.oag.ca.gov/news/press-releases/california-department-justice-releases-results-independent-investigation","more_sources":["https://www.govtech.com/security/california-doj-exposed-data-for-190k-concealed-weapons-applicants"],"leak_type":"exposure","vector":"open_storage","verification":"confirmed","data_types":["name","dob","address"],"aftermath_tags":[],"via":null,"country":"United States","scale":192000,"related_attack_ids":[]},{"id":59,"slug":"2022-05-gemotest","when":"Apr 2022, offered May 2022","sort_date":"2022-05","sector":"other","sector_label":"Other","who":"Gemotest, medical laboratory chain, Russia","who_link":"Gemotest","what_left":"About 31 million rows, per the leak channel cited by Kommersant: full names, dates of birth, addresses, phone numbers, emails, passport series and numbers, insurance and SNILS numbers; records reported to date from 2012. More than 300 GB per the regulator","how":"Database copied no earlier than 22 April 2022. Method not disclosed","then":"Offered for sale on darknet forums in early May 2022. Roskomnadzor inspected; a Moscow court fined Gemotest 60,000 roubles in July 2022","source_url":"https://www.kommersant.ru/doc/5339983","more_sources":["https://lenta.ru/news/2022/07/25/shtraf/","https://ria.ru/20220725/shtraf-1804784135.html","https://vademec.ru/news/2022/07/25/gemotest-oshtrafovali-za-utechku-dannykh-patsientov-/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","address","phone","email","national_id","account_id"],"aftermath_tags":["sale"],"via":null,"country":"Russia","scale":31000000,"related_attack_ids":[]},{"id":64,"slug":"2022-04-google-snap-twitter-discord-emergency-requests","when":"2021 to 2022, reported Apr 2022","sort_date":"2022-04","sector":"other","sector_label":"Other","who":"Google, Snap, Twitter and Discord","who_link":"Google, Snap, Twitter and Discord","what_left":"Basic subscriber information, reportedly; it generally includes the name, IP address, email address and physical address, per Bloomberg","how":"Forged emergency data requests, typically sent after compromising the email system of a foreign law enforcement agency, per US law enforcement officers cited by Bloomberg","then":"Data used to harass and sexually extort women and minors, per six people cited by Bloomberg. [Discord confirmed](https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/) it complied with requests from a police account that had been compromised; Google said it uncovered a fraudulent request in 2021","source_url":"https://news.bloomberglaw.com/privacy-and-data-security/tech-giants-duped-by-forged-requests-in-sexual-extortion-scheme","more_sources":["https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/","https://www.aljazeera.com/economy/2022/3/30/apple-meta-gave-user-data-to-hackers-who-used-forged-requests"],"leak_type":"handover","vector":"fake_legal_request","verification":"reported","data_types":["name","ip_address","email","address"],"aftermath_tags":["extortion"],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":71,"slug":"2022-04-cash-app-investing","when":"Dec 2021, disclosed Apr 2022","sort_date":"2022-04","sector":"bank","sector_label":"Finance","who":"Cash App Investing, brokerage subsidiary of Block","who_link":"Cash App Investing","what_left":"Full names and brokerage account numbers; for some customers also portfolio value, holdings or one day of trading activity. About 8.2 million current and former customers contacted","how":"A former employee downloaded internal reports after their employment had ended","then":"Customers contacted by Cash App Investing","source_url":"https://www.sec.gov/Archives/edgar/data/1512673/000119312522095215/d343042d8k.htm","more_sources":["https://therecord.media/block-says-former-cash-app-employee-accessed-data-from-us-customer-accounts"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["name","account_id","balance","transactions"],"aftermath_tags":[],"via":null,"country":null,"scale":8200000,"related_attack_ids":[]},{"id":87,"slug":"2022-04-trezor-mailchimp","when":"Mar 2022, disclosed Apr 2022","sort_date":"2022-04","sector":"crypto","sector_label":"Crypto","who":"Trezor and other crypto and finance firms, via email vendor Mailchimp","who_link":"Trezor","what_left":"Audience data (mailing lists) exported from 102 Mailchimp customer accounts, out of 319 accessed; Mailchimp said the accounts were in the cryptocurrency and finance sectors","how":"Social engineering of Mailchimp employees gave the attacker their credentials and the internal support and account tools; Mailchimp noticed on 26 March 2022","then":"Trezor owners received fake breach notices urging them to reset their wallet PIN by downloading malicious software","source_url":"https://www.bleepingcomputer.com/news/security/hackers-breach-mailchimps-internal-tools-to-target-crypto-customers","more_sources":["https://therecord.media/hacker-accessed-319-crypto-and-finance-related-mailchimp-accounts-company-said/","https://www.govinfosecurity.com/targeted-mailchimp-breach-affects-trezor-crypto-customers-a-18835","https://www.bankinfosecurity.com/targeted-mailchimp-breach-affects-trezor-crypto-customers-a-18835"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["email"],"aftermath_tags":["phishing","impersonation"],"via":"Mailchimp","country":null,"scale":null,"related_attack_ids":[]},{"id":27,"slug":"2022-03-hubspot-crypto-customers","when":"Mar 2022","sort_date":"2022-03","sector":"crypto","sector_label":"Crypto","who":"BlockFi, Swan Bitcoin, NYDIG, Circle and Pantera Capital, via CRM vendor HubSpot","who_link":"HubSpot","what_left":"Customer names, email addresses and phone numbers held in the companies' HubSpot accounts; BlockFi said most of its clients","how":"A HubSpot employee account was compromised on 18 March 2022 and used to reach fewer than 30 customer accounts; HubSpot said the attack was aimed at cryptocurrency companies","then":"Each company warned its own customers; HubSpot closed the account and cut what its staff can do inside customer accounts","source_url":"https://siliconangle.com/2022/03/21/hubspot-hack-results-data-breach-leading-cryptocurrency-companies/","more_sources":["https://ir.hubspot.com/news-releases/news-release-details/hubspots-statement-regarding-march-18-2022-security-incident","https://www.theblock.co/news/regulation/2022-03-20-crypto-blockfi-pantera-hubspot-security-data-138563"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","phone"],"aftermath_tags":[],"via":"HubSpot","country":null,"scale":null,"related_attack_ids":[]},{"id":31,"slug":"2022-03-apple-meta-emergency-requests","when":"2021, reported Mar 2022","sort_date":"2022-03","sector":"other","sector_label":"Other","who":"Apple and Meta","who_link":"Apple and Meta","what_left":"Basic subscriber details, such as a customer's address, phone number and IP address, reportedly; how many customers is not known","how":"Forged emergency data requests from hackers posing as law enforcement officials, believed to have been sent via hacked email domains of law enforcement agencies in multiple countries","then":"Used to enable harassment campaigns, per one person cited by Bloomberg. Researchers suspect some of the senders are minors in the UK and the US. A [later Bloomberg report](https://news.bloomberglaw.com/privacy-and-data-security/tech-giants-duped-by-forged-requests-in-sexual-extortion-scheme) said data obtained this way from six companies, Apple and Meta among them, was used to harass and sexually extort minors","source_url":"https://www.aljazeera.com/economy/2022/3/30/apple-meta-gave-user-data-to-hackers-who-used-forged-requests","more_sources":["https://thehill.com/policy/cybersecurity/600410-apple-meta-turned-over-user-data-to-hackers-using-forged-requests-report/","https://www.claimsjournal.com/news/national/2022/03/31/309546.htm","https://news.bloomberglaw.com/privacy-and-data-security/tech-giants-duped-by-forged-requests-in-sexual-extortion-scheme","https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/"],"leak_type":"handover","vector":"fake_legal_request","verification":"reported","data_types":["address","phone","ip_address"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":88,"slug":"2022-03-unchained-activecampaign","when":"Mar 2022","sort_date":"2022-03","sector":"crypto","sector_label":"Crypto","who":"Unchained Capital, bitcoin vault and loan provider, via former email vendor ActiveCampaign","who_link":"Unchained Capital","what_left":"No count given. Client email addresses, usernames, account status and whether the client had an active vault or loan; names, email and IP addresses of website sign-ups","how":"An attacker posing as an Unchained employee talked ActiveCampaign support chat staff into reactivating the closed account and adding an administrator, on 10 March 2022","then":"Unchained told clients to be on high alert for spear phishing","source_url":"https://www.unchained.com/blog/email-marketing-data-leak-notice","more_sources":["https://coindesk.com/business/2022/03/16/unchained-capital-discloses-data-leak-at-email-marketing-partner/"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["email","account_id","name","ip_address"],"aftermath_tags":[],"via":"ActiveCampaign","country":null,"scale":null,"related_attack_ids":[]},{"id":121,"slug":"2022-01-btc-alpha","when":"Nov 2021, published Jan 2022","sort_date":"2022-01","sector":"crypto","sector_label":"Crypto","who":"BTC-Alpha, crypto exchange","who_link":"BTC-Alpha","what_left":"A table of 362,479 users: email addresses, hashed passwords, registration dates, countries and IP addresses. The chief executive confirmed the count as the number of users at the time and said part of the data had been altered","how":"Attack on the exchange on 1 November 2021; method not disclosed. The LockBit ransomware group claimed it and set a ransom deadline of 1 December","then":"LockBit operators published the table, reported on 17 January 2022. The exchange made two-factor authentication mandatory; Ukraine's prosecutor general opened a criminal case","source_url":"https://forklog.com/en/btc-alpha-confirms-partial-leak-of-client-data/","more_sources":["https://www.techtarget.com/searchsecurity/news/252509877/Cryptocurrency-exchange-BTC-Alpha-confirms-ransomware-attack"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["email","credentials","location","ip_address"],"aftermath_tags":["extortion","publication"],"via":null,"country":null,"scale":362479,"related_attack_ids":[]},{"id":28,"slug":"2021-robinhood","when":"2021","sort_date":"2021","sector":"bank","sector_label":"Finance","who":"Robinhood","who_link":"Robinhood","what_left":"5 million email addresses, 2 million names, 310 records with date of birth and ZIP code","how":"Social engineering of a support employee","then":"Reported to have been posted on a criminal forum in 2024 after Robinhood refused to pay","source_url":"https://newsroom.aboutrobinhood.com/robinhood-announces-data-security-incident-update/","more_sources":[],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["email","name","dob","location"],"aftermath_tags":["publication","extortion"],"via":null,"country":null,"scale":5000000,"related_attack_ids":[]},{"id":105,"slug":"2021-10-argentina-renaper","when":"Sep 2021, reported Oct 