https://www.thesubtlety.com/breach-tracker/feed.xml 2026-10-19T00:00:00Z https://www.thesubtlety.com/breach-tracker/#id=6701be27ea1ecc2597308d2305842d564e139af2 2026-10-19T00:00:00Z

UNC5820 exploited FortiManager vulnerabilities to access a telecommunications organization’s environment, deploy the PeerStitch implant, and exfiltrate a configuration archive. Disclosed 2026-10-19. Source: https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/

https://www.thesubtlety.com/breach-tracker/#id=5604c03c0dade5bd43aa69a23f4e344f74221c96 2026-10-19T00:00:00Z

A third party exploited a vulnerability in Studio's features to access its cloud environment, where customer data could be retrieved from outside. Disclosed 2026-10-19. Source: https://japancyberwatch.com/articles/studio-website-builder-breach-form-data-api-keys-2026

https://www.thesubtlety.com/breach-tracker/#id=967f29efd1b19c6c813262fb19c6f8132b9cdbbc 2026-10-19T00:00:00Z

An attacker used stolen customer credentials to access a legacy Cerner server and copy patient information. Disclosed 2026-10-19. 19,929,149 records. Source: https://www.foxnews.com/tech/oracle-health-data-breach-exposes-nearly-20-million-patients?utm_source=flipboard&utm_medium=activitypub

https://www.thesubtlety.com/breach-tracker/#id=fe55097e739a1da8ea66cd9ea2f2372b5782ba76 2026-10-19T00:00:00Z

IDScan was identified as the likely source of identity documents reportedly exfiltrated and offered for search on the Nexus site. Disclosed 2026-10-19. Source: https://justpaste.in/news/it-sure-looks-like-hackers-breached-a-major-id-card-verification-service/

https://www.thesubtlety.com/breach-tracker/#id=f7b9e15cde110e4db9c301f7ac5fcd1516b599a1 2026-10-19T00:00:00Z

Hollys Coffee identified unauthorized access to its legacy membership database, exposing personal information, account credentials, and service usage data. Disclosed 2026-10-19. Source: https://beyondmachines.net/event_details/south-korea-s-hollys-coffee-membership-system-compromised-p-n-8-6-w/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=8f399525de0a2636b21a49c960811fef0ae31c44 2026-10-19T00:00:00Z

Attackers exploited a vulnerability in FirstVDS's VMmanager 6 platform and copied data from customers' virtual servers. Disclosed 2026-10-19. Source: https://therecord.media/russia-cyberattack-firstvds-cloud

https://www.thesubtlety.com/breach-tracker/#id=d4caacc9fbaf48723057ae9f42a167be6e37f8bf 2026-10-19T00:00:00Z

Canva said unauthorized access to the third-party tool Canny exposed some enterprise customer records through its connection to Canva’s Salesforce account. Disclosed 2026-10-19. Source: https://www.cyberdaily.au/security/14317-exclusive-aussie-software-giant-canva-confirms-third-party-data-incident

https://www.thesubtlety.com/breach-tracker/#id=cf254df74d8a00779df76e67a9749bd4e44d09a3 2026-10-19T00:00:00Z

Disclosed 2026-10-18. 7 records. Source: https://ago.vermont.gov/categories/security-breach-notices#The%20Way%20to%20My%20Heart%20Inc.%20%28Global%20PAD%20Association%29-2026-10-18

https://www.thesubtlety.com/breach-tracker/#id=4ef6411902571e01752bb7687941b6799dc40140 2026-10-19T00:00:00Z

Qilin claimed on its leak site that it had compromised Pengurusan Aset Air Berhad, but the claim and any data exposure remain unverified. Disclosed 2026-10-18. Source: https://www.yazoul.net/intel/claim/2026-10-18-pengurusan-aset-air-berhad-ransomware-claim-by-qilin-oct-2026

https://www.thesubtlety.com/breach-tracker/#id=cdda96bff117183897f2847e98cc900f20959806 2026-10-19T00:00:00Z

Napoleon Perdis reported unauthorized access to legacy customer records stored by Retail Express, affecting 339,055 individuals. Disclosed 2026-10-18. 339,055 records. Source: https://beyondmachines.net/event_details/napoleon-perdis-data-breach-exposes-340000-customer-records-via-third-party-provider-q-w-i-f-n/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=5945a4d8c0bf8e836dc3a3d27726e10e825e5a38 2026-10-19T00:00:00Z

More Rewards disclosed unauthorized activity on a database server containing customer profiles; the access method and number of affected individuals were not disclosed. Disclosed 2026-10-18. Source: https://beyondmachines.net/event_details/more-rewards-data-breach-exposes-personal-information-of-grocery-customers-o-w-e-m-7/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=5d43b0e40394abfc9311385352affc8a1efed7c5 2026-10-19T00:00:00Z

