Privacy Unpacked

Updated hourly

Major data breaches: what we know

Every breach of 100,000 people or more first reported in the last 90 days. Each page says what is established and by whom, what is not known yet, the company’s record, and what to do if your data was in it.

Major breaches, 90 days
141
Confirmed
99
Largest
335,000,000
  1. Maileva 22,000,000 Confirmed breach · 14 November 2026 · France · names, addresses, contact information
  2. Yamada Denki 3,500,000 Reported breach · 14 November 2026 · Japan · phone numbers, names, addresses
  3. Monex Securities 1,130,000 Reported breach · 13 November 2026 · Japan · driver’s license numbers, email addresses
  4. City of Osaka 1,000,000 Reported breach · 13 November 2026 · Japan · email addresses
  5. Realdania 195,000 Reported breach · 13 November 2026 · Denmark · email addresses, phone numbers, names
  6. Caixa Econômica Federal 7,600,000 Reported breach · 12 November 2026 · Brazil · phone numbers · not known yet: how it happened
  7. Caixa Seguridade 7,600,000 Confirmed breach · 12 November 2026 · Brazil · email addresses, phone numbers, dates of birth
  8. Japan Chamber of Commerce and Industry 980,000 Reported breach · 12 November 2026 · Japan · email addresses, phone numbers, dates of birth · not known yet: how it happened
  9. Access Dental Management 341,049 Confirmed breach · 12 November 2026 · United States · social security numbers, health insurance details, health and medical information · not known yet: how it happened
  10. YouHack 7,160,849 Confirmed breach · 11 November 2026 · Russia · passwords and logins, email addresses, usernames
  11. Tisza Párt (Tisza Világ alkalmazás) 200,000 Reported breach · 11 November 2026 · Hungary · names, addresses, contact information · not known yet: how it happened
  12. Vrienden van Amstel LIVE 128,000 Reported breach · 11 November 2026 · Netherlands · email addresses, phone numbers, dates of birth
  13. Nitori Holdings 37,620,000 Confirmed breach · 9 November 2026 · Japan · email addresses, phone numbers, dates of birth
  14. PJ&A 13,300,000 Reported breach · 9 November 2026 · United States · not known yet: what was exposed
  15. Shareful 7,500,000 Reported breach · 9 November 2026 · Japan · not known yet: what was exposed
  16. Wills 5,490,000 Reported breach · 9 November 2026 · Japan · email addresses, names, rewards exchange information
  17. Rohto Pharmaceutical 2,797,545 Reported breach · 9 November 2026 · Japan · not known yet: what was exposed
  18. Sega 2,200,000 Confirmed breach · 9 November 2026 · Japan · email addresses, newsletter subscription data
  19. SAS AB 350,164 Reported breach · 9 November 2026 · Sweden · booking references, dates, flight-related information
  20. Casinos Austria 150,000 Reported breach · 7 November 2026 · Austria · email addresses, names, purchase details
  21. Norwegian 144,249 Confirmed breach · 7 November 2026 · Norway · passport numbers, government id numbers, travel data
  22. Perry Johnson Companies 13,000,000 Confirmed breach · 6 November 2026 · United States · social security numbers, health and medical information, financial account and card details
  23. Premise Health Holding 313,046 Confirmed breach · 6 November 2026 · United States · social security numbers, health insurance details, health and medical information
  24. Rassemblement national 121,000 Confirmed breach · 6 November 2026 · France · not known yet: what was exposed and how it happened
  25. Iris Ohyama 7,700,000 Reported breach · 5 November 2026 · Japan · passwords and logins, email addresses, phone numbers
  26. Amplifon (USA) 1,300,000 Confirmed breach · 5 November 2026 · United States · social security numbers, driver’s license numbers, government id numbers
  27. Vanguard Group 14,000,000 Confirmed breach · 4 November 2026 · United States · social security numbers, financial account and card details, dates of birth
  28. Istyle 3,000,000 Reported breach · 4 November 2026 · Japan · email addresses, phone numbers, dates of birth
  29. SMBC Consumer Finance 320,118 Confirmed breach · 4 November 2026 · Japan · driver’s license numbers, email addresses, phone numbers
  30. NTT Docomo 300,000 Confirmed breach · 4 November 2026 · Japan · phone numbers, dates of birth, names