2021","sort_date":"2021-10","sector":"gov","sector_label":"Government","who":"RENAPER, Argentina's national registry of persons","who_link":"RENAPER","what_left":"Claimed: ID card data for the whole population, over 45 million people, per the seller: full names, home addresses, birth dates, ID card and citizen numbers, government photo IDs. The government confirmed queries for 19 photos","how":"A VPN account assigned to the Ministry of Health was used to query the register, per the Ministry of Interior, which said the database \"did not suffer any data breach or leak\"","then":"ID photos and details of 44 public figures were posted on Twitter; lookups of any citizen were offered on a hacking forum. The seller gave The Record the details of a citizen the reporter chose","source_url":"https://therecord.media/hacker-steals-government-id-database-for-argentinas-entire-population","more_sources":[],"leak_type":"theft","vector":"account_takeover","verification":"disputed","data_types":["name","address","dob","national_id","id_document"],"aftermath_tags":["publication","sale"],"via":null,"country":"Argentina","scale":45000000,"related_attack_ids":[]},{"id":57,"slug":"2021-08-guntrader","when":"Jul 2021, mapped Aug 2021","sort_date":"2021-08","sector":"other","sector_label":"Other","who":"Guntrader, UK firearms sales website","who_link":"Guntrader","what_left":"111,295 users registered from 2016 to 2021: names, home addresses, postcodes, phone numbers, email addresses, IP addresses, map coordinates of the address, and hashed passwords","how":"SQL database copied; Guntrader reportedly blamed an iframe on a customer's website. Method not otherwise disclosed","then":"Dumped on a hacking forum, then republished by an animal rights blog as a Google Earth file, telling readers to contact owners in their area. The Register reported a burglary two days later at a home in the file, in which a shotgun was stolen. NCA and regional police investigated; the company went into liquidation","source_url":"https://www.theregister.com/2021/08/31/guntrader_breach_csv_danger/","more_sources":["https://www.theregister.com/2021/07/23/guntrader_hacked_111k_users_sql_database/","https://www.theregister.com/2021/09/07/guntrader_hack_perp_interview/","https://www.theregister.com/2021/10/29/guntrader_liquidators_order/","https://www.policeprofessional.com/news/precise-location-of-more-than-110000-gun-owners-published-online/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","phone","email","ip_address","location","credentials"],"aftermath_tags":["publication"],"via":null,"country":"United Kingdom","scale":111295,"related_attack_ids":[]},{"id":72,"slug":"2021-07-france-dgsi-officer-police-files","when":"Up to Sep 2018, sentenced Jul 2021","sort_date":"2021-07","sector":"gov","sector_label":"Government","who":"French police files, searched by an officer of the DGSI domestic intelligence agency","who_link":"French police files","what_left":"Phone records, GPS coordinates and bank documents on specific individuals","how":"The officer ran searches unrelated to his work and sold the results on the darknet for 100 to 300 euros each, paid in bitcoin","then":"A Marseille client used the information to trace individuals, some of whom were later found dead, per AFP; officer jailed for five years, raised to seven for corruption [on appeal](https://www.brut.media/fr/articles/peine-alourdie-en-appel-pour-un-ex-agent-de-la-dgsi-qui-vendait-des-informations-sur-le-darknet); under investigation since 2020 over the preparation of nine homicides","source_url":"https://www.thelocal.fr/20210722/french-ex-spy-jailed-for-selling-police-data-on-darknet","more_sources":["https://www.brut.media/fr/articles/peine-alourdie-en-appel-pour-un-ex-agent-de-la-dgsi-qui-vendait-des-informations-sur-le-darknet","https://www.brut.media/fr/articles/cinq-ans-de-prison-requis-a-marseille-contre-haurus-ex-agent-de-la-dgsi","https://next.ink/brief-article/dark-web-le-parquet-de-marseille-demande-le-renvoi-dhaurus-devant-le-tribunal-correctionnel/"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["location","bank_account"],"aftermath_tags":["sale","physical_attack"],"via":null,"country":"France","scale":null,"related_attack_ids":[]},{"id":106,"slug":"2021-07-estonia-id-photos","when":"Jul 2021","sort_date":"2021-07","sector":"gov","sector_label":"Government","who":"Estonia's state identity document photo database, run by the Information System Authority (RIA)","who_link":"Information System Authority (RIA)","what_left":"286,438 government ID photos; the attacker already held the names and personal identification codes needed to request them","how":"A flaw in an RIA application that did not sufficiently check the validity of queries","then":"A Tallinn man was arrested on 23 July 2021; officials said they did not believe the photos had been passed on; RIA notified everyone affected by email","source_url":"https://therecord.media/estonia-says-a-hacker-downloaded-286000-id-photos-from-government-database","more_sources":[],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["id_document","name","national_id"],"aftermath_tags":[],"via":null,"country":"Estonia","scale":286438,"related_attack_ids":[]},{"id":47,"slug":"2021-04-upstox","when":"Apr 2021","sort_date":"2021-04","sector":"bank","sector_label":"Finance","who":"Upstox, stockbroker, India","who_link":"Upstox","what_left":"About 2.5 million users: names, email addresses, dates of birth, bank account information, PAN numbers, passport details; reports cite 56 million KYC files","how":"Upstox said contact data and KYC details may have been compromised from third-party data-warehouse systems; the attackers reportedly used Amazon AWS keys","then":"Attackers sought a $1.2 million ransom and released a sample of 100,000 users' data; Upstox reset passwords and restricted access to the database","source_url":"https://www.medianama.com/2021/04/223-upstox-data-breach/","more_sources":["https://inc42.com/buzz/upstox-tiptoes-around-data-breach-impacting-2-5-mn-users-but-upgrades-security-system/","https://thehackernews.com/2021/04/indian-brokerage-firm-upstox-suffers.html"],"leak_type":"theft","vector":"third_party","verification":"reported","data_types":["name","email","dob","bank_account","national_id","id_document"],"aftermath_tags":["extortion","publication"],"via":null,"country":"India","scale":2500000,"related_attack_ids":[]},{"id":101,"slug":"2021-03-mobikwik","when":"Mar 2021","sort_date":"2021-03","sector":"bank","sector_label":"Finance","who":"MobiKwik, mobile payments firm, India","who_link":"MobiKwik","what_left":"Claimed: 8.2 terabytes of data on nearly 100 million users, with KYC records (Aadhaar card or PAN ID) of 3.5 million; also phone numbers, email addresses, scrambled passwords, transaction logs and partial card numbers. TechCrunch verified the data in several cases","how":"Not established. MobiKwik said \"it is incorrect to suggest that the data available on the darkweb has been accessed from MobiKwik\" and that its security protocols were not breached","then":"Access to the database offered on a cybercrime forum for 1.2 bitcoin, about $70,000; MobiKwik commissioned a forensic audit and threatened legal action against the researcher who reported it","source_url":"https://techcrunch.com/2021/03/30/mobikwik-investigating-data-breach-after-100m-user-records-found-online/","more_sources":["https://thehackernews.com/2021/03/mobikwik-suffers-major-breach-kyc-data.html"],"leak_type":"unknown","vector":"undisclosed","verification":"disputed","data_types":["phone","email","credentials","transactions","bank_account","id_document"],"aftermath_tags":["sale"],"via":null,"country":"India","scale":100000000,"related_attack_ids":[]},{"id":73,"slug":"2021-01-ggd-coronavirus-systems","when":"Jan 2021","sort_date":"2021-01","sector":"gov","sector_label":"Government","who":"GGD, Dutch municipal health services, coronavirus test and contact-tracing systems","who_link":"GGD","what_left":"Names, addresses and citizen service numbers (BSN). Total not known: RTL Nieuws saw a set covering hundreds of people; the court found 62 photos of records and a spreadsheet of 36 people with one call-centre worker","how":"Call-centre staff who scheduled coronavirus tests looked people up and shared the records; one placed 230 adverts offering addresses and BSN numbers","then":"Offered on Telegram, Snapchat and Wickr; [two workers convicted](https://www.rechtspraak.nl/organisatie-en-contact/organisatie/rechtbanken/rechtbank-midden-nederland/nieuws/2021/09/veroordelingen-voor-datadiefstal-ggd) in September 2021; one had passed on details of two crime journalists known to be under serious threat","source_url":"https://nos.nl/l/2365961","more_sources":["https://www.rechtspraak.nl/organisatie-en-contact/organisatie/rechtbanken/rechtbank-midden-nederland/nieuws/2021/09/veroordelingen-voor-datadiefstal-ggd","https://nos.nl/l/2366518"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["name","address","national_id"],"aftermath_tags":["sale"],"via":null,"country":"Netherlands","scale":null,"related_attack_ids":[]},{"id":74,"slug":"2021-01-ledger-shopify-support-staff","when":"Apr and Jun 2020, disclosed Jan 2021","sort_date":"2021-01","sector":"crypto","sector_label":"Crypto","who":"Ledger, via e-commerce provider Shopify","who_link":"Ledger","what_left":"Approximately 292,000 customers' transactional records, per Ledger: email, name, postal address, products ordered and phone number. About 20,000 were not in Ledger's earlier leak","how":"Rogue member(s) of Shopify's support team exported customer transactional records; a US indictment says a support contractor was [paid in cryptocurrency](https://techcrunch.com/2021/04/05/shopify-breach-hacker-indicted/)","then":"Shopify told Ledger on 23 December 2020; French data protection authority notified; customers emailed on 13 January 2021; investigation by the FBI and the RCMP","source_url":"https://www.ledger.com/blog/update-efforts-to-protect-your-data-and-prosecute-the-scammers","more_sources":["https://techcrunch.com/2020/09/23/shopify-data-merchant-breach/","https://techcrunch.com/2021/04/05/shopify-breach-hacker-indicted/","https://decrypt.co/53961/bitcoin-wallet-ledger-discovers-full-extent-hack","https://betakit.com/ledger-one-of-small-number-of-additional-shopify-merchants-found-to-have-been-affected-by-2020-data-breach/"],"leak_type":"insider","vector":"bribed_insider","verification":"confirmed","data_types":["email","name","address","phone","order_history"],"aftermath_tags":[],"via":"Shopify","country":null,"scale":292000,"related_attack_ids":[]},{"id":29,"slug":"2020-ledger","when":"2020","sort_date":"2020","sector":"crypto","sector_label":"Crypto","who":"Ledger, hardware wallet vendor","who_link":"Ledger","what_left":"272,000 names, phone numbers and home addresses; about 1 million email addresses","how":"E-commerce database, third-party API key","then":"Emails threatening home visits; tampered \"replacement\" devices posted to leaked addresses in 2021. A US class action claiming users lost cryptocurrency to phishing after the leak was dismissed in November 2021 for lack of