GordonFreeman claims to have obtained 2.5 million COVID-19 vaccination records from Argentina's Ministry of Health of Chaco. Disclosed 2026-10-18. 2,500,000 records. Source: https://infosec.exchange/@darkwebsonar/117463025991030218

https://www.thesubtlety.com/breach-tracker/#id=aabd096b4a270d05e63d82c9c7093d93218f58f7 2026-10-19T00:00:00Z

A reported breach affecting Gîtes de France departmental branches exposed approximately 117,574 customer records, including contact and booking details. Disclosed 2026-10-18. 117,574 records. Source: https://www.yazoul.net/breaches/breach/g-tes-de-france-breach-117k-emails-phone-numbers-exposed-2026

https://www.thesubtlety.com/breach-tracker/#id=676075d3eb0c3f0531f4ca96bc44d2439fcc09ae 2026-10-19T00:00:00Z

Everest claimed to have compromised Brenner Base Tunnel and exfiltrated data, but the claim and affected entity have not been independently verified. Disclosed 2026-10-18. Source: https://www.yazoul.net/intel/claim/2026-10-17-brenner-base-tunnel-ransomware-claim-by-everest-oct-2026

https://www.thesubtlety.com/breach-tracker/#id=01d2b95714cc5179cf4489825733b5bc3cb3c260 2026-10-19T00:00:00Z

An intruder reached a legacy system at OpenCode, potentially exposing provider keys saved by some OpenCode Console users. Disclosed 2026-10-17. Source: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

https://www.thesubtlety.com/breach-tracker/#id=a32e148b979d3b5e96fcddb6f25c25452cd7a98c 2026-10-19T00:00:00Z

Disclosed 2026-10-17. 7 records. Source: https://ago.vermont.gov/categories/security-breach-notices#Kymberlie%20McNicholas-2026-10-17

https://www.thesubtlety.com/breach-tracker/#id=d561e61238d263fc460c193a22195d180835f2bc 2026-10-19T00:00:00Z

ConnectWise confirmed that attackers used a compromised vendor-side API secret to access customer Microsoft 365 environments. Disclosed 2026-10-17. Source: https://beyondmachines.net/event_details/connectwise-skykick-credentials-abused-to-compromise-microsoft-365-tenants-5-a-j-8-z/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=76bc0bc90ce6c6c974424bac24c87068bca5c8f0 2026-10-19T00:00:00Z

Disclosed 2026-10-17. 4 records. Source: https://ago.vermont.gov/categories/security-breach-notices#Catawba%20County-2026-10-17

https://www.thesubtlety.com/breach-tracker/#id=2fac13e768259f96547c42f9f8c7c01715fe49c5 2026-10-19T00:00:00Z

Disclosed 2026-10-16. 1 records. Source: https://ago.vermont.gov/categories/security-breach-notices#Ganxxet%2C%20Inc.-2026-10-16

https://www.thesubtlety.com/breach-tracker/#id=964615a0665cd99c0e86d0bca67d2b59e881cf7d 2026-10-19T00:00:00Z

Attackers exploited a directory traversal flaw on Arcadia's media server, accessed internal files and information, and used a backdoor to send phishing emails through Arcadia's system. Disclosed 2026-10-14. 3,140,000 records. Source: https://japancyberwatch.com/articles/arcadia-speecan-raiden-disaster-alert-breach-2026#how-the-attackers-got-in

https://www.thesubtlety.com/breach-tracker/#id=6f578a4a96f926af5cd2ac75fc74dff4d5be3f4a 2026-10-18T00:00:00Z

Mankato Clinic reported a data security incident after the Chaos ransomware group claimed it stole data; the clinic said the intrusion was identified on August 18, 2026. Disclosed 2026-10-18. Source: https://beyondmachines.net/event_details/mankato-clinic-discloses-data-breach-following-ransomware-attack-claims-p-x-f-o-3/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=ef9aa97ff864e7802bdc0435b731d28a59ec2e93 2026-10-18T00:00:00Z

TheHatman claims to have obtained AstraZeneca employee records using compromised Azure tenant credentials. Disclosed 2026-10-18. Source: https://infosec.exchange/@darkwebsonar/117460945822041911

https://www.thesubtlety.com/breach-tracker/#id=b82ac45419f52a668f5af1c2a98603673e2c0174 2026-10-18T00:00:00Z

Yamato Transport reported that data was stolen from its Kuroneko Pay-Later Service, affecting approximately 5.31 million records; the method of access was not disclosed. Disclosed 2026-10-17. 5,310,000 records. Source: https://beyondmachines.net/event_details/yamato-transport-discloses-breach-of-5-3-million-payment-service-records-6-f-v-o-i/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=fc56bca895ec282655ce8d12ebd55057954e4400 2026-10-18T00:00:00Z

