Data Breach Tracker
108
September 2026
Security & Stability
Confirmed data breaches and cyber security incidents reported by US companies each month, sourced from SEC 8-K filings, state attorney general breach notifications, cybersecurity news, and company disclosures. Each record covers the affected organisation, number of records exposed, data types compromised (personal information, financial data, health records), Incident Type where disclosed, and notification date. Only events confirmed by at least one authoritative source are included.
Data breach cyber attack hack personal data exposed announced
CISOs and security teams use it to benchmark incident frequency by sector and identify systemic attack patterns across industries. Cyber insurance underwriters use it to assess risk exposure and loss trends. Legal and compliance teams track breach notification timelines and regulatory responses. Journalists and researchers covering cybersecurity use it as a structured, sourced record of confirmed incidents.
5287
<div style="overflow-x:auto;width:100%"><table class="catchall-table"><thead><tr><th style="min-width:40px">#</th><th style="min-width:240px">Event</th><th style="min-width:140px;white-space:nowrap">Location</th><th style="min-width:140px;white-space:nowrap">Announcement Date</th><th style="min-width:140px;white-space:nowrap">Incident Type</th><th style="min-width:140px;white-space:nowrap">Affected Company</th><th style="min-width:140px;white-space:nowrap">Threat Actor</th><th style="min-width:140px;white-space:nowrap">Data Types Exposed</th><th style="min-width:140px;white-space:nowrap">Records Exposed</th><th style="min-width:140px;white-space:nowrap">Attack Vector</th><th style="min-width:120px;white-space:nowrap">Source</th></tr></thead><tbody><tr><td>1</td><td style="min-width:240px">Revolut Data Breach via Fraudulent Government Email Requests Exposes 680 Customers</td><td style="min-width:140px">United Kingdom</td><td style="min-width:140px">2026-09-12</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">A hacker who obtained sensitive customer data from digital financial platform Revolut targeted high-net-worth and cryptocurrency figures</td><td style="min-width:140px">iamnotavillain</td><td style="min-width:140px">names, dates of birth, occupations, addresses, phone numbers, email addresses, passports, driver's licenses, verification selfies, account statements, IBANs, cryptocurrency wallet references, transaction histories</td><td style="min-width:140px">680</td><td style="min-width:140px">social engineering, fraudulent government email requests</td><td style="white-space:nowrap"><a href="https://www.cutoday.info/Fresh-Today/Revolut-Breach-Exposes-High-Risk-Customers-Raises-Personal-Safety-Concerns" target="_blank" rel="nofollow">https://www.cutoday.info/Fresh-Today/Revolut-Breach-Exposes-High-Risk-Customers-Raises-Personal-Safety-Concerns</a></td></tr><tr><td>2</td><td style="min-width:240px">Burger King Russia Data Breach Exposes 3.2 Million Records</td><td style="min-width:140px">Russia</td><td style="min-width:140px">2024-10-01</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">Burger King Russia's 2024 breach via Mindbox exposed 3.2 million customer records, now leaked online</td><td style="min-width:140px"></td><td style="min-width:140px">emails, names, genders, birth dates, phone numbers, geolocations</td><td style="min-width:140px">3,200,000</td><td style="min-width:140px">third-party supply chain attack</td><td style="white-space:nowrap"><a href="https://tech.yahoo.com/cybersecurity/articles/millions-russian-fast-food-fans-151000009.html" target="_blank" rel="nofollow">https://tech.yahoo.com/cybersecurity/articles/millions-russian-fast-food-fans-151000009.html</a></td></tr><tr><td>3</td><td style="min-width:240px">IDScan Data Breach Exposes Personal Records of 150 Million Drivers</td><td style="min-width:140px">Louisiana, United States</td><td style="min-width:140px">2026-09-04</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">An immense data breach at an identity document checking company called IDScan</td><td style="min-width:140px">Nexus (dark web marketplace on a Russian-language cybercrime forum)</td><td style="min-width:140px">full names, driver's license numbers, government-issued identification numbers</td><td style="min-width:140px">153,000,000</td><td style="min-width:140px">unauthorized access to customer data stored in cloud platform</td><td style="white-space:nowrap"><a href="https://techcrunch.com/2026/09/15/the-worst-hacks-and-breaches-of-2026-so-far" target="_blank" rel="nofollow">https://techcrunch.com/2026/09/15/the-worst-hacks-and-breaches-of-2026-so-far</a></td></tr><tr><td>4</td><td style="min-width:240px">CenterPoint Energy Customer Data Breach Exposes 7.5 Million Records</td><td style="min-width:140px">Texas, United States</td><td style="min-width:140px">2026-09-14</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">Texas utility CenterPoint Energy confirmed on Monday that a threat actor has obtained customers' personal information.