  31. Paycloud Holdings 77,000,000 Reported breach · 3 November 2026 · Japan · email addresses, phone numbers, names
  32. Harvard 850,537 Confirmed breach · 3 November 2026 · United States · email addresses, phone numbers, dates of birth · not known yet: how it happened
  33. Seven-Eleven Japan 160,000 Confirmed breach · 3 November 2026 · Japan · phone numbers, names, addresses
  34. Iris Plaza 7,700,000 Reported breach · 2 November 2026 · Japan · passwords and logins, email addresses, phone numbers
  35. Nojima 7,000,000 Reported breach · 2 November 2026 · Japan · passwords and logins, email addresses, phone numbers
  36. Florida's education department 4,900,000 Reported breach · 2 November 2026 · United States · social security numbers · not known yet: how it happened
  37. Arcadia 3,000,000 Reported breach · 2 November 2026 · Japan · email addresses
  38. Columbia University 2,973,631 Confirmed breach · 2 November 2026 · United States · social security numbers, driver’s license numbers, health insurance details
  39. Suntory Holdings 100,000 Confirmed breach · 2 November 2026 · Japan · email addresses, phone numbers, names
  40. Air India 4,500,000 Reported breach · 1 November 2026 · India · personal data
  41. Club Tourism 4,320,000 Reported breach · 31 October 2026 · Japan · email addresses, phone numbers, dates of birth
  42. Ryohin Keikaku 27,260,000 Confirmed breach · 30 October 2026 · Japan · financial account and card details, email addresses, dates of birth
  43. World 1,200,000 Confirmed breach · 30 October 2026 · customer data
  44. Binance 335,000,000 Confirmed breach · 29 October 2026 · passwords and logins, email addresses, phone numbers
  45. Educational Testing Service (ETS) 5,700,000 Reported breach · 29 October 2026 · United States · dates of birth, names, addresses
  46. Marathon Health 5,687,724 Confirmed breach · 29 October 2026 · United States · social security numbers, health insurance details, health and medical information
  47. Florida Department of Education 4,900,000 Reported breach · 29 October 2026 · United States · social security numbers, email addresses, phone numbers
  48. Revolve Group 1,515,073 Confirmed breach · 29 October 2026 · United States · financial account and card details, names, contact information
  49. General Administration of Public Finance 678,000 Reported breach · 29 October 2026 · France · tax data
  50. compagnie des transports 230,000 Reported breach · 29 October 2026 · France · not known yet: what was exposed
  51. Hippo Analytics 176,128 Confirmed breach · 29 October 2026 · United States · driver’s license numbers, government id numbers, dates of birth
  52. Smart EX 170,000 Reported breach · 29 October 2026 · Japan · email addresses, names, user ids · not known yet: how it happened
  53. Fore 5,700,000 Confirmed breach · 28 October 2026 · Indonesia · customer account data, account data, user account information · not known yet: how it happened
  54. Sony 2,580,000 Reported breach · 28 October 2026 · Japan · passwords and logins, email addresses
  55. Agencia de Gobernanza Electrónica 750,000 Confirmed breach · 28 October 2026 · Moldova · health and medical information, financial account and card details, names
  56. Daekyo 650,000 Reported breach · 28 October 2026 · South Korea · phone numbers, dates of birth, names
  57. Sony Life Insurance 385,000 Reported breach · 28 October 2026 · Japan · phone numbers, dates of birth, names
  58. Bandai Namco 300,000 Reported breach · 28 October 2026 · Japan · email addresses, internal ids · not known yet: how it happened
  59. Yumilink 9,000,000 Reported breach · 27 October 2026 · Japan · email addresses
  60. Sony Network Communications 2,600,000 Confirmed breach · 27 October 2026 · Japan · financial account and card details, passwords and logins, email addresses
  61. Quantum Health 290,792 Confirmed breach · 27 October 2026 · United States · social security numbers, health insurance details, health and medical information
  62. Joshin 6,230,000 Reported breach · 26 October 2026 · Japan · driver’s license numbers, financial account and card details, passwords and logins
  63. Frontline Education 3,085,266 Confirmed breach · 26 October 2026 · United States · social security numbers, passport numbers, driver’s license numbers
