Disclosure tracker › Disclosures in 2026
Intelligence · Disclosure tracker
Disclosures in 2026
Public breach disclosures from regulators, court filings, company notices and news reporting, each recorded with its date and a link to the original. Updated daily.
5,282
Disclosures in the tracker, all years
1,995
Of those, indexed in 2026
41
Added in October
9
Added in the last 7 days
7
Sectors covered
Source: LeakTrace disclosure tracker, 17 Oct 2026. Counts of records in the index, not estimates. Software advisories and security news are not counted.
3,949 results · Disclosures in 2026. Clear filters
Medium14 Jul 2026
Attackers whose methods line up with the data-extortion
Technology · Records not stated
Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform.
The way in…
14 Jul 2026
Medium13 Jul 2026
Organisation not named
Technology · Records not stated
The disclosure as indexed does not name the organisation.
The retailer said the incident did not affect its online shopping platform itself but involved a separately stored customer database maintained by a third-party provider. According to notifications sent to Lidl's…
13 Jul 2026
Medium13 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure.
13 Jul 2026
Medium13 Jul 2026
The Jscrambler client-side web security company
Sector not stated · Records not stated
The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times.
13 Jul 2026
Medium13 Jul 2026
Misconfigured server
Sector not stated · Records not stated
Misconfigured server exposed three phishing operators running Evilginx forks to bypass MFA
13 Jul 2026
Medium13 Jul 2026
Organisation not named
Government · Records not stated
The disclosure as indexed does not name the organisation.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public…
13 Jul 2026
Medium13 Jul 2026
Organisation not named
Sector not stated · 540,000 records
The disclosure as indexed does not name the organisation.
The WorldLeaks extortion group claimed to have stolen 720 GB of data from the healthcare testing and laboratory services provider.
The post Centers Laboratory Data Breach Affects 540,000 Individuals appeared first on…
13 Jul 2026
Medium11 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
Version 8.14.0 of the jscrambler npm package shipped with a malicious preinstall hook that silently drops and runs a native infostealer during installation, one build each for Windows, macOS, and…
11 Jul 2026
Critical11 Jul 2026
Daryna Antoniuk
Government · 6,000,000 records
Daryna Antoniuk reports: Dutch police said Thursday they had uncovered evidence suggesting that Dutch criminals were involved in the cyberattack on telecom provider Odido that exposed the personal data of more than 6…
11 Jul 2026
Critical11 Jul 2026
Brandon Richards
Legal · 2,400,000,000 records
Brandon Richards reports: California resident Sean Mortazi filed a class action lawsuit against TikTok Inc. on June 11, 2026, alleging a data breach exposed the personal data of more than 2.4 billion users worldwide.…
11 Jul 2026
Critical11 Jul 2026
Organisation not named
Legal · Records not stated
The disclosure as indexed does not name the organisation.
PORTLAND, Ore., An Armenian national extradited from Ukraine to the United States pleaded guilty yesterday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the United…
11 Jul 2026
High11 Jul 2026
Glendale Community College
Education · 793,925 records
793,925 records exposed, Academic records, Dates of birth, Email addresses, Genders and 4 more
11 Jul 2026
Medium10 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
CISA reveals how it responded after sensitive AWS GovCloud credentials and internal data were exposed in a public GitHub repository
10 Jul 2026
Critical10 Jul 2026
Organisation not named
Sector not stated · 7,000,000 records
The disclosure as indexed does not name the organisation.
Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA brings back TAO.
The post In Other News: DHS Database Hacked…
10 Jul 2026
Medium10 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
A threat actor has been targeting organizations spanning multiple sectors with voice-based fake security requests that prompt Microsoft 365 users to enroll a new Entra passkey with an aim to carry out data extortion…
10 Jul 2026
Critical10 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operation's inner workings: the hacking tools, the activity logs, and target lists naming more than 1.4…
10 Jul 2026
Critical9 Jul 2026
Organisation not named
Government · 6,000,000 records
The disclosure as indexed does not name the organisation.
Dutch police said Thursday they had uncovered evidence suggesting that Dutch criminals were involved in the cyberattack on telecom provider Odido that exposed the personal data of more than 6 million customers earlier…
9 Jul 2026
Critical9 Jul 2026
Data breach
Finance · 6,900,000 records
Hackers gained access to more than 6.9 million records at AssuranceAmerica by targeting a company employee.
9 Jul 2026
Medium9 Jul 2026
Darktrace
Sector not stated · Records not stated
Darktrace says a LiteLLM AI gateway linked to Amazon Bedrock was compromised for cryptomining after signs of exposed SSH activity.
9 Jul 2026
Medium9 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. [.
9 Jul 2026
Critical9 Jul 2026
Organisation not named
Government · Records not stated
The disclosure as indexed does not name the organisation.
A foreign, financially motivated group was responsible for a cyberattack on state-owned forestry company Latvijas Valsts Mezi (LVM), officials said.
9 Jul 2026
Medium9 Jul 2026
Organisation not named
Technology · Records not stated
The disclosure as indexed does not name the organisation.
A cloud intrusion that ended with the deployment of cryptomining malware has exposed a bigger risk for enterprises: AI gateways that concentrate access to cloud identities, permissions, and foundation models in a…
9 Jul 2026
Medium9 Jul 2026
The Japan Times
Government · Records not stated
The Japan Times reports: An 18-year-old man has been arrested for his suspected involvement in a cyberattack on the operator of the Kaikatsu Club internet cafe chain, according to investigative sources. On Wednesday…
9 Jul 2026
Critical9 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
Hackers exploited a zero-day vulnerability in a third-party system to access a KDDI email system for ISPs.
The post 12 Million Impacted by Data Breach at Japanese Telco KDDI appeared first on SecurityWeek.
9 Jul 2026
Were you affected?