The Play ransomware group claimed it exfiltrated data from WSBI-ESBG, but the claim has not been independently verified. Disclosed 2026-10-17. Source: https://www.yazoul.net/intel/claim/2026-10-17-wsbi-esbg-ransomware-claim-by-play-oct-2026

https://www.thesubtlety.com/breach-tracker/#id=481e184a7ceab43b3a9872726c9f214c4d5166ad 2026-10-18T00:00:00Z

A breach claim by Returnero listed Secretaria de Salud and included a sample with user profiles, plaintext passwords, emails, phone numbers, and health officials’ names. Disclosed 2026-10-17. Source: https://infosec.exchange/@darkwebsonar/117457325929735542

https://www.thesubtlety.com/breach-tracker/#id=ed838c1ec907680671613c7e4fad356e092188fd 2026-10-18T00:00:00Z

Mid Florida Dermatology & Plastic Surgery reported a breach affecting 85,585 individuals, with personal, medical, financial, and credential information exposed. Disclosed 2026-10-17. 85,585 records. Source: https://beyondmachines.net/event_details/mid-florida-dermatology-plastic-surgery-reports-breach-affecting-85000-patients-z-0-4-7-a/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=d4227edd1b74f7454992af5e783f9b6923af9e22 2026-10-18T00:00:00Z

Medical Data Rx, a Michigan-based IT provider, experienced a ransomware attack attributed to The Gentlemen/VYPR that disrupted healthcare data access. Disclosed 2026-10-17. Source: https://mastodon.social/@netsecio/117457363784983972

https://www.thesubtlety.com/breach-tracker/#id=da8e918543f01fb8a7544da84f4f1b6e85fd60d8 2026-10-18T00:00:00Z

A ransomware group using the name pear allegedly listed Macfarlan Capital Partners as a victim, but the claim and any data exposure remain unverified. Disclosed 2026-10-17. Source: https://www.yazoul.net/intel/claim/2026-10-16-macfarlan-capital-partners-ransomware-claim-by-pear-oct-2026

https://www.thesubtlety.com/breach-tracker/#id=a9b440daf3b18657414881906577180c6f1b7508 2026-10-18T00:00:00Z

Florida DMV reported a data breach after an attacker used compromised credentials, while ShinyHunters claimed responsibility and alleged theft of 500,000 files. Disclosed 2026-10-17. Source: https://mastodon.social/@netsecio/117457363578940484

https://www.thesubtlety.com/breach-tracker/#id=440dde5a604dc1a1eb757702631554a544eb2760 2026-10-18T00:00:00Z

ETS reportedly suffered a breach in which names, addresses, and demographic information of millions of current and former California public school students were stolen. Disclosed 2026-10-17. Source: https://mastodon.social/@netsecio/117457363195461518

https://www.thesubtlety.com/breach-tracker/#id=5492eddf4ed1ad047543d1e5332e75bacb2f5233 2026-10-18T00:00:00Z

Educational Testing Service reported that an attacker used a stolen credential to access its SFTP site and copy student assessment files. Disclosed 2026-10-17. 5,700,000 records. Source: https://beyondmachines.net/event_details/ets-data-breach-exposes-records-of-millions-of-california-students-a-u-0-j-y/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=e94af7d976e8b75f15e1ffb805717db1b0bac975 2026-10-18T00:00:00Z

Hackers accessed Boston Children’s Health Physicians’ network through a breach at its security services provider, XTIUM, and stole patient records. Disclosed 2026-10-17. Source: https://ag.ny.gov/press-release/2026/attorney-general-james-and-attorney-general-tong-secure-27-million-pediatric

https://www.thesubtlety.com/breach-tracker/#id=b6358efbab8fafe0dee7d1abce0a9ed542d3311b 2026-10-18T00:00:00Z

Anne Arundel County confirmed a data breach after the Rhysida ransomware group claimed it stole government data and demanded a ransom. Disclosed 2026-10-16. Source: https://infosec.exchange/@beyondmachines1/117456378876983531

https://www.thesubtlety.com/breach-tracker/#id=4ad6c09e59ef6899dc10f63ad8140ccd70db7ca0 2026-10-17T00:00:00Z

Kannarr Eye Care reported that the INC Ransom group encrypted systems and viewed or took sensitive health and personal records affecting 14,003 individuals. Disclosed 2026-10-17. 14,003 records. Source: https://beyondmachines.net/event_details/kannarr-eye-care-notifies-14000-patients-following-inc-ransom-attack-1-8-z-g-m/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=02d1a133b64aa6b017c0408bab99ec349c81018f 2026-10-17T00:00:00Z

