# Data breach security incidents · pwn.watch

> Security incidents tagged Data breach (vendor, product, platform or attack type).

Page: https://pwn.watch/t/data-breach · generated 2026-10-22T23:13:41.393Z

## Status (as of 2026-10-22)
- Incidents: 43 (6 live, 4 live and not fully patched, 36 patched)
- Days without a Data breach security incident: 0 (4 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-19

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/data-breach.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/data-breach/feed.xml
- This file: https://pwn.watch/t/data-breach/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Capcom ID breach exposes 11.7M account email addresses](https://pwn.watch/i/capcom-id-breach-oct-2026) ([json](https://pwn.watch/i/capcom-id-breach-oct-2026.json)): high, live, patched, started 2026-10-19
- [TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored](https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor) ([json](https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json)): high, closed, partial, started 2026-10-18
- [OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys](https://pwn.watch/i/opencode-console-provider-key-breach) ([json](https://pwn.watch/i/opencode-console-provider-key-breach.json)): high, live, partial, started 2026-10-17
- [Zeabur breach exposes 3.2M env-var records; company to shut down](https://pwn.watch/i/zeabur-october-2026-breach-shutdown) ([json](https://pwn.watch/i/zeabur-october-2026-breach-shutdown.json)): critical, live, partial, started 2026-10-14
- [Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud](https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026) ([json](https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026.json)): medium, live, patched, started 2026-10-07
- [PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken](https://pwn.watch/i/pingcap-tidb-cloud-breach) ([json](https://pwn.watch/i/pingcap-tidb-cloud-breach.json)): high, live, partial, started 2026-09-09
- [Instructure Canvas Free-for-Teacher breach (ShinyHunters)](https://pwn.watch/i/canvas-instructure-shinyhunters-may) ([json](https://pwn.watch/i/canvas-instructure-shinyhunters-may.json)): high, closed, partial, started 2026-05-01
- [OpenAI employee devices hit via TanStack Mini Shai-Hulud wave](https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud) ([json](https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json)): high, closed, patched, started 2026-05-01
- [LexisNexis breach (FulcrumSec claims React2Shell path)](https://pwn.watch/i/lexisnexis-breach-react2shell-claim) ([json](https://pwn.watch/i/lexisnexis-breach-react2shell-claim.json)): high, closed, patched, started 2026-02-24, CVE-2025-55182
- [European Commission & Dutch authorities hit via Ivanti EPMM zero-days](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach) ([json](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json)): critical, closed, patched, started 2026-02-01, CVE-2026-1340
- [UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)](https://pwn.watch/i/singapore-unc3886-telecom-espionage) ([json](https://pwn.watch/i/singapore-unc3886-telecom-espionage.json)): unknown, closed, partial, started 2026-02-01
- [ShinyHunters leak Crunchbase data (~2M records)](https://pwn.watch/i/crunchbase-shinyhunters-jan) ([json](https://pwn.watch/i/crunchbase-shinyhunters-jan.json)): high, closed, no-fix-needed, started 2026-01-01
- [Mixpanel smishing breach exposes OpenAI API users' names and emails](https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025) ([json](https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025.json)): medium, closed, no-fix-needed, started 2025-11-08
- [Discord support vendor breach exposes ~70,000 government ID photos](https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025) ([json](https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025.json)): high, closed, no-fix-needed, started 2025-10-03
- [Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen](https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025) ([json](https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json)): high, closed, no-fix-needed, started 2025-10-01
- [Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882) ([json](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json)): critical, closed, patched, started 2025-09-29, CVE-2025-61882
- [SonicWall: state actor stole firewall config backups of every cloud-backup customer](https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025) ([json](https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025.json)): high, closed, no-fix-needed, started 2025-09-17
- [F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen](https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025) ([json](https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025.json)): critical, closed, patched, started 2025-08-09
- [Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)](https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025) ([json](https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025.json)): high, closed, no-fix-needed, started 2025-08-08
- [Qantas: 5.7M customers' data stolen from a contact-centre platform](https://pwn.watch/i/qantas-contact-centre-breach-july-2025) ([json](https://pwn.watch/i/qantas-contact-centre-breach-july-2025.json)): high, closed, no-fix-needed, started 2025-06-30