</td><td style="min-width:140px">4d722e4d656f77</td><td style="min-width:140px">names, phone numbers, service and billing addresses, account numbers, billed amounts, partial Social Security numbers</td><td style="min-width:140px">7,500,000</td><td style="min-width:140px">public-facing API</td><td style="white-space:nowrap"><a href="https://www.securityweek.com/texas-utility-centerpoint-energy-confirms-breach-after-hacker-leaks-data" target="_blank" rel="nofollow">https://www.securityweek.com/texas-utility-centerpoint-energy-confirms-breach-after-hacker-leaks-data</a></td></tr><tr><td>5</td><td style="min-width:240px">Federal Bureau of Investigation Data Breach by Shiny Hunters</td><td style="min-width:140px">Washington, D.C.</td><td style="min-width:140px">2026-09-22</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">Federal Bureau of Investigation (FBI)</td><td style="min-width:140px">Shiny Hunters</td><td style="min-width:140px">psychiatric care records, medical examination records, Social Security numbers, job aptitude test results, electrocardiogram results, staff information</td><td style="min-width:140px">5000</td><td style="min-width:140px">Oracle PeopleSoft zero-day vulnerability</td><td style="white-space:nowrap"><a href="https://www.newsweekjapan.jp/articles/-/335197" target="_blank" rel="nofollow">https://www.newsweekjapan.jp/articles/-/335197</a></td></tr><tr><td>6</td><td style="min-width:240px">Social Security Administration Data Breach</td><td style="min-width:140px">United States</td><td style="min-width:140px">2024-08-19</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">DOGE entered the Social Security Administration</td><td style="min-width:140px"></td><td style="min-width:140px">Social Security numbers, personal information</td><td style="min-width:140px">2900000000</td><td style="min-width:140px"></td><td style="white-space:nowrap"><a href="https://www.163.com/dy/article/L7017Q0R05118UGF.html" target="_blank" rel="nofollow">https://www.163.com/dy/article/L7017Q0R05118UGF.html</a></td></tr><tr><td>7</td><td style="min-width:240px">Manchester Airports Group Data Breach by FulcrumSec Exposing 8.8 Million Passenger Records</td><td style="min-width:140px">UK</td><td style="min-width:140px">2026-08-27</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">breached the IT system of Manchester Airports Group (MAG) on August 22 and 23.</td><td style="min-width:140px">FulcrumSec</td><td style="min-width:140px">email addresses, phone numbers, vehicle registrations, postcodes, travel plans, booking details, purchasing history, browsing device data</td><td style="min-width:140px">8,800,000</td><td style="min-width:140px">exposed Iterable API credentials in client-side JavaScript</td><td style="white-space:nowrap"><a href="https://news2world.net/obzor-mirovyh-novostej/hakeri-opublikovali-v-darknete-lichnie-dannie-britanskih-politikov-i-voennih.html" target="_blank" rel="nofollow">https://news2world.net/obzor-mirovyh-novostej/hakeri-opublikovali-v-darknete-lichnie-dannie-britanskih-politikov-i-voennih.html</a></td></tr><tr><td>8</td><td style="min-width:240px">McKesson Data Breach Exposes 284 Million Records</td><td style="min-width:140px">Texas, United States</td><td style="min-width:140px">2026-08-28</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">cyberattack on McKesson, a major U.S. pharmaceutical distribution company</td><td style="min-width:140px">ShinyHunters</td><td style="min-width:140px">names, addresses, Social Security numbers, diagnoses, medications, allergies, patient notes, dates of birth, phone numbers, email addresses</td><td style="min-width:140px">284,000,000</td><td style="min-width:140px">voice phishing and social engineering</td><td style="white-space:nowrap"><a href="https://techweekly.co.za/2026/09/01/hackers-allegedly-steal-millions-of-patient-records-in-data-breach-at-healthcare-leader-mckesson" target="_blank" rel="nofollow">https://techweekly.co.za/2026/09/01/hackers-allegedly-steal-millions-of-patient-records-in-data-breach-at-healthcare-leader-mckesson</a></td></tr><tr><td>9</td><td style="min-width:240px">Pentagon Data Breach Exposes Personal Data of Over 3 Million Defense System Personnel</td><td style="min-width:140px">United