Rhysida claimed to have stolen files from an unnamed Maryland county and threatened to leak them unless paid. Disclosed 2026-10-16. Source: https://mastodon.social/@threadlinqs/117450830118969340

https://www.thesubtlety.com/breach-tracker/#id=bc68160b8f459affa17272645de2b720e82e41e9 2026-10-17T00:00:00Z

The Money Store said an unauthorized third party accessed systems through an outside service provider’s remote monitoring and management tool and took information from residential mortgage loan files. Disclosed 2026-10-16. Source: https://www.datatrail.app/breach/the-money-store/

https://www.thesubtlety.com/breach-tracker/#id=45f834505577493a9ebc3b10101947eb012d7dc5 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 36,360 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005429

https://www.thesubtlety.com/breach-tracker/#id=fc829c9f497ee7e978f0ab5cdac4739c9049011f 2026-10-17T00:00:00Z

A 2024 hack of blood testing company Synnovis disrupted pathology services across several London hospitals. Disclosed 2026-10-16. Source: https://databreaches.net/2026/10/16/russian-man-linked-to-deadly-nhs-contractor-hack-arrested/

https://www.thesubtlety.com/breach-tracker/#id=14568a0bbcb046e39e6878b6bbb3144778257be1 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 113,727 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005430

https://www.thesubtlety.com/breach-tracker/#id=243e95d02fa7b599863a57f32fb96c77a0ddb09c 2026-10-17T00:00:00Z

Thegentlemen allegedly listed St Peters Anglican Primary School on its leak site, but the claim has not been independently verified. Disclosed 2026-10-16. Source: https://www.yazoul.net/intel/claim/2026-10-16-st-peters-anglican-primary-school-ransomware-claim-by-thegentlemen-oct-2026

https://www.thesubtlety.com/breach-tracker/#id=fe357ed54983e27cb554475274f9a09243c1f41b 2026-10-17T00:00:00Z

OFX Group reported unauthorized access to internal files containing personal information, while stating that its client platform databases, client accounts, and funds were not accessed. Disclosed 2026-10-16. Source: https://beyondmachines.net/event_details/ofx-group-confirms-unauthorized-access-to-client-and-applicant-personal-information-b-g-n-3-l/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=791596b4d10684427a74ed56ab690b728de35624 2026-10-17T00:00:00Z

Neuro Wellness Spa inadvertently emailed a file containing patient information to another patient. Disclosed 2026-10-16. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631463

https://www.thesubtlety.com/breach-tracker/#id=e93f3f1201c5b0fc472ad0ec4de7b887203e5c3e 2026-10-17T00:00:00Z

A National Health Insurance Service employee illegally sold subscribers’ personal information to external parties. Disclosed 2026-10-16. Source: https://databreaches.net/2026/10/16/kr-nhis-employee-sold-data-victims-uninformed-for-three-months/

https://www.thesubtlety.com/breach-tracker/#id=95bd175cde17fdcd850ef65a8ab55c7952e07950 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 24,447 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005423

https://www.thesubtlety.com/breach-tracker/#id=7ec5fcfd36771766f3ce96a09f1c3be7c67ce135 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 37,966 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005431

https://www.thesubtlety.com/breach-tracker/#id=0be4ca29dfd74b5a77d0980a2810df8b5a1026d1 2026-10-17T00:00:00Z

An unauthorized actor accessed the organization's network and acquired files between April 9 and April 13, 2026. Disclosed 2026-10-16. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631484

https://www.thesubtlety.com/breach-tracker/#id=0c85549051f7197bc792bd4058956b3dc8ec3472 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 217,703 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005425

https://www.thesubtlety.com/breach-tracker/#id=39440ee99cf4db3f9a41e9174a3f98cdf6045156 2026-10-17T00:00:00Z

Inner City Education Foundation reported that an unauthorized actor accessed certain systems and may have taken information. Disclosed 2026-10-16. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631486

https://www.thesubtlety.com/breach-tracker/#id=de479be603463e6ba6f5753ed425b086a35e7384 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 4,488 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005426

https://www.thesubtlety.com/breach-tracker/#id=1324c6bb32fd00364be2ad12edc30c732ba20d0c 2026-10-17T00:00:00Z

Attackers used exposed Dodo Pizza corporate credentials to access company systems, including cloud storage and databases, and reportedly stole customer information. Disclosed 2026-10-16. Source: https://therecord.media/russia-datasuckers-hackers-arrested

https://www.thesubtlety.com/breach-tracker/#id=816f5e925e25ecadcef06904b624f6195b099deb 2026-10-17T00:00:00Z

Disclosed 2026-10-16. 2,566 records. Source: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005427

https://www.thesubtlety.com/breach-tracker/#id=ab9f61ae0da1c51c5d2479ac766c7184efe5181b 2026-10-17T00:00:00Z