jurisdiction","source_url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/hacker-publishes-stolen-email-and-mailing-addresses-of-270000-ledger-cryptocurrency-wallet-users","more_sources":["https://betakit.com/shopify-ledger-dodge-class-action-as-california-court-dismisses-2020-data-breach-lawsuit/","https://decrypt.co/52136/ledger-customers-now-getting-threatening-emails-for-bitcoin-ransoms"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","phone","address","email"],"aftermath_tags":["publication","phishing","physical_threat"],"via":null,"country":"France","scale":1000000,"related_attack_ids":[]},{"id":49,"slug":"2020-08-kreditplus","when":"Jul 2020, reported Aug 2020","sort_date":"2020-08","sector":"bank","sector_label":"Finance","who":"KreditPlus, vehicle and equipment financing company, Indonesia","who_link":"KreditPlus","what_left":"About 896,000 customer records, per reports: names, national ID (KTP) numbers, email addresses, passwords, addresses, phone numbers, employment details, details of guarantor family members","how":"Not disclosed. KreditPlus said its preliminary investigation showed data theft by unauthorised third parties","then":"Sold on a criminal forum; the regulator OJK and the communications ministry asked KreditPlus for an explanation; KreditPlus said it would report to the national cyber agency BSSN","source_url":"https://sumbar.antaranews.com/berita/377162/kreditplus-akui-ada-pencurian-data-konsumen","more_sources":["https://www.cnnindonesia.com/ekonomi/20200805070924-78-532247/kreditplus-temukan-dugaan-pencurian-data-oleh-pihak-ketiga","https://www.cnnindonesia.com/ekonomi/20200804131347-78-531949/ojk-konfirmasi-kreditplus-soal-dugaan-kebocoran-data-nasabah","https://katadata.co.id/digital/fintech/5f2962622d9fb/kominfo-minta-kreditplus-klarifikasi-bocornya-ribuan-data-nasabah"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","email","credentials","address","phone","employment","family"],"aftermath_tags":["sale"],"via":null,"country":"Indonesia","scale":896000,"related_attack_ids":[]},{"id":48,"slug":"2020-07-dave-waydev","when":"Jul 2020","sort_date":"2020-07","sector":"bank","sector_label":"Finance","who":"Dave, banking app, via former analytics vendor Waydev","who_link":"Dave","what_left":"7,516,691 user records: names, emails, dates of birth, home addresses, phone numbers, encrypted Social Security numbers, bcrypt password hashes","how":"Breach at Waydev, a former third-party service provider, gave access to Dave user data","then":"Auctioned for about $16,000, then released free on a hacker forum on 24 July 2020; passwords reset and customers notified","source_url":"https://www.bleepingcomputer.com/news/security/dave-data-breach-affects-75-million-users-leaked-on-hacker-forum/","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","email","dob","address","phone","national_id","credentials"],"aftermath_tags":["sale","publication"],"via":"Waydev","country":null,"scale":7516691,"related_attack_ids":[]},{"id":86,"slug":"2020-06-coincheck-registrar","when":"Jun 2020","sort_date":"2020-06","sector":"crypto","sector_label":"Crypto","who":"Coincheck, crypto exchange, via its domain registration service","who_link":"Coincheck","what_left":"Around 200 customers who emailed the exchange between 31 May and 1 June: name, registered address, birth date, phone number and selfie ID","how":"A third party got into Coincheck's account at its domain registration service and read incoming customer emails","then":"Remittance service suspended; Coincheck reported no impact on customers' assets","source_url":"https://www.theblock.co/linked/67278/","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","address","dob","phone","selfie","email"],"aftermath_tags":[],"via":null,"country":null,"scale":200,"related_attack_ids":[]},{"id":30,"slug":"2020-05-blockfi","when":"May 2020","sort_date":"2020-05","sector":"crypto","sector_label":"Crypto","who":"BlockFi, crypto lender","who_link":"BlockFi","what_left":"Names, dates of birth, postal addresses and activity histories of retail clients. BlockFi said ID scans, social security numbers and bank details were not accessed","how":"SIM swap of an employee's phone number on 14 May 2020 gave the attacker just over an hour inside the back-office system","then":"The attacker tried to withdraw client funds and failed. BlockFi client data left again through HubSpot in 2022 and through Kroll in 2023","source_url":"https://www.coindesk.com/markets/2020/05/19/blockfi-says-hacker-sim-swapped-employees-phone-no-funds-were-lost","more_sources":[],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","dob","address","transactions"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":174,"slug":"2019-11-cayman-national-isle-of-man","when":"2016, published Nov 2019","sort_date":"2019-11","sector":"bank","sector_label":"Finance","who":"Cayman National Bank and Trust, Isle of Man","who_link":"Cayman National Bank and Trust, Isle of Man","what_left":"Documents and emails of the offshore bank and its sister trust company; the hacker claims to have published 2TB of confidential data","how":"Hacked by a self-described hacktivist who says the intrusion took place in 2016; the bank confirmed a \"data theft\" by a \"criminal hacking group\"","then":"Files passed to a transparency site and published; criminal investigation opened; the bank said it found no evidence of financial loss to customers","source_url":"https://vice.com/en/article/offshore-bank-targeted-phineas-fisher-confirms-hack-cayman-national-bank","more_sources":["https://www.iomtoday.co.im/news/999/inquiry-into-data-theft-at-bank-231605"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["messages"],"aftermath_tags":["publication"],"via":null,"country":"Isle of Man","scale":null,"related_attack_ids":[]},{"id":175,"slug":"2019-11-gatehub","when":"Nov 2019","sort_date":"2019-11","sector":"crypto","sector_label":"Crypto","who":"GateHub, crypto wallet service","who_link":"GateHub","what_left":"1.4 million accounts: email addresses and hashed passwords, per the researcher who reviewed the file; the poster also claimed two-factor keys, mnemonic phrases and wallet hashes, which GateHub officials dispute","how":"Not disclosed; GateHub had been hacked in June 2019, when 18,473 encrypted accounts were accessed, and the link between the two is unknown","then":"Posted on a hacking forum; the researcher checked a sample of addresses and found them all registered with the service","source_url":"https://decrypt.co/11813/gatehub-crypto-wallet-hack-exposes-1-4-million-users","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"reported","data_types":["email","credentials","wallet"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":1400000,"related_attack_ids":[]},{"id":76,"slug":"2019-10-queensland-police-address-lookup","when":"Jul 2013 to Jul 2014, sentenced Oct 2019","sort_date":"2019-10","sector":"gov","sector_label":"Government","who":"Queensland Police Service, Australia","who_link":"Queensland Police Service","what_left":"Home address and other details of one woman","how":"A senior constable looked her up in two confidential police computer systems and sent the details to her estranged husband, a childhood friend of his","then":"The woman, who maintained she was a victim of domestic violence, was forced to move; the officer pleaded guilty to nine counts and got two months' jail, wholly suspended, restored on appeal in August 2021","source_url":"https://www.qlsproctor.com.au/2021/08/court-reinstates-suspended-jail-term-for-officer-who-leaked-dv-victims-address/","more_sources":[],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["address"],"aftermath_tags":[],"via":null,"country":"Australia","scale":1,"related_attack_ids":[]},{"id":77,"slug":"2019-10-sberbank-card-data","when":"Aug 2019, reported Oct 2019","sort_date":"2019-10","sector":"bank","sector_label":"Finance","who":"Sberbank, Russia","who_link":"Sberbank","what_left":"Sberbank confirmed data of \"at least 200 clients\". Claimed: the seller advertised records of up to 60 million credit cards, with personal details such as place of employment","how":"Sberbank said the most likely explanation was the deliberate criminal action of an employee, since the database is isolated from external networks","then":"Offered for sale on a black-market site; a sample of about 200 records verified by security firm DeviceLock, and Kommersant found its own journalists' card details in the data","source_url":"https://www.themoscowtimes.com/2019/10/03/sberbank-hit-by-huge-data-breach-a67570","more_sources":[],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["bank_account","employment"],"aftermath_tags":["sale"],"via":null,"country":"Russia","scale":60000000,"related_attack_ids":[]},{"id":171,"slug":"2019-09-novaestrat-ecuador","when":"Sep 2019","sort_date":"2019-09","sector":"other","sector_label":"Other","who":"Novaestrat, data analytics company, Ecuador","who_link":"Novaestrat","what_left":"Approximately 20.8 million records on Ecuadorian citizens: names, national ID numbers, places of birth, home addresses; 7 million financial records with account status and balance from a state-owned bank; 2.5 million car owner records","how":"Elasticsearch server left open; found by vpnMentor researchers, who traced it to Novaestrat","then":"Secured after Ecuador's computer emergency team was contacted; no copying by others reported in the source","source_url":"https://www.zdnet.com/article/database-leaks-data-on-most-of-ecuadors-citizens-including-6-7-million-children/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","national_id","address","location","balance","employment","wealth"],"aftermath_tags":[],"via":null,"country":"Ecuador","scale":20800000,"related_attack_ids":[]},{"id":195,"slug":"2019-08-chile-voter-records","when":"Aug 2019","sort_date":"2019-08","sector":"gov","sector_label":"Government","who":"Chilean voter records from the Electoral Service (Servel), on a server Servel says it does not own","who_link":"Electoral Service (Servel)","what_left":"Names, home addresses, gender, age and tax ID numbers (RUT) of 14,308,151 people, nearly 80% of Chile's population","how":"Elasticsearch database open to the internet on a US hosting provider's network","then":"Servel confirmed the data was authentic and dated from 2017, and denied owning the server","source_url":"https://www.zdnet.com/article/voter-records-for-80-of-chiles-population-left-exposed-online/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","address","national_id"],"aftermath_tags":[],"via":null,"country":"Chile","scale":14308151,"related_attack_ids":[]},{"id":169,"slug":"2019-07-capital-one","when":"Mar 2019, disclosed Jul 2019","sort_date":"2019-07","sector":"bank","sector_label":"Finance","who":"Capital One","who_link":"Capital One","what_left":"Approximately 100 million people in the United States and approximately 6 million in Canada: names, addresses, phone numbers, email addresses, dates of birth, self-reported income, credit scores, limits, balances and payment history; about 140,000 Social Security numbers, about 80,000 linked bank account numbers, approximately 1 million Canadian Social Insurance Numbers","how":"An outside individual got in on 22 and 23 March 2019 through a [misconfigured web application firewall](https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arrested-data-theft-involving-large-financial-services-company) and