Data breaches in the week of 12–18 October 2026

The largest

1. Burger King Japan 11,180,000 records Japan
2. CPR (Danish national population register) 8,800,000 citizens Denmark
3. Daiichi Kosho 8,000,000 customers Japan
4. Crunchbase 559,908 accounts
5. Sharecare 318,185 accounts United States
6. Gîtes de France 117,574 accounts France

Every breach this week, by country

United States 45

• CenterPoint Energy, Inc. 13 October 2026 · 1,062,060 Texas residents
• Sharecare 12 October 2026 · 318,185 accounts
• AssuranceAmerica Managing General Agency, LLC 16 October 2026 · 88,640 Texas residents
• Austin Independent School District 12 October 2026 · 44,652 Texas residents
• Klein Independent School District 16 October 2026 · 37,966 Texas residents
• The Krum Public Library 16 October 2026 · 34,042 Texas residents
• JM Bullion, Inc. 13 October 2026 · 6,640 Texas residents
• Mercadien PC Certified Public Accountants 13 October 2026 · 5,219 Texas residents
• Stitch Connect Inc 16 October 2026 · 4,062 Texas residents
• Encore Enterprises 16 October 2026 · 1,746 Texas residents
• Terrell Independent School District 12 October 2026 · 1,672 Texas residents
• Delek US Energy, Inc. 16 October 2026 · 1,666 Texas residents
• Porter and Company 13 October 2026 · 1,620 Texas residents
• MLD Mortgage Inc. dba The Money Store 15 October 2026 · 1,367 Texas residents
• Magna Hospitality Group 13 October 2026 · 1,298 Texas residents
• Iroquois Memorial Hospital 14 October 2026 · 1,279 Texas residents
• American Board of Preventive Medicine 13 October 2026 · 955 Texas residents
• EnTrans Holding, Inc. 13 October 2026 · 839 Texas residents
• JM Bozeman Enterprises 12 October 2026 · 602 Texas residents
• Arkansas Hospice Inc. d/b/a LifeTouch Health 13 October 2026 · 564 Texas residents
• The City of Mt. Angel 13 October 2026 · 471 Oregon residents
• Mountrail County Medical Center 16 October 2026 · 456 Texas residents
• American Board of Preventative Medicine 14 October 2026 · 352 Vermont residents
• The Way to My Heart Inc. (Global PAD Association) 18 October 2026 · 7 Vermont residents
• Kymberlie McNicholas 17 October 2026 · 7 Vermont residents
• Catawba County 17 October 2026 · 4 Vermont residents
• Rossby Financial LLC d/b/a Toler Financial group 13 October 2026 · 4 Vermont residents
• BBC International LLC 16 October 2026 · 3 Vermont residents
• Johnson Investment Counsel 16 October 2026 · 2 Vermont residents
• fairlife, LLC 15 October 2026 · 2 Vermont residents
• Murray County 13 October 2026 · 2 Vermont residents
• Ganxxet, Inc. 16 October 2026 · 1 Vermont residents
• Frazer LLP 16 October 2026
• Covered California 16 October 2026
• Inner City Education Foundation 16 October 2026
• CDE 16 October 2026
• John G. Yphantides, a Professional Law Corporation 16 October 2026
• Neuro Wellness Spa 16 October 2026
• City of Foster City 15 October 2026
• BDG Law Group 14 October 2026
• Kern County Superintendent of Schools 14 October 2026
• Tulare Joint Union High School District 13 October 2026
• Park Dental Partners, Inc. 13 October 2026
• Mercadien, P.C. CPAs 12 October 2026
• Xandr 12 October 2026

Japan 3

• Burger King Japan reported 17 October 2026 · 11,180,000 records
• Daiichi Kosho reported 12 October 2026 · 8,000,000 customers
• Nikkei 16 October 2026

United Kingdom 2

• Legal Aid Agency reported 15 October 2026
• Isle of Wight Council reported 15 October 2026

Denmark 1

• CPR (Danish national population register) reported 15 October 2026 · 8,800,000 citizens

Country being checked 1

• Crunchbase 14 October 2026 · 559,908 accounts

France 1

• Gîtes de France 18 October 2026 · 117,574 accounts

Netherlands 1

• Martini Hotel Group reported 16 October 2026 · 15 guests

Canada 1

• Save-On-Foods reported 17 October 2026

Indonesia 1

• Tokopedia reported 13 October 2026

Ransomware claims

Gangs named 326 organisations on their leak sites this week, against 264 the week before. A claim is the gang’s word, not a confirmed breach.

• N0n 84 claims
• The Gentlemen 42 claims
• Qilin 29 claims
• Wallstreet 15 claims
• LockBit 5.0 10 claims
• Akira 9 claims

What regulators did

• Reprimand · UK Information Commissioner’s Office · Ogi Networks Limited The decision 14 October 2026
• Reprimand · UK Information Commissioner’s Office · Local Government Data Unit - Wales The decision 14 October 2026