An unauthorized party used a compromised login credential to access an SFTP site used to exchange California student information with CDE and copied files. Disclosed 2026-10-16. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631485

https://www.thesubtlety.com/breach-tracker/#id=f3f2b847561fb9b2062b6fb1d2e1ada2c1534b25 2026-10-17T00:00:00Z

Beyond Gravity reported data theft after detecting malicious activity in its IT systems on August 12, 2026. Disclosed 2026-10-16. Source: https://beyondmachines.net/event_details/beyond-gravity-reports-data-theft-following-targeted-cyberattack-2-z-2-8-m/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=3fad174918f4cc526d8dd4a90ef11415a87c81eb 2026-10-17T00:00:00Z

The ransomware group blacknevas claimed that it had breached Amity University Dubai and listed alleged student and staff data on its leak site; the claim is unverified. Disclosed 2026-10-16. Source: https://www.yazoul.net/intel/claim/2026-10-15-amity-university-dubai-ransomware-claim-by-blacknevas-sep-2026

https://www.thesubtlety.com/breach-tracker/#id=65c806658f23872f32c6d1e53c5b738e4ee09e38 2026-10-17T00:00:00Z

Citizen Lab reported that at least 45 Al Jazeera devices were targeted with spyware delivered through zero-click ads in 2024 and 2025. Disclosed 2026-10-16. Source: https://beyondmachines.net/event_details/zero-click-ads-how-an-unpatched-browser-can-be-silently-led-to-spyware-x-q-1-i-p/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=26d40d540ec70ef20d3fb2b808cbf0c2736303b1 2026-10-17T00:00:00Z

Burger King Japan disclosed a breach affecting 11.18 million app membership records in its member management system. Disclosed 2026-10-15. 11,180,000 records. Source: https://infosec.exchange/@cyberworldops/117451496403721856

https://www.thesubtlety.com/breach-tracker/#id=7ebdeebfe680fae9f9fbb6d3cf65b4185b09084c 2026-10-17T00:00:00Z

Magna Hospitality Group reported that an unauthorized actor accessed certain systems and copied files containing personal information. Disclosed 2026-10-13. Source: https://beyondmachines.net/event_details/magna-hospitality-group-discloses-ransomware-breach-exposing-385-gb-of-data-h-8-v-6-5/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=0a3c33cfafa0574fd79718e2a6eba684f8153a6a 2026-10-17T00:00:00Z

JM Bullion reported suspicious activity affecting its network from April 12 to April 14, 2026, and said affected data included individuals' names with other information. Disclosed 2026-10-13. 1,022 records. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631226

https://www.thesubtlety.com/breach-tracker/#id=d6bd71da0c8bbda994a2333dd3666cc62d0be75b 2026-10-17T00:00:00Z

IDC Frontier confirmed that a third-party ransomware attack disrupted four zones of IDCF Cloud, affecting 495 companies and local governments. Disclosed 2026-10-09. Source: https://japancyberwatch.com/articles/idcf-cloud-unauthorized-access-outage-2026

https://www.thesubtlety.com/breach-tracker/#id=84ff8c5398ee93ebd56cfdc2c10288c30c89f4e7 2026-10-17T00:00:00Z

A news report stated that a hack affecting iRhythm Technologies involved 8.2 million patients. Disclosed 2026-10-06. 8,200,000 records. Source: https://mastodon.clinicians-exchange.org/@rsstosecurity/117452107807623626

https://www.thesubtlety.com/breach-tracker/#id=bc5eb8920bdad0d3e3c17e8ee2c31b405dad332d 2026-10-17T00:00:00Z

CenterPoint Energy reported unauthorized access to customer data through an externally facing system, with approximately 1 million Texans affected. Disclosed 2026-09-14. 1,000,000 records. Source: https://osintsights.com/centerpoint-energy-breach-exposes-1m-customer-records?utm_source=mastodon&utm_medium=social

https://www.thesubtlety.com/breach-tracker/#id=2c151c66c8578d29f45f4c90b75a720a585ed396 2026-10-16T00:00:00Z

ShinyHunters allegedly leaked notarial transaction records from Somalia's Ministry of Justice and Constitutional Affairs. Disclosed 2026-10-16. Source: https://infosec.exchange/@darkwebsonar/117448858361435696

https://www.thesubtlety.com/breach-tracker/#id=2de9217ba595f4819dec1e7ed8eff26e5dce8ba6 2026-10-16T00:00:00Z

A camera bag containing SD memory cards was stolen from a Pret-a-Portrait vehicle, and the cards may have held Priory School photographs and pupil names and class information. Disclosed 2026-10-16. Source: https://osintsights.com/uk-school-faces-data-breach-after-photographers-vehicle-targeted?utm_source=mastodon&utm_medium=social

https://www.thesubtlety.com/breach-tracker/#id=f600a4e0e46dbaea7615ff482d304d35ae8525ed 2026-10-16T00:00:00Z