posted about the theft on GitHub","then":"A GitHub user alerted Capital One on 17 July; a suspect was arrested on 29 July; Capital One said there was no evidence the data was used for fraud or shared","source_url":"https://www.capitalone.com/digital/facts2019/","more_sources":["https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arrested-data-theft-involving-large-financial-services-company"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","address","phone","email","dob","wealth","balance","transactions","national_id","bank_account"],"aftermath_tags":[],"via":null,"country":"United States","scale":100000000,"related_attack_ids":[]},{"id":197,"slug":"2019-07-bulgaria-national-revenue-agency","when":"Jun 2019, disclosed Jul 2019","sort_date":"2019-07","sector":"gov","sector_label":"Government","who":"National Revenue Agency, Bulgaria's tax office","who_link":"National Revenue Agency","what_left":"Records of nearly every adult among Bulgaria's seven million people: names of millions of people and companies, with information on incomes, tax declarations, health insurance payments and loans","how":"Hack at the end of June 2019 that compromised about three percent of the tax agency's database","then":"A person claiming responsibility emailed local media; a 20-year-old cybersecurity worker was arrested and charged. The data protection commission fined the agency, and a Sofia court [upheld the 2.6 million euro fine](https://bnrnews.bg/en/post/96652/national-revenue-agency-will-have-to-pay-a-eur-26-million-fine-for-personal-data-leak) in November 2023","source_url":"https://www.aljazeera.com/news/2019/7/17/wizard-arrested-after-hack-of-most-bulgarian-taxpayers-details","more_sources":["https://bnrnews.bg/en/post/96652/national-revenue-agency-will-have-to-pay-a-eur-26-million-fine-for-personal-data-leak"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","wealth"],"aftermath_tags":["publication"],"via":null,"country":"Bulgaria","scale":null,"related_attack_ids":[]},{"id":78,"slug":"2019-05-desjardins","when":"Mar 2017 to May 2019","sort_date":"2019-05","sector":"bank","sector_label":"Finance","who":"Desjardins, financial cooperative, Canada","who_link":"Desjardins","what_left":"Close to 9.7 million people: first and last names, dates of birth, social insurance numbers, home addresses, phone numbers, email addresses and transaction histories","how":"An employee in the marketing department copied the data from a shared drive to his work computer and then to USB keys over at least 26 months","then":"Found by Laval police during a separate investigation, not by Desjardins; per media reports cited by the regulator, some of it was sold to a private lender and an advisor admitted paying $40,000 for member lists","source_url":"https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2020/pipeda-2020-005/","more_sources":[],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["name","dob","national_id","address","phone","email","transactions"],"aftermath_tags":["sale"],"via":null,"country":"Canada","scale":9700000,"related_attack_ids":[]},{"id":167,"slug":"2019-05-first-american-financial","when":"May 2019","sort_date":"2019-05","sector":"bank","sector_label":"Finance","who":"First American Financial, title insurer","who_link":"First American Financial","what_left":"Approximately 885 million files dating back more than 16 years: mortgage and title records with bank account details, wire transaction receipts, Social Security numbers and driver's licence images","how":"Any document on the company's website could be read without a login by changing a digit in its web address; First American called it a \"design defect\"","then":"SEC found the company's security staff had known of the flaw for months; First American paid a $487,616 penalty in Jun 2021","source_url":"https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/","more_sources":["https://www.sec.gov/news/press-release/2021-102"],"leak_type":"exposure","vector":"software_flaw","verification":"confirmed","data_types":["bank_account","transactions","national_id","id_document","wealth"],"aftermath_tags":[],"via":null,"country":"United States","scale":885000000,"related_attack_ids":[]},{"id":163,"slug":"2019-01-ascension-mortgage-documents","when":"Jan 2019","sort_date":"2019-01","sector":"bank","sector_label":"Finance","who":"Ascension, data and analytics firm for lenders, holding loan files from US banks","who_link":"Ascension","what_left":"More than 24 million loan and mortgage documents covering tens of thousands of loans: names, addresses, birth dates, Social Security numbers, bank account numbers, loan agreements and tax forms","how":"Elasticsearch server left open; a vendor's \"server configuration error\", per Ascension's parent company","then":"Believed exposed for two weeks; shut down on 15 January after a researcher and TechCrunch contacted the banks","source_url":"https://techcrunch.com/2019/01/23/financial-files/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"confirmed","data_types":["name","address","dob","national_id","bank_account","wealth"],"aftermath_tags":[],"via":null,"country":"United States","scale":24000000,"related_attack_ids":[]},{"id":164,"slug":"2019-01-state-bank-of-india","when":"Jan 2019","sort_date":"2019-01","sector":"bank","sector_label":"Finance","who":"State Bank of India","who_link":"State Bank of India","what_left":"Two months of text messages to customers of the SBI Quick service: phone numbers, bank balances, recent transactions and partial account numbers, on millions of customers","how":"Server in a Mumbai data centre with no password","then":"Secured after a researcher told TechCrunch; the bank did not comment before publication","source_url":"https://techcrunch.com/2019/01/30/state-bank-india-data-leak/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["phone","balance","transactions","bank_account"],"aftermath_tags":[],"via":null,"country":"India","scale":null,"related_attack_ids":[]},{"id":161,"slug":"2018-11-hsbc-usa","when":"Oct 2018, disclosed Nov 2018","sort_date":"2018-11","sector":"bank","sector_label":"Finance","who":"HSBC Bank USA","who_link":"HSBC Bank USA","what_left":"Full names, mailing addresses, phone numbers, email addresses, dates of birth, account numbers, account types, balances, transaction histories, payee account information and statement histories; number of customers not disclosed","how":"Online accounts accessed by unauthorised users between 4 and 14 October 2018; reported as consistent with reused passwords from other breaches","then":"HSBC suspended online access for affected customers and notified them through a letter filed with California authorities","source_url":"https://www.zdnet.com/article/hsbc-discloses-security-incident/","more_sources":[],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","address","phone","email","dob","bank_account","balance","transactions"],"aftermath_tags":[],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":180,"slug":"2018-11-marriott-starwood","when":"Nov 2018","sort_date":"2018-11","sector":"other","sector_label":"Other","who":"Marriott, Starwood guest reservations database","who_link":"Marriott","what_left":"Approximately 5.25 million unencrypted passport numbers and approximately 20.3 million encrypted ones, in up to approximately 383 million guest records; approximately 8.6 million encrypted payment cards","how":"Unauthorised access to the Starwood guest reservations database, determined by Marriott on 19 November 2018; the release read does not say how","then":"Marriott set up a way for guests to look up whether their passport number was in the unencrypted set. Marriott said there was no evidence the master key for the encrypted numbers was accessed","source_url":"https://news.marriott.com/news/2019/01/04/marriott-provides-update-on-starwood-database-security-incident","more_sources":["https://web.archive.org/web/2019/https://news.marriott.com/2019/01/marriott-provides-update-on-starwood-database-security-incident/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["id_document","bank_account"],"aftermath_tags":[],"via":null,"country":"United States","scale":383000000,"related_attack_ids":[]},{"id":182,"slug":"2018-10-cathay-pacific","when":"Mar 2018, disclosed Oct 2018","sort_date":"2018-10","sector":"other","sector_label":"Other","who":"Cathay Pacific and Hong Kong Dragon Airlines","who_link":"Cathay Pacific","what_left":"Personal data of approximately 9.4 million passengers from over 260 countries and jurisdictions: mainly name, flight number and date, email address, membership number, address and phone number","how":"Attackers used a known vulnerability in an internet-facing server whose administrator console was exposed; unencrypted database backup files had been produced for a data centre move","then":"Suspicious activity detected on 13 March 2018; the regulator and passengers were told in October. Hong Kong's Privacy Commissioner found data security and retention breaches and served an enforcement notice in June 2019","source_url":"https://web.archive.org/web/2019/https://www.pcpd.org.hk/english/news_events/media_statements/press_20190606.html","more_sources":["https://www.pcpd.org.hk/english/news_events/media_statements/press_20190606.html"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","address","email","phone","account_id"],"aftermath_tags":[],"via":null,"country":"Hong Kong","scale":9400000,"related_attack_ids":[]},{"id":152,"slug":"2018-09-voya-financial-advisors","when":"Apr 2016, SEC order Sep 2018","sort_date":"2018-09","sector":"bank","sector_label":"Finance","who":"Voya Financial Advisors, broker-dealer and investment adviser","who_link":"Voya Financial Advisors","what_left":"Approximately 5,600 customers: address, date of birth, last four digits of the Social Security number and email address; a full Social Security or other government ID number viewed for at least 2,000 of them","how":"Callers impersonating the firm's contractors phoned its support line over six days in April 2016 and had the contractors' passwords reset, then logged in to a customer management system","then":"Intruders used the data to create new online customer profiles; the firm paid a $1 million SEC penalty","source_url":"https://www.sec.gov/news/press-release/2018-213","more_sources":["https://www.sec.gov/litigation/admin/2018/34-84288.pdf"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["address","dob","national_id","email"],"aftermath_tags":["impersonation"],"via":null,"country":"United States","scale":5600,"related_attack_ids":[]},{"id":160,"slug":"2018-08-atlas-quantum","when":"Aug 2018","sort_date":"2018-08","sector":"crypto","sector_label":"Crypto","who":"Atlas Quantum, crypto investment platform, Brazil","who_link":"Atlas Quantum","what_left":"Over 264,000 users: email addresses, phone numbers and the amounts of cryptocurrency they held on the platform","how":"Not disclosed; the company told users on Facebook that the platform had been hacked","then":"Company said user funds were safe; a Brazilian YouTube channel first reported the leak and said 14,500 of the records carried deposit