Denmark's Central Population Register (CPR) has confirmed a data breach affecting approximately 8.8 million registered individuals. The exposed data includes sensitive personal information, prompting warnings of increased risks for identity theft, phishing, and social engineering. Official details regarding the root cause and specific data elements remain under investigation.
The Technical University of Denmark (DTU) has confirmed a cybersecurity incident involving unauthorized access to its identity and access management (IAM) system. According to reports, hackers gained access to the system and downloaded a large amount of data, potentially exposing the personal information of up to 200,000 users. The university states the breach occurred prior to disclosure, and ongoing investigations are assessing the exact nature and scope of the exposed data.
Frontline Education notified affected school districts of a data breach where unauthorized access to employee information, including Social Security numbers, was gained through a vulnerability in third-party software. The incident impacts districts utilizing Frontline's services, with potential risks of identity theft and fraud for affected individuals.
The U.S. Department of Defense notified current and former military service members that their personal and personnel data was compromised in a breach of the Pentagon's Defense Manpower Data Center (DMDC) human resources management system. The breach, which occurred in October 2025, affected over 3 million individuals. Notifications to affected parties began around October 1, 2026. The specific threat actor, vulnerability exploited, and full extent of data stolen remain under investigation.
Times Car, a Japanese car-sharing service, has confirmed a data breach compromising approximately 6.6 million user accounts. The incident was disclosed late last week, with the exact attack vector and nature of exposed personal information yet to be fully specified. Authorities and the company are reportedly investigating the breach.
Security researchers have identified more than 16,000 Supabase-backed applications with publicly accessible databases. The exposure stems from default allow rules that permit unrestricted read access to tables containing personally identifiable information, passwords, and authentication tokens. The findings highlight the risk of misconfigured backend-as-a-service platforms when security defaults are not adjusted for production use.
The Swedish Authority for Privacy Protection (IMY) has levied a fine of $183,000 (SEK 1.8 million) against IT systems provider Miljödata following a data breach in August 2025 that exposed the personal information of approximately 2.2 million individuals. The decision underscores the regulator's focus on organizational accountability for data security failures.
Gyazo, a popular image-sharing platform, has confirmed a data breach in which attackers exploited a server vulnerability to steal 23.6 million user records. The breach was reported on September 18, 2026, and may involve personal data. The exact nature of the vulnerability and the specific data types remain unconfirmed.
Gyazo, the image-sharing service operated by Kyoto-based Helpfeel Inc., confirmed a data breach exposing approximately 23.62 million user records and 490 million image metadata records. The incident, disclosed in a notice published Wednesday, involved the exposure of email addresses, password hashes, and image link IDs. The company stated it is investigating the incident and implementing security measures.
CenterPoint Energy, a major U.S. utility provider, has confirmed a data breach that compromised some customers' personal information. The disclosure follows an attacker leaking data allegedly stolen from the company. The full scope of the incident remains unclear, and the company is advising customers to monitor their accounts.
Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. The incident stems from a VPN flaw that allowed unauthorized access to personnel databases. The agency has remediated the vulnerability and initiated a review of access controls. The full scope and exploitation method remain under investigation, with figures considered preliminary.
Revolut has disclosed a data breach in which customer financial information and passport data was shared with a threat actor who impersonated a government agency. The exact number of affected customers remains undisclosed. The incident was reported by BleepingComputer on 2026-09-14.
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that its DAVID driver database was breached after attackers used credentials belonging to a police department employee. The incident, disclosed on September 11, 2026, involved unauthorized access to driver personal information, though the exact number of affected records has not been specified. FLHSMV is conducting an incident response and reviewing access controls.
IDScan, an identity verification company, has confirmed that hackers accessed customer data stored in its cloud platform, following reports linking the company to a massive database containing over 153 million driver's license scans. The breach potentially exposes sensitive personal information, and the full scope remains under investigation.
Veradigm, a healthcare technology company, has disclosed a data breach involving patient personal data. The incident stems from a cybersecurity event at one of the company's third-party vendors, which was claimed by a ransomware group. The exact scope of data exposed and the vendor's identity have not been specified in initial reports.
AdaptHealth, a major healthcare services provider, has confirmed a data breach affecting approximately 4.1 million individuals. The incident, discovered in July 2026, was attributed to the ShinyHunters threat group. The breach exposed personal and health information, raising concerns about identity theft and medical fraud.
The ShinyHunters extortion group has publicly claimed responsibility for breaching the Florida Department of Motor Vehicles' "DAVID" online platform, asserting the theft of more than 200,000 driver records. As of reporting, the Florida DMV and independent sources have not confirmed the intrusion or verified the volume and sensitivity of the alleged data.
A cloud-based Advance Passenger Information System (APIS) database linked to Vietnam was found exposed on the internet, containing approximately 220 million records of passenger and crew data. The leak included sensitive personally identifiable information such as names, passport numbers, dates of birth, nationalities, and flight details dating from 2017 to 2026. Researchers discovered the exposed system through a cloud-based path using default credentials. The database has since been secured or taken offline following disclosure, though the exact owner and origin of the data remain unconfirmed.
Online maths learning platform Mathspace disclosed a data breach affecting more than 1 million students, staff, and parents. Attackers gained unauthorized access to the organization's Metabase internal reporting system and exfiltrated data. The full scope of categories of information accessed and the initial intrusion method remain under investigation.
Trezor has confirmed that an August 2026 data breach at its shipping and logistics provider, ShipMonk, has affected approximately 67,000 additional U.S. customers, bringing the total number of impacted Trezor users to 81,000. The incident underscores the risks associated with third-party vendor dependencies in the cryptocurrency hardware wallet supply chain.
Trezor has disclosed that a breach at its shipping provider ShipMonk compromised personal data of approximately 67,000 U.S. customers. The exposed information includes names, email addresses, phone numbers, shipping addresses, and order numbers dating from November 2019 to August 2021. Trezor emphasized that the breach does not impact the security of its hardware wallets or private keys.
Multiple class-action lawsuits have been filed against identity verification company IDScan following allegations of a data breach impacting over 153 million driver's license records. Plaintiffs claim the company failed to adequately protect sensitive personal information, while hackers allegedly breached the service and offered to sell the dataset. The incident, reported by BleepingComputer on September 4, 2026, raises concerns about identity theft and fraud risks for affected drivers.
Threat actors exploited unpatched vulnerabilities in ownCloud to gain initial access to the Philippines Nuclear Research Institute, resulting in the exfiltration of reactor databases, personnel records, and credential stores. The incident underscores the risk of delayed patching in critical infrastructure environments.
Thomson Reuters disclosed a data breach affecting its West Publishing Corporation's C-Track court case management platform. An unauthorized party obtained files from the system in March 2026, with discovery occurring on June 30, 2026. The breach impacts courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. Potential data exposure includes Social Security Numbers and sealed judicial information, though specific victim counts and verification status remain unconfirmed.