Poole Group confirmed a cyber incident affecting part of its IT environment after LockBit claimed the attack and threatened to leak allegedly stolen data. Disclosed 2026-10-16. Source: https://www.cyberdaily.au/security/14307-exclusive-poole-group-investigating-lockbit-ransomware-attack

https://www.thesubtlety.com/breach-tracker/#id=7645d34169c40a29045b455dba26adca572f7f29 2026-10-16T00:00:00Z

Missouri Central Credit Union reported unauthorized access to its email environment through phishing, exposing members' personal and financial information. Disclosed 2026-10-16. Source: https://beyondmachines.net/event_details/missouri-central-credit-union-email-breach-exposes-member-financial-data-h-q-p-0-j/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=9d4348ccb82697420d7da80563951e2f23ff3ab3 2026-10-16T00:00:00Z

Qilin listed Chadwick Switchboards and published a dataset that allegedly included accounts, admin data, staff folders and product data. Disclosed 2026-10-16. Source: https://www.cyberdaily.au/security/14311-exclusive-aussie-tech-company-with-links-to-defence-law-enforcement-allegedly-breached-by-ransomware-attack

https://www.thesubtlety.com/breach-tracker/#id=5bdad532045aa2e5e3b550406984d6a3039fd4bf 2026-10-16T00:00:00Z

BK Japan reported unauthorized access to the system managing mobile app member information, affecting approximately 11.18 million customer records. Disclosed 2026-10-16. 11,180,000 records. Source: https://beyondmachines.net/event_details/bk-japan-discloses-data-breach-exposing-11-18-million-app-member-records-3-r-0-4-e/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=b0697f5c70acff91d9bfbcb6783417996e23872b 2026-10-16T00:00:00Z

A cyberattack on BAE Systems disrupted the bankruptcy noticing systems it operates for the U.S. federal courts. Disclosed 2026-10-16. Source: https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/

https://www.thesubtlety.com/breach-tracker/#id=8d3f679b3d30746e43d6f150ad42f4fecd5d0521 2026-10-16T00:00:00Z

Qilin allegedly listed The Golden Legacy Financing on its leak site, but the claim and any data access or encryption have not been verified. Disclosed 2026-10-15. Source: https://www.yazoul.net/intel/claim/2026-10-14-golden-legacy-financing-ransomware-claim-by-qilin-oct-2026

https://www.thesubtlety.com/breach-tracker/#id=ab5ad68b6c2956ab8ea9f116842bf8f2852e0b66 2026-10-16T00:00:00Z

SourceNext Corporation said attackers abused its member information retrieval API and took data from 22,519,960 member records. Disclosed 2026-10-15. 22,519,960 records. Source: https://japancyberwatch.com/articles/sourcenext-member-data-breach-passwords-2026

https://www.thesubtlety.com/breach-tracker/#id=6049932e7ed8ca3c3d37c4f573d745227661c370 2026-10-16T00:00:00Z

nightspire claimed that So**n Public Schools was a ransomware victim and said data was not available. Disclosed 2026-10-15. Source: https://www.yazoul.net/intel/claim/2026-10-15-s-o-n-public-schools-ransomware-claim-by-nightspire-sep-2026

https://www.thesubtlety.com/breach-tracker/#id=d3f884a0ddceff8eceac2b9e62db5764c3f61bc4 2026-10-16T00:00:00Z

Sangre de Cristo Electric Association reported an intrusion that disrupted bill payments and telephone services; INC Ransom claimed it stole information, which the cooperative has not confirmed. Disclosed 2026-10-15. Source: https://dysruptionhub.com/sangre-de-cristo-colorado-cyber-intrusion/

https://www.thesubtlety.com/breach-tracker/#id=b51420f89337b238f6e335dfcf46b0bad55591e1 2026-10-16T00:00:00Z

MLD Mortgage Inc. reported that an unauthorized third party accessed its environment through a service provider's remote monitoring and management platform and acquired information from affected systems. Disclosed 2026-10-15. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631398

https://www.thesubtlety.com/breach-tracker/#id=0e9aa1f7b323f446e22aa6cd0fcb7720e9022dd6 2026-10-16T00:00:00Z

Criminals exploited vulnerabilities in the Legal Aid Agency's IT systems, accessed personal information, and exfiltrated data. Disclosed 2026-10-15. 250,000 records. Source: https://therecord.media/uk-legal-aid-cyberattack-data

https://www.thesubtlety.com/breach-tracker/#id=8c2991858545eee96dd45878153d922db486f8d6 2026-10-16T00:00:00Z