figures","source_url":"https://www.hackread.com/brazilian-crypto-exchange-hacked-data-users-exposed/","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["email","phone","balance"],"aftermath_tags":[],"via":null,"country":"Brazil","scale":264000,"related_attack_ids":[]},{"id":183,"slug":"2018-07-singhealth","when":"Jun to Jul 2018","sort_date":"2018-07","sector":"gov","sector_label":"Government","who":"SingHealth, Singapore's public healthcare group","who_link":"SingHealth","what_left":"Name, NRIC number, address, gender, race and date of birth of about 1.5 million patients; outpatient medicine records of about 160,000 of them, including the Prime Minister's","how":"Cyberattack on a patient database, with data copied out from 27 June to 4 July 2018. The government called it deliberate, targeted and not the work of casual hackers or criminal gangs","then":"Police report lodged on 12 July; all patients told by SMS whether their data was taken. The attackers specifically and repeatedly targeted the Prime Minister's records","source_url":"https://www.moh.gov.sg/news-highlights/details/singhealth%27s-it-system-target-of-cyberattack","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","address","dob"],"aftermath_tags":[],"via":null,"country":"Singapore","scale":1500000,"related_attack_ids":[]},{"id":193,"slug":"2018-06-exactis","when":"Jun 2018","sort_date":"2018-06","sector":"other","sector_label":"Other","who":"Exactis, US data broker","who_link":"Exactis","what_left":"Close to 340 million records, about 230 million on consumers and 110 million on business contacts: phone numbers, home addresses, email addresses and more than 400 characteristics per person, including religion and the number, age and gender of children","how":"Database left on a publicly reachable server, found by a researcher scanning for open Elasticsearch databases","then":"The researcher told Exactis and the FBI, and says the company then protected the data. Exactis did not answer the reporter's requests for comment","source_url":"https://www.wired.com/story/exactis-database-leak-340-million-records/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","address","phone","email","family"],"aftermath_tags":[],"via":null,"country":"United States","scale":340000000,"related_attack_ids":[]},{"id":159,"slug":"2018-05-bmo-simplii","when":"May 2018","sort_date":"2018-05","sector":"bank","sector_label":"Finance","who":"Bank of Montreal and Simplii Financial, Canada","who_link":"Bank of Montreal and Simplii Financial","what_left":"Identifying personal information of a combined 90,000 account holders; the thieves said it covered names, account numbers, passwords, security questions and answers, social insurance numbers and balances","how":"Not disclosed by the banks; the thieves' email said they exploited weaknesses in the two banks' security systems","then":"Thieves demanded a $1 million ransom and threatened to release the data; a list with details of 100 BMO customers circulated online and several of them confirmed it as accurate to CBC","source_url":"https://www.cbc.ca/1.4682018","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","phone","dob","bank_account","national_id","balance","credentials"],"aftermath_tags":["extortion","publication"],"via":null,"country":"Canada","scale":90000,"related_attack_ids":[]},{"id":200,"slug":"2017-12-alteryx-experian-consumerview","when":"Oct 2017, disclosed Dec 2017","sort_date":"2017-12","sector":"other","sector_label":"Other","who":"Alteryx, data analytics firm, holding Experian's ConsumerView marketing file","who_link":"Alteryx","what_left":"Experian's ConsumerView file on 123 million American households, 248 fields per household: home addresses and contact information, mortgage ownership and financial histories, purchasing behaviour","how":"Amazon S3 storage bucket left publicly readable, found by a researcher on 6 October 2017","then":"Alteryx secured the bucket when notified. No sale or publication reported in the source","source_url":"https://www.upguard.com/breaches/cloud-leak-alteryx","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["address","phone","wealth","order_history"],"aftermath_tags":[],"via":"Alteryx","country":"United States","scale":123000000,"related_attack_ids":[]},{"id":158,"slug":"2017-11-appleby-paradise-papers","when":"2016, published Nov 2017","sort_date":"2017-11","sector":"other","sector_label":"Other","who":"Appleby, offshore law firm, Bermuda","who_link":"Appleby","what_left":"About 6.8 million documents from Appleby and its former corporate services arm Estera, within the 13.4 million Paradise Papers; the client register carried more than 31,000 US addresses and more than 14,000 UK addresses, per the BBC","how":"Appleby said it was \"not the subject of a leak but of a serious criminal act\", an \"illegal computer hack\", and that no one working at the firm was involved; the newspaper that received the files has not named its source","then":"Published as the Paradise Papers by news organisations in 67 countries; Appleby said its forensic investigation found no definitive evidence that data had left its systems","source_url":"https://www.theregister.co.uk/2017/11/06/paradise_papers/","more_sources":["https://www.bbc.com/news/world-41880153","https://bernews.com/2017/11/appleby-reaction-media-coverage/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","wealth"],"aftermath_tags":["publication"],"via":null,"country":"Bermuda","scale":6800000,"related_attack_ids":[]},{"id":181,"slug":"2017-11-uber-2016-breach","when":"2016, disclosed Nov 2017","sort_date":"2017-11","sector":"other","sector_label":"Other","who":"Uber","who_link":"Uber","what_left":"Names and driver's licence numbers of around 600,000 US drivers; names, email addresses and mobile phone numbers of 57 million users","how":"Two outsiders downloaded files from a third-party cloud service Uber used, then demanded a ransom","then":"Uber paid the two $100,000 in bitcoin in December 2016 against non-disclosure agreements and told neither users nor regulators until November 2017. Both later pleaded guilty; Uber's former security chief was [convicted in October 2022](https://web.archive.org/web/2023/https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-convicted-federal-charges-covering-data-breach) of covering the breach up","source_url":"https://web.archive.org/web/2020/https://www.uber.com/newsroom/2016-data-incident/","more_sources":["https://www.uber.com/newsroom/2016-data-incident/","https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-convicted-federal-charges-covering-data-breach"],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["name","id_document","email","phone"],"aftermath_tags":["extortion"],"via":null,"country":"United States","scale":57000000,"related_attack_ids":[]},{"id":157,"slug":"2017-10-south-africa-master-deeds","when":"Oct 2017","sort_date":"2017-10","sector":"other","sector_label":"Other","who":"Jigsaw Holdings, South Africa, \"Master Deeds\" file","who_link":"Jigsaw Holdings","what_left":"66,360,837 records, 60,323,827 with a unique government ID number: names, genders, ethnicities, ID numbers and home ownership","how":"A 27 GB database backup sat on a public web server with directory browsing switched on","then":"Still exposed seven months after it was first found; the file's last-modified date was early 2015, per the researcher","source_url":"https://www.troyhunt.com/questions-about-the-massive-south-african-master-deeds-data-breach-answered/","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","national_id","dob","wealth"],"aftermath_tags":[],"via":null,"country":"South Africa","scale":66360837,"related_attack_ids":[]},{"id":205,"slug":"2017-10-malaysia-mobile-operators","when":"2014, reported Oct 2017","sort_date":"2017-10","sector":"other","sector_label":"Other","who":"Malaysian mobile operators, including Celcom, Digi, Maxis and U Mobile","who_link":"Malaysian mobile operators, including Celcom, Digi, Maxis and U Mobile","what_left":"Roughly 46.2 million mobile numbers with customer details, addresses and SIM card information; separately, 81,309 records of three medical bodies with MyKad numbers and residential addresses","how":"Not disclosed. File timestamps show the data was last updated between May and July 2014","then":"A seller tried to offer the data on a Malaysian forum in October 2017; the site that reported it passed its findings to the communications regulator","source_url":"https://www.lowyat.net/2017/146339/personal-data-millions-malaysians-up-for-sale-source-breach-still-unknown/","more_sources":[],"leak_type":"unknown","vector":"undisclosed","verification":"reported","data_types":["name","address","phone","national_id"],"aftermath_tags":["sale"],"via":null,"country":"Malaysia","scale":46200000,"related_attack_ids":[]},{"id":201,"slug":"2017-08-chicago-voters-ess","when":"Aug 2017","sort_date":"2017-08","sector":"gov","sector_label":"Government","who":"Chicago Board of Election Commissioners, via voting machine firm Election Systems & Software","who_link":"Chicago Board of Election Commissioners","what_left":"Names, addresses, phone numbers, driver's licence numbers and partial Social Security numbers of 1.8 million Chicago voters","how":"Amazon S3 storage bucket owned by the vendor left publicly downloadable; found on 11 August 2017 and closed on 12 August","then":"Vendor secured the bucket when notified. No sale or publication reported in the source","source_url":"https://www.upguard.com/breaches/cloud-leak-chicago-voters","more_sources":[],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","address","phone","id_document","national_id"],"aftermath_tags":[],"via":"Election Systems & Software","country":"United States","scale":1864000,"related_attack_ids":[]},{"id":154,"slug":"2017-07-bithumb","when":"Feb 2017, disclosed Jul 2017","sort_date":"2017-07","sector":"crypto","sector_label":"Crypto","who":"Bithumb, crypto exchange, South Korea","who_link":"Bithumb","what_left":"Roughly 32,000 users, about 3 per cent of the user base: names, email addresses and mobile phone numbers","how":"An employee's home PC was hacked and used to extract user records; Bithumb said its internal systems were not compromised","then":"Callers posing as Bithumb executives phoned customers and talked some into giving up one-time passwords; accounts drained, one customer reportedly lost 10 million won; Bithumb promised 100,000 won to each affected member","source_url":"https://www.theregister.com/2017/07/06/bithumb_hack/","more_sources":["https://www.esecurityplanet.com/endpoint/byod-blamed-for-massive-cryptocurrency-breach.html"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","phone"],"aftermath_tags":["phishing","impersonation"],"via":null,"country":"South Korea","scale":32000,"related_attack_ids":[]},{"id":155,"slug":"2017-07-unicredit","when":"Sep 2016 to Jul 2017","sort_date":"2017-07","sector":"bank","sector_label":"Finance","who":"UniCredit, via an unnamed third-party provider","who_link":"UniCredit","what_left":"Approximately 400,000 loan customers in Italy: personal data and IBAN numbers \"might have been accessed\"","how":"Two intrusions through an unnamed third-party provider, in September and October 2016 and in June and July 2017","then":"UniCredit said no passwords or data allowing unauthorised transactions were