This week's data breach reports span healthcare, gaming, public safety tips, rail freight and IT services. The incidents differ in size and cause. Several involve Social Security numbers and in many cases the gap between the intrusion and the notice was long. Here is what the reports say.
Quest Diagnostics Data Breach Affects Patient Records
Quest Diagnostics confirmed a cyberattack in an 8-K filing with the U.S. Securities and Exchange Commission. The company said it learned of the attack on Wednesday. It targeted Quanum, a system that lets doctors' offices, hospitals and healthcare practices request lab tests for patients and handle billing.
Quest said the unauthorized access included the accessing of "certain patient records." The amount of information affected has not been specified. Quest notified law enforcement and is investigating.
Crime Stoppers Data Leak and the Capcom Credential Exposure
Canada's privacy commissioner opened an investigation into a Crime Stoppers data breach. CBC reported that 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years were exposed when Navigate360 was hacked in March. Navigate360 manages the platform Crime Stoppers uses. The company confirmed the breach last week. Police forces across Ontario temporarily paused directing public calls to Crime Stoppers.
Capcom confirmed that its Capcom ID membership service had unauthorized access by a third party. The company said the incident began on October 19. More than 11.7 million users were affected. The exposed data included account emails. For 43 accounts it also included birth date, gender, country or region and nicknames. Capcom also reported unauthorized changes to 196 account passwords. It said credit card information was not included. Users may see more phishing scam emails.
Business Data Breach Notices: CSX, Fourteen Foods, CTG and Covered California
CSX disclosed two separate incidents. In the second, a CSX employee responded to a vishing call on May 29, 2026. An unauthorized party then gained access to the company's environment. Between May 29 and June 9, that party accessed and acquired certain files. On August 26, CSX determined that the files contained personal information. This included names, Social Security numbers, driver's license numbers and bank account and routing numbers.
Fourteen Foods, which operates Dairy Queen Grill & Chill locations, said an unauthorized third party copied files between February 19 and February 25, 2026. The exposed information included names and Social Security numbers. Notices began on October 22, with 12 months of free credit monitoring offered.
CTG, an IT services company, said an unauthorized party copied files from its network on September 26. The data included names, Social Security numbers, direct deposit account information, government ID numbers and health insurance member ID numbers or other health plan data. Letters began going out on October 19. Individuals must enroll in the offered services within 90 days of the date on their notice letter.
Covered California agent data was exposed in a phishing attack on May 13, according to a breach notice posted on the California attorney general's website on October 16. The spreadsheets included agents' names, license numbers, roles within insurance agencies and Social Security numbers or federal employment identification numbers. The notice did not say how many people were affected. It did not include an offer of identity theft protection services.
What Individuals Should Do
- Read every notice letter you receive. Note the types of information listed.
- Enroll in any offered monitoring before the deadline. CTG's window is 90 days from the date on the letter.
- If you have a Capcom ID, treat unexpected emails with care. Capcom warned users may see more phishing scam emails.
- Check your accounts and credit reports. This matters most if your Social Security number or bank details were listed.
What Businesses Should Do
- Brief staff on phone based tricks. The CSX incident began when an employee responded to a vishing call.
- Watch for phishing aimed at staff records. The Covered California spreadsheets held Social Security numbers and federal employment identification numbers.
- Ask third party providers what safeguards they have. The Crime Stoppers exposure came through Navigate360, the company that manages the platform. CSX also reported a vendor related incident.
- Review the files you hold on staff and clients. Several of these incidents involved copied files that contained personal information.
What to take from it
For a firm
Brief your staff this week on vishing calls and phishing and ask each third party provider that handles your data what safeguards it has in place.
For a person
Open any breach notice you receive, check which types of information it lists and enroll in any free monitoring offered before the deadline on the letter.