The Korean Federation of Community Credit Cooperatives reported that attackers exploited web page vulnerabilities and exfiltrated data affecting approximately 400 insurance customers. Disclosed 2026-10-15. 400 records. Source: https://beyondmachines.net/event_details/korean-federation-of-community-credit-cooperatives-report-cyberattack-data-breach-n-r-4-v-3/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=fa40deee1d741067e3b5c229aab838e63491173c 2026-10-16T00:00:00Z

A cyberattack involving BAE Systems disrupted the Bankruptcy Noticing Center used by federal bankruptcy courts, halting production of bankruptcy notices. Disclosed 2026-10-15. Source: https://therecord.media/federal-bankruptcy-courts-dealing-with-cyberattack-outage

https://www.thesubtlety.com/breach-tracker/#id=12ec81f15691e51b81fedd64789df4a7b7a01e0a 2026-10-16T00:00:00Z

Disclosed 2026-10-14. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631323

https://www.thesubtlety.com/breach-tracker/#id=e2e6b5b3cf6fafc051dc1d2f6992cea01cf748b9 2026-10-16T00:00:00Z

An external group used an employee’s stolen credentials to access Meta GitHub repositories and take business data and personal information. Disclosed 2026-10-13. 1,500 records. Source: https://shattered.io/meta-github-breach-1500-people-2026

https://www.thesubtlety.com/breach-tracker/#id=145eb237acf1e2c0bc8b7432d4008b0dfec86524 2026-10-16T00:00:00Z

Disclosed 2026-09-29. 2,080 records. Source: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-29-indiana-university-health-affiliated-covered-entity

https://www.thesubtlety.com/breach-tracker/#id=a4cc74d0f8e799888032ac8a0ab44466792a0016 2026-10-16T00:00:00Z

Disclosed 2026-09-25. 5,461 records. Source: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-25-center-for-bone-and-joint-surgery-of-the-palm-beaches

https://www.thesubtlety.com/breach-tracker/#id=a182840981d66a1d7d91bb6b0e3edcd4813bfd93 2026-10-16T00:00:00Z

The City of Foster City reported that an unauthorized third party accessed certain City systems and may have viewed or acquired files containing personal information. Disclosed 2026-07-13. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631363

https://www.thesubtlety.com/breach-tracker/#id=634d1bf5a33a16cf3f949a30e629f6bf3725b397 2026-10-15T00:00:00Z

Photon Health said attackers exploited a previously unknown vulnerability in its self-hosted Metabase application and accessed stored data that may have been exfiltrated. Disclosed 2026-10-15. Source: https://beyondmachines.net/event_details/photon-health-discloses-data-breach-after-metabase-zero-day-exploitation-u-v-0-i-z/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=812b31cd74c2833a8c74c44979716efa8edfe979 2026-10-15T00:00:00Z

Hunter Neurology is investigating n0n’s claim that patient data was stolen in an incident affecting a third-party provider’s environment, and n0n threatened to publish the data. Disclosed 2026-10-15. Source: https://www.cyberdaily.au/security/14305-exclusive-hunter-neurology-investigating-patient-data-breach-claims

https://www.thesubtlety.com/breach-tracker/#id=6b771bb5d03c751408c5fc8ad2b52ab63a0a7c21 2026-10-15T00:00:00Z

HYFLOCK claimed on its leak site that it exfiltrated approximately 300GB of data from YYC Advisors, but the claim and victim identity are unverified and internally inconsistent. Disclosed 2026-10-14. Source: https://www.yazoul.net/intel/claim/2026-10-14-yyc-advisors-ransomware-claim-by-hyflock-sep-2026

https://www.thesubtlety.com/breach-tracker/#id=5a79ba0d4290ba7088a87425c05308b586be6e74 2026-10-15T00:00:00Z

Ride On Express Holdings reported unauthorized access to externally operated servers used by its food delivery services, while the server provider reported a ransomware attack. Disclosed 2026-10-14. 6,500,000 records. Source: https://beyondmachines.net/event_details/ride-on-express-investigates-potential-data-breach-affecting-up-to-6-5-million-customer-records-v-k-l-s-l/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=78fca487653ca8cb06e2178a4dff82fc6f06b371 2026-10-15T00:00:00Z

Origin Energy said a July breach affected approximately 900,000 current and former customers and exposed personal and financial information. Disclosed 2026-10-14. 900,000 records. Source: https://mastodon.social/@hacksgr/117439396722621342

https://www.thesubtlety.com/breach-tracker/#id=5510bd75bd6ef8353de85d7c50c971c4e6da44c9 2026-10-15T00:00:00Z

OK Savings Bank detected unauthorized access to a loan application page, and information belonging to 183 customers may have been exposed. Disclosed 2026-10-14. 183 records. Source: https://beyondmachines.net/event_details/ok-savings-bank-investigates-potential-data-breach-w-l-s-p-h/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=eb489558b982d125f83420617d43c8fee5a5b912 2026-10-15T00:00:00Z