affected","source_url":"https://www.theregister.com/2017/07/26/unicredit_bank_breach/","more_sources":[],"leak_type":"theft","vector":"third_party","verification":"confirmed","data_types":["bank_account"],"aftermath_tags":[],"via":null,"country":"Italy","scale":400000,"related_attack_ids":[]},{"id":153,"slug":"2017-04-wonga","when":"Apr 2017","sort_date":"2017-04","sector":"bank","sector_label":"Finance","who":"Wonga, payday lender","who_link":"Wonga","what_left":"Up to 270,000 current and former customers, including 245,000 in the UK: name, email address, home address, phone number, bank account number and sort code, last four digits of the card number","how":"Wonga reported \"illegal and unauthorised access\" to customer data and did not say where or how","then":"Customers in the UK and Poland warned","source_url":"https://www.theguardian.com/business/2017/apr/09/wonga-data-breach-could-affect-250000-uk-customers","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","address","phone","bank_account"],"aftermath_tags":[],"via":null,"country":null,"scale":270000,"related_attack_ids":[]},{"id":196,"slug":"2016-10-australian-red-cross-blood-service","when":"Oct 2016","sort_date":"2016-10","sector":"other","sector_label":"Other","who":"Australian Red Cross Blood Service, via its website contractor","who_link":"Australian Red Cross Blood Service","what_left":"Names, gender, addresses and dates of birth of 550,000 blood donors from 2010 to 2016, with answers on at-risk sexual behaviour","how":"A contractor that maintains the website posted an unsecured file with donor data online; an unauthorised person accessed it","then":"The person who found the file passed it to a security researcher, who reported it. The Blood Service said all known copies were deleted and the risk of misuse was low; donors were told by message","source_url":"https://www.abc.net.au/news/2016-10-28/red-cross-blood-service-admits-to-data-breach/7974036","more_sources":[],"leak_type":"exposure","vector":"third_party","verification":"confirmed","data_types":["name","address","dob"],"aftermath_tags":[],"via":null,"country":"Australia","scale":550000,"related_attack_ids":[]},{"id":150,"slug":"2016-04-mossack-fonseca-panama-papers","when":"Apr 2016","sort_date":"2016-04","sector":"other","sector_label":"Other","who":"Mossack Fonseca, offshore law firm, Panama","who_link":"Mossack Fonseca","what_left":"11.5 million records on 214,488 offshore entities: emails, financial spreadsheets, passports and corporate records naming the owners of companies and bank accounts, per ICIJ","how":"The firm's founding partner said it was hacked from outside and [ruled out an inside job](https://asiatimes.com/2016/04/panama-papers-law-firm-says-data-hack-came-from-outside/); the journalists say only that the records came from a confidential source","then":"Published as the Panama Papers by a consortium of news organisations; the firm filed a complaint with Panama's attorney general","source_url":"https://www.icij.org/investigations/panama-papers/20160403-panama-papers-global-overview/","more_sources":["https://asiatimes.com/2016/04/panama-papers-law-firm-says-data-hack-came-from-outside/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","id_document","wealth","messages"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":11500000,"related_attack_ids":[]},{"id":151,"slug":"2016-04-qatar-national-bank","when":"Apr 2016","sort_date":"2016-04","sector":"bank","sector_label":"Finance","who":"Qatar National Bank","who_link":"Qatar National Bank","what_left":"1.4 GB of internal files and customers' financial and personal data, including folders on members of Qatar's ruling family and on Al Jazeera staff","how":"QNB said its systems may have been hacked; a group with Turkish ties claimed the attack","then":"Posted online on 26 April; QNB said some of the data may be accurate but much was constructed from non-QNB sources; customers named in the leak confirmed that leaked logins worked","source_url":"https://www.bankinfosecurity.com/qnb-confirms-leak-downplays-damage-a-9082","more_sources":["https://www.hackread.com/qatar-national-bank-hacked-database-leaked/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","bank_account","transactions","credentials","phone","email"],"aftermath_tags":["publication"],"via":null,"country":null,"scale":null,"related_attack_ids":[]},{"id":185,"slug":"2016-04-turkey-citizen-database","when":"Apr 2016","sort_date":"2016-04","sector":"gov","sector_label":"Government","who":"Turkish state citizen records","who_link":"Turkish state citizen records","what_left":"Names, addresses, parents' first names, cities and dates of birth and national identifier numbers of about 50 million Turkish citizens. The data appears to date from 2008; the Associated Press verified entries as authentic","how":"Not disclosed. Turkey's government said the data had first leaked in 2010","then":"Posted online as a 1.4 gigabyte download with a political message, with the President's own entry shown on the page. The communications minister called the reports outdated","source_url":"https://www.wired.com/2016/04/hack-brief-turkey-breach-spills-info-half-citizens/","more_sources":["https://www.theregister.com/2016/04/04/turkey_megaleak/"],"leak_type":"unknown","vector":"undisclosed","verification":"reported","data_types":["name","address","dob","national_id","family"],"aftermath_tags":["publication"],"via":null,"country":"Turkey","scale":50000000,"related_attack_ids":[]},{"id":202,"slug":"2016-04-mexico-voter-roll","when":"Apr 2016","sort_date":"2016-04","sector":"gov","sector_label":"Government","who":"Mexican voter roll compiled by the National Electoral Institute (INE), copy on an Amazon cloud server","who_link":"National Electoral Institute (INE)","what_left":"Names, addresses, dates of birth and voter ID numbers; 93.4 million voters per the researcher's first report, 87 million per the BBC","how":"Database on an Amazon cloud server readable without a password, found by a researcher on 14 April 2016. The INE said the server was not its own","then":"Taken offline after the researcher reached Mexican election officials. The INE responded publicly and filed a complaint; political parties receive copies of the roll by right","source_url":"https://www.bbc.com/news/technology-36128745","more_sources":["https://web.archive.org/web/2016/https://www.databreaches.net/personal-info-of-93-4-million-mexicans-exposed-on-amazon/"],"leak_type":"exposure","vector":"open_storage","verification":"reported","data_types":["name","address","dob","national_id"],"aftermath_tags":[],"via":null,"country":"Mexico","scale":93400000,"related_attack_ids":[]},{"id":184,"slug":"2016-03-comelec-philippines","when":"Mar 2016","sort_date":"2016-03","sector":"gov","sector_label":"Government","who":"Commission on Elections (COMELEC), Philippines","who_link":"Commission on Elections","what_left":"Voter database of 75,302,683 records; overseas voter database of 1,376,067 records with passport number and expiry date, taxpayer identification number, addresses in the Philippines and abroad, and names of spouse and parents; a firearms ban database of 896,992 records","how":"Breach of the COMELEC website, where the databases were kept, between 20 and 27 March 2016","then":"The National Privacy Commission found COMELEC had violated the Data Privacy Act and recommended criminal prosecution of its chairman","source_url":"https://web.archive.org/web/2017/https://privacy.gov.ph/privacy-commission-finds-bautista-criminally-liable-for-comeleak-data-breach/","more_sources":["https://privacy.gov.ph/privacy-commission-finds-bautista-criminally-liable-for-comeleak-data-breach/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","address","id_document","national_id","family","email"],"aftermath_tags":[],"via":null,"country":"Philippines","scale":75302683,"related_attack_ids":[]},{"id":149,"slug":"2015-12-invest-bank-uae","when":"Nov to Dec 2015","sort_date":"2015-12","sector":"bank","sector_label":"Finance","who":"Invest Bank, Sharjah, United Arab Emirates","who_link":"Invest Bank","what_left":"Account statements of hundreds of customers, then tens of thousands of customer files; the hacker said the data covered names, credit card information and financial details","how":"Not disclosed; a bank executive confirmed a data breach","then":"Hacker demanded about $3 million in Bitcoin, the bank refused, and customer statements were tweeted and then posted as six zip files","source_url":"https://grahamcluley.com/bank-refuses-3-million-ransom-hacker-exposes-customer-account-details/","more_sources":["https://dailydot.com/invest-bank-hacker-buba"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","bank_account","transactions"],"aftermath_tags":["sale","extortion","publication"],"via":null,"country":"United Arab Emirates","scale":null,"related_attack_ids":[]},{"id":192,"slug":"2015-11-vtech","when":"Nov 2015","sort_date":"2015-11","sector":"other","sector_label":"Other","who":"VTech, maker of children's electronic toys","who_link":"VTech","what_left":"4,863,209 parent accounts with name, email address, mailing address, password and security question; 6,368,509 children's profiles with name, gender and birthdate","how":"Unauthorised party accessed the Learning Lodge customer database and related servers between 12 and 29 November 2015; VTech learned of it from a journalist","then":"VTech paid $650,000 in a 2018 [settlement with the US Federal Trade Commission](https://www.ftc.gov/news-events/news/press-releases/2018/01/electronic-toy-maker-vtech-settles-ftc-allegations-it-violated-childrens-privacy-law-ftc-act), which said the company had not taken reasonable steps to secure the data","source_url":"https://web.archive.org/web/2016/https://www.vtech.com/en/press_release/2015/faq-about-data-breach-on-vtech-learning-lodge/","more_sources":["https://www.vtech.com/en/press_release/2015/faq-about-data-breach-on-vtech-learning-lodge/","https://www.ftc.gov/news-events/news/press-releases/2018/01/electronic-toy-maker-vtech-settles-ftc-allegations-it-violated-childrens-privacy-law-ftc-act"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","email","address","dob","credentials","ip_address","order_history","family"],"aftermath_tags":[],"via":null,"country":null,"scale":6368509,"related_attack_ids":[]},{"id":147,"slug":"2015-10-experian-t-mobile","when":"Sep 2015, disclosed Oct 2015","sort_date":"2015-10","sector":"bank","sector_label":"Finance","who":"Experian, credit bureau, holding T-Mobile applicants' data","who_link":"Experian","what_left":"Approximately 15 million people who applied for T-Mobile financing: names, dates of birth, addresses, Social Security numbers and driver's licence numbers","how":"Intruders took a single file from an Experian server; the date they first got in is unclear","then":"Experian said no payment card or banking details were stolen and its consumer credit database was not touched; consumers notified by post","source_url":"https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","dob","address","national_id"],"aftermath_tags":[],"via":null,"country":null,"scale":15000000,"related_attack_ids":[]},{"id":148,"slug":"2015-10-scottrade","when":"Late 2013 to early 2014, disclosed Oct 2015","sort_date":"2015-10","sector":"bank","sector_label":"Finance","who":"Scottrade, retail