  64. Rakuten Travel 2,600,000 Confirmed breach · 26 October 2026 · Japan · financial account and card details, email addresses, phone numbers
  65. UK Biobank 500,000 Reported breach · 26 October 2026 · United Kingdom · not known yet: what was exposed and how it happened
  66. Park24 6,628,007 Confirmed breach · 23 October 2026 · Japan · driver’s license numbers, email addresses, phone numbers · not known yet: how it happened
  67. Hollys 2,760,000 Confirmed breach · 23 October 2026 · South Korea · passwords and logins, email addresses, phone numbers
  68. Loblaw 2,000,000 Confirmed breach · 23 October 2026 · Canada · financial account and card details, email addresses, phone numbers · not known yet: how it happened
  69. Navigate 360 828,537 Confirmed breach · 23 October 2026 · United States · social security numbers, passport numbers, driver’s license numbers
  70. 3 Danmark 400,000 Confirmed breach · 23 October 2026 · Denmark · names, addresses · not known yet: how it happened
  71. Motility Software Solutions 194,755 Confirmed breach · 23 October 2026 · United States · social security numbers, driver’s license numbers, financial account and card details · not known yet: how it happened
  72. Parti communiste français 190,000 Reported breach · 23 October 2026 · France · email addresses, phone numbers, names
  73. Sagawa Express 53,230,000 Reported breach · 22 October 2026 · Japan · personal data
  74. Capcom 12,000,000 Confirmed breach · 22 October 2026 · Japan · passwords and logins, email addresses, dates of birth
  75. University of Copenhagen 525,000 Confirmed breach · 22 October 2026 · Denmark · cpr (national id) numbers, government id numbers, email addresses
  76. Trustbank 4,454,097 Confirmed breach · 20 October 2026 · Japan · passwords and logins, email addresses, phone numbers
  77. I-CAD (French pet register) 2,900,000 Confirmed breach · 20 October 2026 · France · names, cat identification details
  78. Alternative für Deutschland 420,000 Reported breach · 20 October 2026 · Germany · government id numbers, financial account and card details, email addresses
  79. Gîtes de France 117,574 Confirmed breach · 18 October 2026 · France · email addresses, phone numbers, names · not known yet: how it happened
  80. Burger King Japan 11,180,000 Reported breach · 17 October 2026 · Japan · email addresses, phone numbers, dates of birth · not known yet: how it happened
  81. Nikkei 1,830,000 Confirmed breach · 16 October 2026 · Japan · email addresses, phone numbers, dates of birth · not known yet: how it happened
  82. Central Ohio Primary Care Physicians, Inc. (COPC) 1,351,650 Confirmed breach · 16 October 2026 · United States · social security numbers, health and medical information, financial account and card details
  83. Railway 4,800,000 Confirmed breach · 15 October 2026 · Japan · passwords and logins, email addresses, phone numbers
  84. Crunchbase 559,908 Confirmed breach · 14 October 2026 · United States · email addresses, phone numbers, names · not known yet: how it happened
  85. Daiichi Kosho 8,000,000 Reported breach · 12 October 2026 · Japan · personal data · not known yet: how it happened
  86. Sharecare 318,185 Confirmed breach · 12 October 2026 · United States · government id numbers, email addresses, phone numbers · not known yet: how it happened
  87. Ricardo 890,000 Reported breach · 11 October 2026 · Switzerland · not known yet: what was exposed
  88. Blueberry Pediatrics 401,496 Confirmed breach · 10 October 2026 · United States · health insurance details, health and medical information, dates of birth
  89. Neogen 435,963 Confirmed breach · 9 October 2026 · United States · email addresses, phone numbers, names · not known yet: how it happened
  90. Winona County 123,476 Confirmed breach · 8 October 2026 · United States · social security numbers · not known yet: how it happened
  91. Angel One 6,765,054 Confirmed breach · 7 October 2026 · India · government id numbers, financial account and card details, email addresses · not known yet: how it happened
  92. CyrusOne 373,460 Confirmed breach · 7 October 2026 · United States · email addresses, phone numbers, names · not known yet: how it happened
