Largest disclosures of 2026

Hackers breached the systems of Russian fast-food chain Dodo Pizza, accessing customer personal details and order histories. A hacking group named DataSuckers claimed responsibility and alleged it had acquired 68 million customer records.

Conduent proposed an $80 million settlement to resolve consolidated class action lawsuits stemming from a major data breach that began in late 2024. The SafePay ransomware group reportedly breached the network and exfiltrated personal and protected health info

Between January 1 and June 30, 2026, 397 data breaches affecting 500 or more individuals were reported to the U.S. Department of Health and Human Services. Across these breaches, the protected health information of 33.77 million individuals was exposed or impe

American Collection Medical Agency clients agreed to a $6.4 million settlement resolving claims over a major historical data breach. The cyberattack targeted AMCA's web payment portal and exposed sensitive personal, medical billing, and financial information f

Image-sharing service Gyazo suffered a major data breach after attackers exploited a vulnerability in an upload server. The incident exposed nearly 24 million customer records along with approximately 490 million image metadata records.

Nearly 20 million individuals had their personal and medical information compromised following a cyberattack on Oracle Health's legacy Cerner systems. The threat actor used stolen customer credentials to access an unmigrated legacy server and attempted extorti

DentaQuest suffered a cyberattack by the ShinyHunters extortion group, which gained unauthorized access to its network in May 2026. The threat actors exfiltrated 234 GB of data and leaked records after ransom negotiations failed, impacting an estimated 15 mill

Japanese gaming company Capcom confirmed a data breach affecting its membership service, CAPCOM ID, which exposed the email addresses and account information of over 11.7 million users. The company detected unauthorized access on October 19 and took immediate

Burger King Japan disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Attackers accessed the system managing membership data between October 2 and October 7, compromising names, contact details, an

Hackers breached the system supporting the official Burger King app in Japan, exposing approximately 11 million user records between October 2 and October 7. The compromised information includes customer names, email addresses, phone numbers, birthdates, gende

A coalition of 44 state attorneys general reached a settlement with Labcorp regarding a major 2019 data breach originating at its debt collection vendor, AMCA. The breach exposed sensitive personal and medical data belonging to more than 10.2 million Labcorp p

Unauthorised parties abused a private Danish company's legitimate lookup access to Denmark's national population register to harvest records over several weeks in September 2026. Names, addresses and CPR identification numbers belonging to about 8.8 million li

An HHS breach portal filing lists the June 2026 iRhythm breach as affecting 8,179,772 people. Hackers took names, addresses, dates of birth, contact details and iRhythm account and device data, including insurance numbers, from third-party-hosted business appl

Park24 suffered a major data leak affecting its Times Car car-sharing service web system. Attackers obtained data on approximately 6.6 million accounts, including identity documents such as driver's license images from about 1.6 million users.

The US Defense Manpower Data Center suffered a data breach after unauthorized users accessed a file-sharing server containing unencrypted personal information for roughly nine months. The breach impacted approximately 2.76 million living individuals and 294,00

Sony Network Communications, a Sony Group internet service provider in Japan, confirmed a breach that occurred on October 19 and was detected four days later. A total of 2,585,481 current and former customer records were exposed.

Nikkei Inc. disclosed a data breach that exposed approximately 1.83 million records, with at least 150,000 containing personal identifiable information. Attackers gained access to a development system stored in the cloud using stolen credentials.

Laboratory Services Cooperative agreed to settle class action litigation following a 2024 data breach that impacted approximately 1.6 million individuals. Unauthorized network activity was detected in October 2024, leading to the exfiltration of sensitive pati

Multiple Ontario police services suspended their use of Crime Stoppers following a major data breach involving third-party software provider Navigate360. Hackers stole anonymous tip data from the P3 platform, potentially exposing the personal details of thousa

Central Ohio Primary Care Physicians suffered a voice phishing attack that compromised internal systems and led to data theft. The incident affected the personal and protected health information of approximately 1.4 million current and former patients.

A cyberattack on Arizona's court system compromised sensitive data belonging to more than 1.3 million people, including records from a restitution enforcement program and foster care reports. Investigators determined the breach was initiated after a court empl

CenterPoint Energy notified authorities that customer personal information was compromised following a data breach. The stolen data includes names, addresses, Social Security numbers, and driver's license numbers for over 1 million Texas residents.

Paradigm Healthcare Services found unauthorized access to its local network in October 2025 and has only now started notifying affected people. Files containing protected health information of about 970,000 Medi-Cal members may have been accessed between Octob

Former medical transportation provider Transformative Healthcare and its subsidiaries agreed to a $1 million settlement following a major data breach and billing fraud allegations. An unauthorized third party accessed systems containing the protected health in