- [Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)](https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025) ([json](https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json)): high, closed, no-fix-needed, started 2025-06-04
- [Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused](https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025) ([json](https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json)): high, closed, no-fix-needed, started 2025-05-11
- [Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale](https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025) ([json](https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json)): high, closed, no-fix-needed, started 2025-03-21
- [Fearless Wallet browser extension leaked private keys for ~20 months](https://pwn.watch/i/fearless-wallet-extension-key-leak) ([json](https://pwn.watch/i/fearless-wallet-extension-key-leak.json)): critical, live, unpatched, started 2025-02-19
- [DeepSeek leaves ClickHouse database open: chat logs and API keys exposed](https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025) ([json](https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025.json)): high, closed, patched, started 2025-01-29
- [BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356) ([json](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json)): critical, closed, patched, started 2024-12-05, CVE-2024-12356
- [Cleo file transfer zero-days exploited by Clop for data theft](https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956) ([json](https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json)): critical, closed, patched, started 2024-12-03, CVE-2024-50623, CVE-2024-55956
- [Internet Archive hacked: 31 million user records stolen](https://pwn.watch/i/internet-archive-breach-31-million) ([json](https://pwn.watch/i/internet-archive-breach-31-million.json)): high, closed, no-fix-needed, started 2024-10-09
- [National Public Data breach: 2.7 billion records with SSNs leaked](https://pwn.watch/i/national-public-data-breach-ssn-leak) ([json](https://pwn.watch/i/national-public-data-breach-ssn-leak.json)): high, closed, no-fix-needed, started 2024-08-06
- [Hugging Face Spaces secrets accessed without authorization](https://pwn.watch/i/hugging-face-spaces-secrets-leak) ([json](https://pwn.watch/i/hugging-face-spaces-secrets-leak.json)): high, closed, no-fix-needed, started 2024-05-31
- [Dropbox Sign (HelloSign) production environment breached](https://pwn.watch/i/dropbox-sign-production-breach) ([json](https://pwn.watch/i/dropbox-sign-production-breach.json)): high, closed, no-fix-needed, started 2024-04-24
- [Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)](https://pwn.watch/i/snowflake-customer-data-theft-unc5537) ([json](https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json)): critical, closed, no-fix-needed, started 2024-04-14
- [Change Healthcare ransomware attack (ALPHV/BlackCat)](https://pwn.watch/i/change-healthcare-ransomware-attack) ([json](https://pwn.watch/i/change-healthcare-ransomware-attack.json)): critical, closed, no-fix-needed, started 2024-02-21
- [Midnight Blizzard breaches Microsoft corporate email](https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach) ([json](https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json)): high, closed, no-fix-needed, started 2024-01-12
- [Xfinity breach via Citrix Bleed: 35.9M customers](https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023) ([json](https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023.json)): high, closed, patched, started 2023-10-16
- [23andMe: credential stuffing exposes 6.9M users' ancestry data](https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023) ([json](https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023.json)): high, closed, no-fix-needed, started 2023-10-06
- [Okta support system breach: HAR files with session tokens stolen](https://pwn.watch/i/okta-support-system-breach-2023) ([json](https://pwn.watch/i/okta-support-system-breach-2023.json)): high, closed, no-fix-needed, started 2023-09-28
- [MGM Resorts and Caesars hit by Scattered Spider](https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023) ([json](https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json)): high, closed, no-fix-needed, started 2023-09-07
- [Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link](https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023) ([json](https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json)): high, closed, patched, started 2023-06-22
- [MOVEit Transfer zero-day: Cl0p mass data theft](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023) ([json](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json)): critical, closed, patched, started 2023-05-27, CVE-2023-34362, CVE-2023-35036, CVE-2023-35708
- [Storm-0558: stolen Microsoft signing key used to read government email](https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023) ([json](https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json)): critical, closed, patched, started 2023-05-15
- [T-Mobile: API abused to pull data on 37M accounts](https://pwn.watch/i/t-mobile-api-breach-37-million-2023) ([json](https://pwn.watch/i/t-mobile-api-breach-37-million-2023.json)): high, closed, no-fix-needed, started 2023-01-05
- [CircleCI breach: rotate every secret](https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023) ([json](https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json)): critical, closed, no-fix-needed, started 2023-01-04