Mobileum reported unauthorized access to its network environment, and an investigation found that affected systems contained personal information. Disclosed 2026-10-14. 45 records. Source: https://beyondmachines.net/event_details/mobileum-data-breach-exposes-names-and-social-security-numbers-h-w-5-y-h/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=bc3b619d9ae8a26fc19ab35d6c4951c4a5ba4abe 2026-10-15T00:00:00Z

Lehigh Valley Restaurant Brands reported that files were copied from its systems, affecting 17,892 individuals, and Payouts King claimed responsibility. Disclosed 2026-10-14. 17,892 records. Source: https://beyondmachines.net/event_details/lehigh-valley-restaurant-brands-data-breach-affects-approximately-18000-individuals-as-payouts-king-claims-411-gb-stolen-y-x-m-z-z/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=98c122f2537ea0d6deb3c423d96f21c37bad48da 2026-10-15T00:00:00Z

Kern County Superintendent of Schools reported that a vulnerability in a third-party software product allowed unauthorized access to part of its environment, and personal information was obtained. Disclosed 2026-10-14. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631271

https://www.thesubtlety.com/breach-tracker/#id=78c890680b5fb57b7a9d515dd826a3da2335e8e9 2026-10-15T00:00:00Z

Johnson Investment Counsel disclosed a data breach after a third-party MSP was compromised; Storm claimed theft of client data including SSNs. Disclosed 2026-10-14. Source: https://mastodon.social/@netsecio/117439628431900153

https://www.thesubtlety.com/breach-tracker/#id=a7716c2061f2c2e47bfaa73f525c139cbff4a850 2026-10-15T00:00:00Z

Denmark’s national population register was accessed through a trusted third party, exposing 8.8 million identities. Disclosed 2026-10-14. 8,800,000 records. Source: https://mastox.eu/@thecybersecguru/117440607907239185

https://www.thesubtlety.com/breach-tracker/#id=aae4c661f67208167404e20788fde4288c8e20df 2026-10-15T00:00:00Z

Crunchbase was reportedly targeted by ShinyHunters in January 2026, and data later published online included 560,000 unique email addresses and associated personal and professional information. Disclosed 2026-10-14. 560,000 records. Source: https://infosec.exchange/@XposedOrNot/117439903005370032

https://www.thesubtlety.com/breach-tracker/#id=c9bca1f06908a4c5a9fb24952564848417d25eb3 2026-10-15T00:00:00Z

Claire's is investigating a data breach claim by Dark Project, which says it stole 1.71 TB of data. Disclosed 2026-10-14. Source: https://mastodon.social/@netsecio/117439628879765844

https://www.thesubtlety.com/breach-tracker/#id=f62b87ae5d0cd855d996bb2ce15635323a4c175e 2026-10-15T00:00:00Z

BBC International reported unauthorized access to its environment that may have exposed personal, financial, and medical information of employees and related individuals. Disclosed 2026-10-14. 42 records. Source: https://beyondmachines.net/event_details/bbc-international-data-breach-potentially-exposes-employee-pii-and-health-information-0-m-8-m-r/gD2P6Ple2L

https://www.thesubtlety.com/breach-tracker/#id=7610d85ca252037f2958af9358b135269a06240c 2026-10-15T00:00:00Z

AssuranceAmerica Managing General Agency detected suspicious activity involving an API endpoint used for insurance quotes, and personal information was improperly obtained. Disclosed 2026-10-14. 22,952 records. Source: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20AssuranceAmerica%20Managing%20General%20Agency%2C%20LLC.pdf

https://www.thesubtlety.com/breach-tracker/#id=9be6dee054395b10d48d812a46f7b1dbb2aa8b8f 2026-10-15T00:00:00Z

Tulare Joint Union High School District identified unauthorized activity and later determined that an unknown actor copied or downloaded certain files and folders. Disclosed 2026-10-13. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631234

https://www.thesubtlety.com/breach-tracker/#id=2b1d568831316589656f140390ec932aeb7b2e70 2026-10-15T00:00:00Z

Disclosed 2026-10-13. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631249

https://www.thesubtlety.com/breach-tracker/#id=86fdc5748a9aca9362eb0e0315b1a05b3f775336 2026-10-15T00:00:00Z

Hackers used compromised access associated with Pays to retrieve information from Denmark’s CPR register and store it externally. Disclosed 2026-10-13. 8,800,000 records. Source: https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/

https://www.thesubtlety.com/breach-tracker/#id=94756e1669c3b733c63a73e63ab2b4fc02d7e5e2 2026-10-15T00:00:00Z

Disclosed 2026-10-13. Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-631233