States</td><td style="min-width:140px">2026-09-29</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">The Pentagon's human resources system suffered a large-scale security breach</td><td style="min-width:140px">unauthorized users (not identified)</td><td style="min-width:140px">social security numbers, personally identifiable information, sensitive administrative data</td><td style="min-width:140px">3,054,000</td><td style="min-width:140px">vulnerability in DMDC file-sharing system</td><td style="white-space:nowrap"><a href="https://www.goldring.ro/ro/news/scurgere-masiva-de-date-la-pentagon-peste-trei-milioane-de-persoane-din-sistemul-de-aparare-american-au-fost-afectate" target="_blank" rel="nofollow">https://www.goldring.ro/ro/news/scurgere-masiva-de-date-la-pentagon-peste-trei-milioane-de-persoane-din-sistemul-de-aparare-american-au-fost-afectate</a></td></tr><tr><td>10</td><td style="min-width:240px">Gangnam Unni Data Breach Exposes Personal and Medical Data of 219,665 Users</td><td style="min-width:140px">South Korea</td><td style="min-width:140px">2026-09-07</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">Healing Paper, the operator of Gangnam Unni, a cosmetic medical information platform, has suffered a data breach</td><td style="min-width:140px">hackers</td><td style="min-width:140px">names, phone numbers, email addresses, dates of birth, gender, country and region of residence, social network login IDs, IP addresses, device information, consultation photos, medical records, payment details</td><td style="min-width:140px">219,665</td><td style="min-width:140px">API vulnerability exploitation</td><td style="white-space:nowrap"><a href="https://www.163.com/dy/article/L6GD2KA205567N48.html" target="_blank" rel="nofollow">https://www.163.com/dy/article/L6GD2KA205567N48.html</a></td></tr><tr class="row-locked"><td>11</td><td style="min-width:240px">Qilin Ransomware Gang Discloses Cyber Attack on Bureau of Alcohol, Tobacco, Firearms and Explosives</td><td style="min-width:140px">United States</td><td style="min-width:140px">2026-08-26</td><td style="min-width:140px">ransomware</td><td style="min-width:140px">Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)</td><td style="min-width:140px">Qilin</td><td style="min-width:140px">investigation target names, phone numbers, IP addresses, iCloud data, phone dumps, SIM card data, account identifiers</td><td style="min-width:140px"></td><td style="min-width:140px"></td><td style="white-space:nowrap"><a href="https://0xzx.com/2026090209086434226.html" target="_blank" rel="nofollow">https://0xzx.com/2026090209086434226.html</a></td></tr><tr class="row-locked"><td>12</td><td style="min-width:240px">Tving Personal Data Breach Exposes 39.54 Million Accounts</td><td style="min-width:140px">South Korea</td><td style="min-width:140px">2026-09-03</td><td style="min-width:140px">data_breach</td><td style="min-width:140px">About 40 million user accounts were exposed in the Tving personal data breach, an investigation has found.</td><td style="min-width:140px"></td><td style="min-width:140px">user IDs, passwords, CJ Group integrated IDs, full names, mobile phone numbers, email addresses, dates of birth, connection information, payment histories</td><td style="min-width:140px">39,540,000</td><td style="min-width:140px">stolen developer access key</td><td style="white-space:nowrap"><a href="https://mbiz.heraldcorp.com/article/10861686" target="_blank" rel="nofollow">https://mbiz.heraldcorp.com/article/10861686</a></td></tr></tbody></table></div>
<h3>What is the difference between this and Have I Been Pwned?</h3><p>Have I Been Pwned focuses on individual credential exposure. This tracker covers corporate breach events – affected company, breach scope, attack type, and regulatory notification – making it suited to enterprise risk monitoring rather than personal account checks.</p><h3>Are healthcare and financial sector breaches included?</h3><p>Yes. HIPAA-covered healthcare breaches appear via HHS breach portal notifications; financial institution incidents come from SEC filings and sector-specific reporting.</p><h3>How does CatchAll validate a breach before including it?</h3><p>Inclusion requires at least one authoritative source – a regulatory filing, company press release, or official notification. Unconfirmed reports from security researchers or forums are excluded.</p><h3>What is the refresh rate of this dataset?</h3><p>We rerun this dataset once a month. You can create your own dataset that updates as frequently as every one hour on <a href="https://platform.newscatcherapi.com/catchall">platform.newscatcherapi.com/catchall</a></p>