brokerage","who_link":"Scottrade","what_left":"Client names and street addresses of 4.6 million customers; Social Security numbers were in the same system","how":"Unauthorised access to the brokerage's network; Scottrade learned of it from the FBI","then":"Scottrade said contact information appeared to be the focus and that no client funds or trading platforms were compromised","source_url":"https://krebsonsecurity.com/2015/10/scottrade-breach-hits-4-6-million-customers/","more_sources":[],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","national_id"],"aftermath_tags":[],"via":null,"country":null,"scale":4600000,"related_attack_ids":[]},{"id":189,"slug":"2015-10-talktalk","when":"Oct 2015","sort_date":"2015-10","sector":"other","sector_label":"Other","who":"TalkTalk, UK telecom","who_link":"TalkTalk","what_left":"Names, addresses, dates of birth, phone numbers and email addresses of 156,959 customers; bank account details and sort codes in 15,656 cases","how":"SQL injection against three vulnerable web pages in infrastructure inherited from TalkTalk's 2009 acquisition of Tiscali's UK operations, between 15 and 21 October 2015","then":"ICO fined TalkTalk a then record 400,000 pounds in October 2016","source_url":"https://web.archive.org/web/2016/https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/","more_sources":["https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","address","dob","phone","email","bank_account"],"aftermath_tags":[],"via":null,"country":"United Kingdom","scale":156959,"related_attack_ids":[]},{"id":194,"slug":"2015-08-ashley-madison","when":"Jul 2015, published Aug 2015","sort_date":"2015-08","sector":"other","sector_label":"Other","who":"Ashley Madison, dating site for extramarital affairs, run by Avid Life Media","who_link":"Ashley Madison","what_left":"Details of approximately 36 million user accounts; for paying users, real names, billing addresses and the last four digits of credit card numbers","how":"Intrusion that began with an employee's valid account credentials, detected on 12 July 2015; the attacker called itself The Impact Team","then":"Published on 18 and 20 August 2015. Users then received [emails demanding bitcoin](https://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-users/) under threat of telling family or employers. Toronto police said [two people linked to the leak were reported to have taken their lives](https://www.bbc.com/news/technology-34044506)","source_url":"https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2016/pipeda-2016-005/","more_sources":["https://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-users/","https://www.bbc.com/news/technology-34044506"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","address","bank_account","email","credentials","messages"],"aftermath_tags":["publication","extortion"],"via":null,"country":"Canada","scale":36000000,"related_attack_ids":[]},{"id":176,"slug":"2015-07-opm-background-investigations","when":"May 2015, announced Jul 2015","sort_date":"2015-07","sector":"gov","sector_label":"Government","who":"US Office of Personnel Management, background investigation files","who_link":"US Office of Personnel Management","what_left":"Social Security numbers and background investigation records of 21.5 million people: 19.7 million applicants and 1.8 million spouses or co-habitants. Records hold residency, employment, family, health, criminal and financial history; fingerprints of [approximately 5.6 million](https://web.archive.org/web/2015/https://www.opm.gov/news/releases/2015/09/cyber-statement-923/). Separately, personnel data of 4.2 million federal employees","how":"Intrusion into OPM's background investigation databases; the OPM release does not say how the attackers got in","then":"OPM and the Department of Defense offered identity theft monitoring to the 21.5 million; an interagency group was set up to review how the fingerprints could be misused","source_url":"https://web.archive.org/web/2015/https://www.opm.gov/news/releases/2015/07/opm-announces-steps-to-protect-federal-workers-and-others-from-cyber-threats/","more_sources":["https://www.opm.gov/news/releases/2015/07/opm-announces-steps-to-protect-federal-workers-and-others-from-cyber-threats/","https://web.archive.org/web/2015/https://www.opm.gov/news/releases/2015/09/cyber-statement-923/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","address","family","employment","wealth","selfie","credentials"],"aftermath_tags":[],"via":null,"country":"United States","scale":21500000,"related_attack_ids":[]},{"id":204,"slug":"2015-06-japan-pension-service","when":"May 2015, disclosed Jun 2015","sort_date":"2015-06","sector":"gov","sector_label":"Government","who":"Japan Pension Service","who_link":"Japan Pension Service","what_left":"1.25 million cases of pension IDs with names; birth dates in most cases, and addresses in some 52,000","how":"Staff opened an email attachment carrying a virus, which gave access to their computers","then":"Reported to Tokyo police on 19 May and announced on 1 June; affected people to get new pension ID numbers. Officials said the perpetrators might have changed addresses on file using the stolen data","source_url":"https://web.archive.org/web/2020/https://www.japantimes.co.jp/news/2015/06/01/national/crime-legal/japan-pension-system-hacked-1-25-million-cases-personal-data-leaked/","more_sources":["https://www.japantimes.co.jp/news/2015/06/01/national/crime-legal/japan-pension-system-hacked-1-25-million-cases-personal-data-leaked/"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","national_id","dob","address"],"aftermath_tags":[],"via":null,"country":"Japan","scale":1250000,"related_attack_ids":[]},{"id":177,"slug":"2015-05-irs-get-transcript","when":"Jan 2014 to May 2015","sort_date":"2015-05","sector":"gov","sector_label":"Government","who":"US Internal Revenue Service, Get Transcript application","who_link":"US Internal Revenue Service","what_left":"Tax transcripts of approximately 114,000 taxpayers, per the IRS in May 2015; another 220,000 identified in August 2015 and potential access to approximately 390,000 more found in February 2016. Transcripts carry tax return data; the account information included Social Security information, date of birth and street address","how":"Criminals used taxpayer information stolen elsewhere to pass the application's identity checks","then":"Application taken offline in May 2015; taxpayers notified and offered identity theft protection and Identity Protection PINs. The IRS said some access may have been aimed at filing fraudulent returns the following season","source_url":"https://www.irs.gov/newsroom/irs-statement-on-get-transcript","more_sources":["https://www.irs.gov/newsroom/irs-statement-on-the-get-transcript-application"],"leak_type":"theft","vector":"account_takeover","verification":"confirmed","data_types":["name","national_id","dob","address","wealth"],"aftermath_tags":[],"via":null,"country":"United States","scale":390000,"related_attack_ids":[]},{"id":186,"slug":"2015-01-anthem","when":"Dec 2014 to Jan 2015","sort_date":"2015-01","sector":"bank","sector_label":"Finance","who":"Anthem, US health insurer","who_link":"Anthem","what_left":"Names, Social Security numbers, medical identification numbers, addresses, dates of birth, email addresses and employment information of almost 79 million people","how":"Spear phishing emails to a subsidiary; at least one employee responded, and attackers took the data between 2 December 2014 and 27 January 2015","then":"Anthem paid $16 million to the US health department's Office for Civil Rights in 2018, the largest such settlement to that date","source_url":"https://web.archive.org/web/2018/https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16-million-record-hipaa-settlement-following-largest-health-data-breach-history.html","more_sources":["https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16-million-record-hipaa-settlement-following-largest-health-data-breach-history.html"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","national_id","address","dob","email","employment","account_id"],"aftermath_tags":[],"via":null,"country":"United States","scale":79000000,"related_attack_ids":[]},{"id":187,"slug":"2015-01-premera-blue-cross","when":"May 2014 to Jan 2015","sort_date":"2015-01","sector":"bank","sector_label":"Finance","who":"Premera Blue Cross, US health insurer","who_link":"Premera Blue Cross","what_left":"Names, addresses, dates of birth, email addresses, Social Security numbers, bank account information and health plan clinical information of more than 10.4 million people","how":"Phishing email installed malware that gave attackers access from May 2014; undetected for nearly nine months","then":"Breach report filed on 17 March 2015. Premera paid $6.85 million to the US health department's Office for Civil Rights in 2020","source_url":"https://web.archive.org/web/2020/https://www.hhs.gov/about/news/2020/09/25/health-insurer-pays-6-85-million-settle-data-breach-affecting-over-10-4-million-people.html","more_sources":["https://www.hhs.gov/about/news/2020/09/25/health-insurer-pays-6-85-million-settle-data-breach-affecting-over-10-4-million-people.html"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["name","address","dob","email","national_id","bank_account"],"aftermath_tags":[],"via":null,"country":"United States","scale":10400000,"related_attack_ids":[]},{"id":80,"slug":"2014-morgan-stanley-wealth-clients","when":"2011 to 2014","sort_date":"2014","sector":"bank","sector_label":"Finance","who":"Morgan Stanley Smith Barney, wealth management","who_link":"Morgan Stanley Smith Barney","what_left":"Confidential customer data on approximately 730,000 accounts","how":"An employee downloaded the data through two internal portals and transferred it to his personal server at home","then":"The personal server was likely hacked; portions of the data were posted on the internet with offers to sell larger quantities. Employee convicted; firm paid a $1 million SEC penalty in June 2016","source_url":"https://www.sec.gov/news/press-release/2016-112","more_sources":["https://www.financial-planning.com/news/sec-fines-morgan-stanley-1m-for-data-breach"],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["account_id"],"aftermath_tags":["sale","publication"],"via":null,"country":null,"scale":730000,"related_attack_ids":[]},{"id":145,"slug":"2014-10-jpmorgan-chase","when":"2014, disclosed Oct 2014","sort_date":"2014-10","sector":"bank","sector_label":"Finance","who":"JPMorgan Chase","who_link":"JPMorgan Chase","what_left":"Names, addresses, phone numbers and email addresses for approximately 76 million households and 7 million small businesses, plus internal JPMorgan information about those users","how":"Network intrusion; the bank's filing does not say how the attackers got in","then":"The bank said it saw no evidence that account numbers, passwords, dates of birth or Social Security numbers were taken. In Nov 2015 US prosecutors [charged a group](https://www.justice.gov/usao-sdny/pr/attorney-general-and-manhattan-us-attorney-announce-charges-stemming-massive-network) with stealing data on over 80 million customers of one unnamed bank, partly to get contact details