  93. Double Counter 274,922 Confirmed breach · 7 October 2026 · France · email addresses, names, usernames · not known yet: how it happened
  94. Danish Central Person Register (CPR) 8,800,000 Confirmed breach · 5 October 2026 · Denmark · cpr (national id) numbers, government id numbers, dates of birth · not known yet: how it happened
  95. iRhythm Technologies 8,179,772 Confirmed breach · 3 October 2026 · United States · health insurance details, health and medical information, dates of birth
  96. Sheppard, Mullin, Richter & Hampton 204,001 Confirmed breach · 2 October 2026 · United States · social security numbers, driver’s license numbers, government id numbers
  97. Technical University of Denmark (DTU) 200,000 Reported breach · 2 October 2026 · Denmark · cpr (national id) numbers, government id numbers, phone numbers · not known yet: how it happened
  98. Denver Health Medical Plan 238,083 Confirmed breach · 1 October 2026 · United States · health and medical information
  99. World Acceptance 232,401 Confirmed breach · 30 September 2026 · United States · social security numbers, driver’s license numbers, names · not known yet: how it happened
  100. Atlantic Digestive Specialists 173,853 Confirmed breach · 30 September 2026 · United States · health and medical information
  101. DriveWealth 30,000,000 Confirmed breach · 29 September 2026 · United States · social security numbers, financial account and card details, dates of birth
  102. Poppins Payroll Company 246,937 Confirmed breach · 29 September 2026 · United States · social security numbers, financial account and card details, dates of birth
  103. Baltimore Medical System 197,201 Confirmed breach · 29 September 2026 · United States · not known yet: what was exposed and how it happened
  104. City of McMinnville 122,864 Confirmed breach · 29 September 2026 · United States · social security numbers, driver’s license numbers, government id numbers
  105. Saber Healthcare 427,084 Confirmed breach · 25 September 2026 · United States · social security numbers, driver’s license numbers, government id numbers
  106. MedImpact Healthcare Systems 335,281 Confirmed breach · 25 September 2026 · United States · social security numbers, health insurance details, health and medical information · not known yet: how it happened
  107. OneMain Financial Group 122,783 Confirmed breach · 25 September 2026 · United States · social security numbers, names, addresses
  108. Marana Health Center 191,295 Confirmed breach · 23 September 2026 · United States · not known yet: what was exposed
  109. Fairwinds Credit Union 165,054 Confirmed breach · 23 September 2026 · United States · social security numbers, driver’s license numbers, names
  110. LimeLeads 17,838,396 Confirmed breach · 22 September 2026 · United States · email addresses, phone numbers, employers · not known yet: how it happened
  111. Burger King Russia 3,155,792 Confirmed breach · 21 September 2026 · Russia · email addresses, phone numbers, dates of birth · not known yet: how it happened
  112. Ridgeway Pharmacy 258,920 Confirmed breach · 21 September 2026 · United States · health insurance details, health and medical information, financial account and card details
  113. Stitch Connect 113,727 Confirmed breach · 21 September 2026 · United States · health and medical information, dates of birth, names
  114. IDScan.net 13,000,001 Confirmed breach · 18 September 2026 · United States · driver’s license numbers, government id numbers, dates of birth · not known yet: how it happened
  115. Opportune 128,106 Confirmed breach · 17 September 2026 · United States · social security numbers, financial account and card details, names
  116. Call-on-Doc 107,861 Confirmed breach · 17 September 2026 · United States · health and medical information, names · not known yet: how it happened
  117. AngMar Management Services 126,196 Confirmed breach · 16 September 2026 · United States · social security numbers, health insurance details, health and medical information
  118. CenterPoint Energy 1,062,060 Confirmed breach · 14 September 2026 · United States · social security numbers, driver’s license numbers, names · not known yet: how it happened
  119. Paradigm Healthcare Services 970,403 Confirmed breach · 14 September 2026 · United States · health and medical information