for stock-promotion spam","source_url":"https://www.sec.gov/Archives/edgar/data/19617/000119312514362173/d799478d8k.htm","more_sources":["https://www.justice.gov/usao-sdny/pr/attorney-general-and-manhattan-us-attorney-announce-charges-stemming-massive-network"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","address","phone","email"],"aftermath_tags":["phishing"],"via":null,"country":"United States","scale":76000000,"related_attack_ids":[]},{"id":188,"slug":"2014-08-community-health-systems","when":"Apr to Jun 2014, disclosed Aug 2014","sort_date":"2014-08","sector":"other","sector_label":"Other","who":"Community Health Systems, US hospital operator","who_link":"Community Health Systems","what_left":"Names, Social Security numbers, physical addresses, birthdays and telephone numbers of 4.5 million patients","how":"Intrusion with malware between April and June 2014; the company's investigators placed the attackers in China","then":"Announced by the company on 18 August 2014; the FBI said it was working with the hospital network. No medical or card data taken, per the company","source_url":"https://web.archive.org/web/2020/https://money.cnn.com/2014/08/18/technology/security/hospital-chs-hack/","more_sources":["https://money.cnn.com/2014/08/18/technology/security/hospital-chs-hack/"],"leak_type":"theft","vector":"undisclosed","verification":"confirmed","data_types":["name","national_id","address","dob","phone"],"aftermath_tags":[],"via":null,"country":"United States","scale":4500000,"related_attack_ids":[]},{"id":79,"slug":"2014-01-south-korea-card-firms-kcb","when":"May to Dec 2013, reported Jan 2014","sort_date":"2014-01","sector":"bank","sector_label":"Finance","who":"KB Kookmin Card, Lotte Card and NH Nonghyup Card, South Korea, via Korea Credit Bureau","who_link":"KB Kookmin Card, Lotte Card and NH Nonghyup Card","what_left":"Credit card and personal details of 20 million South Koreans: names, social security numbers and credit card details","how":"An IT contractor working at the Korea Credit Bureau copied unencrypted data onto a USB stick","then":"Sold to marketing firms; contractor and the buyers' managers arrested; the regulator said card passwords and CVC codes were not taken and no direct damage had been reported","source_url":"https://www.theregister.com/2014/01/22/sk_data_breach_apology/","more_sources":[],"leak_type":"insider","vector":"rogue_insider","verification":"confirmed","data_types":["name","national_id","bank_account"],"aftermath_tags":["sale"],"via":"Korea Credit Bureau","country":"South Korea","scale":20000000,"related_attack_ids":[]},{"id":65,"slug":"2013-10-court-ventures-experian","when":"Reported Oct 2013","sort_date":"2013-10","sector":"other","sector_label":"Other","who":"Court Ventures, data broker bought by Experian in Mar 2012","who_link":"Court Ventures","what_left":"Paid lookups of US consumer records: Social Security numbers, dates of birth, driving licence records and financial information, per KrebsOnSecurity. The buyer later admitted offering access to data on 200 million US citizens. Experian said its credit files were not accessed","how":"Sold database access to a customer posing as a US-based private investigator, who ran an identity theft service from Vietnam and paid by monthly wire transfers from Singapore, per the head of a partner data firm. Experian said the reselling continued after it bought the company","then":"Records resold through two identity theft sites to more than 1,300 buyers, who ran more than three million queries. The buyer was [sentenced to 13 years](https://www.justice.gov/opa/pr/vietnamese-national-sentenced-13-years-prison-operating-massive-international-hacking-and) in Jul 2015; the IRS confirmed $65 million in fraudulent tax returns filed in the names of 13,673 people whose data was sold there","source_url":"https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/","more_sources":["https://www.justice.gov/opa/pr/vietnamese-national-sentenced-13-years-prison-operating-massive-international-hacking-and"],"leak_type":"handover","vector":"pretexting","verification":"confirmed","data_types":["name","national_id","dob","bank_account"],"aftermath_tags":["sale"],"via":null,"country":"United States","scale":null,"related_attack_ids":[]},{"id":178,"slug":"2012-09-south-carolina-department-of-revenue","when":"Aug to Sep 2012","sort_date":"2012-09","sector":"gov","sector_label":"Government","who":"South Carolina Department of Revenue, state tax office","who_link":"South Carolina Department of Revenue","what_left":"Tax filers' records: an estimated 3.6 million Social Security numbers and 387,000 credit card records, per reporting of November 2012","how":"Phishing email to Department of Revenue staff on 13 August 2012; the attacker used an employee's credentials, copied database backup files on 12 September and sent them to a system on the internet, per the [Mandiant report](https://web.archive.org/web/2014/http://governor.sc.gov/Documents/MANDIANT%20Public%20IR%20Report%20-%20Department%20of%20Revenue%20-%2011%2020%202012.pdf)","then":"A law enforcement agency told the department that personal data of three people had been stolen. The state agreed to pay up to $12 million for credit monitoring for people who had filed state tax returns","source_url":"https://web.archive.org/web/2016/http://www.postandcourier.com/article/20121103/PC16/121109713","more_sources":["https://web.archive.org/web/2014/http://governor.sc.gov/Documents/MANDIANT%20Public%20IR%20Report%20-%20Department%20of%20Revenue%20-%2011%2020%202012.pdf"],"leak_type":"theft","vector":"pretexting","verification":"confirmed","data_types":["national_id","bank_account","wealth"],"aftermath_tags":[],"via":null,"country":"United States","scale":3600000,"related_attack_ids":[]},{"id":81,"slug":"2012-05-julius-baer-tax-cd","when":"Oct to Dec 2011, handed over Feb and May 2012","sort_date":"2012-05","sector":"bank","sector_label":"Finance","who":"Julius Baer, Swiss private bank","who_link":"Julius Baer","what_left":"About 2,700 records of German and Dutch clients; the German set was filtered to clients holding more than 100,000 in euros, francs, pounds or dollars. Names, account numbers, balances and addresses, per the employee","how":"An external IT specialist working at the bank copied records from several internal systems, at the suggestion of a German intermediary, and passed them to a retired German tax investigator","then":"Sold to German tax authorities; he received about 1.1 million euros for the German records. Sentenced in August 2013 to three years, partly suspended","source_url":"https://www.srf.ch/news/wirtschaft/wirtschaft-datendieb-der-bank-baer-muss-ins-gefaengnis","more_sources":["https://www.srf.ch/news/wirtschaft/gestohlene-kundendaten-it-mitarbeiter-vor-gericht","https://www.moneycab.com/dossiers/datendieb-der-bank-julius-baer-kommt-vor-gericht/amp/","https://www.finews.ch/news/banken/18587-julius-baer-lutz-otte-steuerstreit-bundesanwaltschaft-bankgeheimnis-datenleck"],"leak_type":"insider","vector":"bribed_insider","verification":"confirmed","data_types":["name","bank_account","balance","address"],"aftermath_tags":["sale"],"via":null,"country":"Switzerland","scale":2700,"related_attack_ids":[]},{"id":143,"slug":"2011-06-mt-gox-user-database","when":"Jun 2011","sort_date":"2011-06","sector":"crypto","sector_label":"Crypto","who":"Mt. Gox, Bitcoin exchange","who_link":"Mt. Gox","what_left":"User database: account numbers, logins, email addresses and encrypted passwords, per Mt. Gox's notice to users; a researcher counted 61016 accounts in the posted list","how":"Mt. Gox first said an auditor with read-only database access had a compromised computer; it later said it believed attackers used an SQL injection flaw","then":"Database offered for sale, then posted on a Bitcoin forum; Mt. Gox suspected the leaked data was used to reach an administrator account and crash the price; passwords reset","source_url":"https://www.welivesecurity.com/2011/06/20/1-bitcoin-exchange-data-breached","more_sources":["https://blog.zorinaq.com/major-attack-on-the-worlds-largest-bitcoin-exchange/","https://www.pcworld.com/article/486888/faked_bitcoins_caused_price_crash_exchange_reveals.html"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["account_id","email","credentials"],"aftermath_tags":["sale","publication"],"via":null,"country":null,"scale":61016,"related_attack_ids":[]},{"id":191,"slug":"2011-04-sony-playstation-network","when":"Apr 2011","sort_date":"2011-04","sector":"other","sector_label":"Other","who":"Sony PlayStation Network and Qriocity","who_link":"Sony","what_left":"Name, address, country, email address, birthdate, password and login of account holders; purchase history and billing address possibly also taken. Sony could not rule out that credit card data was taken","how":"Intrusion into the network between 17 and 19 April 2011","then":"Services switched off; Sony warned users of email, telephone and postal scams. The ICO [fined Sony 250,000 pounds](https://web.archive.org/web/2013/https://ico.org.uk/news/latest_news/2013/ico-news-release-2013) in January 2013 and said the attack could have been prevented with up-to-date software","source_url":"https://blog.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/","more_sources":["https://web.archive.org/web/2013/https://ico.org.uk/news/latest_news/2013/ico-news-release-2013"],"leak_type":"theft","vector":"software_flaw","verification":"confirmed","data_types":["name","address","email","dob","credentials","order_history"],"aftermath_tags":[],"via":null,"country":null,"scale":null,"related_attack_ids":[]}],"tiles":[{"figure":"153M+","caption":"driver's licence scans for sale after the IDScan breach","tag":"September 2026","leak_id":4},{"figure":"~680","caption":"Revolut customers whose passports, licences and statements reportedly went out on a fake emergency request","tag":"September 2026","leak_id":2},{"figure":"347,000","caption":"Trezor subscribers sent a fake security alert from the company's own support address","tag":"September 2026","leak_id":3},{"figure":"80,689","caption":"Trezor buyers whose names and shipping addresses left through a shipping vendor","tag":"August to September 2026","leak_id":5},{"figure":"31,000","caption":"beneficial owners in Liechtenstein's register copied by name, birth date and holding","tag":"July 2026","leak_id":6},{"figure":"1M+","caption":"passports, licences and check-in selfies left open on the web by a hotel check-in system","tag":"May 2026","leak_id":7},{"figure":"33.7M","caption":"Coupang customers: names, phone numbers and home addresses taken by a former employee","tag":"November 2025","leak_id":13},{"figure":"1 bn","caption":"KYC records on an open database attributed to identity vendor IDmerit, which disputes it","tag":"November 2025","leak_id":11},{"figure":"$200","caption":"reported price per customer record paid to bribed Coinbase support contractors","tag":"May 2025","leak_id":17},{"figure":"$10,000","caption":"asking price for one file advertised as 18 million crypto customers from 20 platforms","tag":"April 2025","leak_id":18},{"figure":"272,000","caption":"Ledger customers whose home addresses were published; threatening emails followed","tag":"2020","leak_id":29}]}