  120. Clover Health 138,677 Confirmed breach · 14 September 2026 · United States · health and medical information
  121. Chess.com 4,653,212 Confirmed breach · 13 September 2026 · United States · email addresses, names, usernames · not known yet: how it happened
  122. Cornerstone Staffing Solutions 366,122 Confirmed breach · 11 September 2026 · United States · social security numbers, passport numbers, driver’s license numbers
  123. Catalyst Physician Group 242,121 Confirmed breach · 11 September 2026 · United States · social security numbers, health and medical information, dates of birth
  124. zHealth 128,422 Confirmed breach · 11 September 2026 · United States · health insurance details, health and medical information, names
  125. GI Medicine Associates 264,724 Confirmed breach · 8 September 2026 · United States · social security numbers, health and medical information · not known yet: how it happened
  126. Greenberg Traurig, LLP (“GT”) 150,000 Confirmed breach · 8 September 2026 · United States · social security numbers, dates of birth, names
  127. Hibbett Retail 109,732 Confirmed breach · 8 September 2026 · United States · social security numbers, passport numbers, driver’s license numbers · not known yet: how it happened
  128. Catalyst Brands 187,341 Confirmed breach · 4 September 2026 · United States · social security numbers, passport numbers, driver’s license numbers · not known yet: how it happened
  129. Manchester Airports Group 8,849,657 Confirmed breach · 2 September 2026 · United Kingdom · email addresses, phone numbers, names · not known yet: how it happened
  130. Questel 1,226,209 Confirmed breach · 1 September 2026 · France · email addresses, phone numbers, names · not known yet: how it happened
  131. Healthfirst Bluegrass 139,834 Confirmed breach · 26 August 2026 · United States · social security numbers, health and medical information, dates of birth · not known yet: how it happened
  132. Bell American Group 115,346 Confirmed breach · 26 August 2026 · United States · not known yet: what was exposed and how it happened
  133. Carhartt 12,933,413 Confirmed breach · 25 August 2026 · United States · email addresses, phone numbers, names · not known yet: how it happened
  134. Golf Canada 568,972 Confirmed breach · 22 August 2026 · Canada · email addresses, dates of birth, names · not known yet: how it happened
  135. Premier Medical Group of the Hudson Valley 282,075 Confirmed breach · 21 August 2026 · United States · health and medical information
  136. ASOS US Sales 138,828 Confirmed breach · 21 August 2026 · United States · financial account and card details, passwords and logins, email addresses
  137. HUT American Group 135,007 Confirmed breach · 20 August 2026 · United States · social security numbers, driver’s license numbers, government id numbers · not known yet: how it happened
  138. Oz Hair and Beauty 1,988,331 Confirmed breach · 19 August 2026 · Australia · email addresses, phone numbers, names · not known yet: how it happened
  139. Nebraska Orthopaedic Center (Aesto, LLC) 235,270 Confirmed breach · 19 August 2026 · United States · social security numbers, health and medical information, dates of birth
  140. Fanlore 144,520 Confirmed breach · 19 August 2026 · United States · passwords and logins, email addresses, names · not known yet: how it happened
  141. Apple American Group LLC and Apple American Group II 282,573 Confirmed breach · 18 August 2026 · United States · social security numbers, passport numbers, driver’s license numbers

How this list is made

A breach is listed when an official notice, the company or a news report gives a count of 100,000 or more. Where only US states’ counts of their own residents are known, they are added up and shown as “at least”. Attackers’ claims are never listed: a claim is not proof that data was taken. Counts often grow after the first notice (count drift), so a breach can enter this list days after it was first reported.

Journalists and researchers: everything here is free to use with credit under CC BY 4.0; the data is in the open dataset, and how we check ourselves is in the accuracy audit.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.