UK Legal Aid Agency says about 250,000 records stolen in its April 2025 breach predate 2007, the oldest from 1978. The bulk of the data still falls between January 2007 and 16 May 2025, three years earlier than the 2010 start the agency confirmed in May.
Perspective Coverage
4 publishers
- Builder
- Builder 5%
- Operator
- Operator 74%
- Investor
- Investor 21%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives45
- Confidence74
Burger King Japan says attackers who accessed its app member system from Oct 2 to 7 reached 11.18 million customer records, and the data has leaked online. The company warned affected customers to watch for emails, SMS messages and calls that may impersonate it.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence66
Anne Arundel County says an intruder copied files from its systems
Anne Arundel County, Maryland, confirmed that an unauthorized actor copied files from its systems after detecting activity on August 28. The Rhysida ransomware gang claimed the attack, but the county has not said what was taken or whether residents are affected.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives55
- Confidence50
CenterPoint Energy told the Texas Attorney General that a breach compromised Social Security and driver's license numbers of 1,062,060 Texans. A forum actor claimed 7.49 million records; the all-state total is unclear.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence62
Eiliko robot toy backend exposed 13 million conversations to a hacker, The Verge reports
Energize Lab left the cloud service behind its Eiliko robot toy unprotected, exposing 13 million conversations, The Verge reported. For buyers and builders of companion toys, the first test is whether one account can read another's records.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
South Korean regulators have confirmed breaches at 16 financial companies from one hacking campaign and estimate about 100,000 items of personal data leaked. They plan to make every firm list its externally connected systems and to spell out how chief executives are held accountable for security.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 51%
- Investor
- Investor 27%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
Asos hackers reached Snowflake through an employee's login, City AM reports
Attackers who threatened millions of Asos customers got into its Snowflake-hosted data by posing as an employee's trusted contact, City AM reports. Its report names ShinyHunters for H&M alone among Asos, H&M and TFG, so a shared method across the three is unconfirmed.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
Denmark's CPR administration says abuse of a company's authorized register access exposed data on about 8.8 million people. TV 2 reports the login, with the password 123456, was tied to a former employee of Pays ApS.
Perspective Coverage
5 publishers
- Builder
- Builder 24%
- Operator
- Operator 52%
- Investor
- Investor 24%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence66
TFG London identified a cybersecurity incident on Sunday 11 October that hit IT systems at Phase Eight, Hobbs and Whistles. TFG says it has no reason to believe payment information is at risk, and the Independent counts it as the second UK retailer hack in a week.
Perspective Coverage
9 publishers
- Builder
- Builder 5%
- Operator
- Operator 68%
- Investor
- Investor 27%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence72
South Korea's Financial Services Commission said about 100,000 cases of personal data leaks are presumed across 16 financial institutions. The affected firms are still checking for further breaches, so the figure is an interim count.
Perspective Coverage
3 publishers
- Builder
- Builder 8%
- Operator
- Operator 72%
- Investor
- Investor 20%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence65
The FBI confirmed a contractor's failure to apply a critical Oracle PeopleSoft patch, CVE-2026-35273, led to a breach affecting thousands of employees. Any organisation that outsources PeopleSoft operations is exposed in the same way wherever its operator has not installed the fix.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence70
FBI drops Accenture as contractor over unpatched PeopleSoft that ShinyHunters breached
FBI dropped Accenture last week for failing to patch the Oracle PeopleSoft platform ShinyHunters breached, Reuters reported. Google separately says attackers hijacked the .as, .gh and .sl registries.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence45
Curaçao regulator says hacked portal will not return, targets Oct. 9 for details of interim solution
Curaçao's gaming regulator said Oct. 7 its hacked licensing portal will not return, then posted no interim plan by its own Oct. 9 target. Existing licenses stay valid on its account, so the gap is in filings.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
Daiichi Kosho, Japan's largest karaoke maker, says malware at Nippon Columbia, one of its contractors, left more than 8.7 million records on its customers and employees exposed. The data sat with the contractor, so one infected workstation there put 8.6 million karaoke customers in scope.
Perspective Coverage
4 publishers
- Builder
- Builder 21%
- Operator
- Operator 55%
- Investor
- Investor 24%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence62
Air France-KLM confirms a breach the Asos attackers say is theirs
Air France-KLM confirmed to City AM that unauthorised access reached internal folders despite mandatory multi-factor authentication. The airline did not name an attacker, so the tie to Xuanye Group, the Asos claimant, rests on the group's own posts.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives65
- Confidence45
iRhythm, maker of the Zio patch, says attackers who social-engineered access to third-party-hosted apps took data on at least 360,000 patients. The records link patients' insurance numbers to their device serial numbers, enough detail for a caller to pass as the company.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence68
Japan's FSA pushes banks from driving licences toward chip IDs after 20-plus corporate cyber incidents
Japan's FSA on 9 October called on banks to speed up chip-based IDs for new accounts, after over 20 major companies reported cyber incidents. The agency's examples are passports and MyNumber cards, so new-account identity checks are where the breach response reaches banks.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence50
Block's Cash App security settlement pays about $139 a claim to roughly 6% of filers
Block's $15 million Cash App security settlement starts paying claimants in October 2026 after approving about 40,380 of more than 667,000 claims. Approved claims are valued at about $5.6 million so far, little more than a third of the fund Block agreed to.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence60
President Lee Jae Myung says AI appears to have been used in hacks on South Korean banks that leaked data on at least 25,000 Shinhan customers. If his claim that AI removes the need for specialized skills holds up, banks should plan for many more attackers.
Perspective Coverage
18 publishers
- Builder
- Builder 32%
- Operator
- Operator 52%
- Investor
- Investor 16%
Reality
- Evidence70
- Adoption35
- Hype gap+20
- Incentives55
- Confidence64
Japan's FSA asks banks and crypto exchanges to drop photo-ID checks before the 2027 deadline
Japan's FSA asked banks and crypto exchanges to swap photographed-ID checks for IC-chip reading now, ahead of an April 1, 2027 deadline. The request follows a Times Car breach of about 1.6 million license images, Cryptopolitan reported, and leaves each firm to decide whether to pay for the switch this year or wait for the law.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence40
Earlier coverage
- Asos widens its breach disclosure after hackers share a data sample with the BBC
Leadership · October 8, 2026 · Confirmed2 publishers
- Revolut will pay for new IDs after sending 680 customers' data to a hijacked Italian police email
Invest · October 8, 2026 · Confirmed2 publishers
- Attackers' servers held 960,000 member records from Korea's Yoido Full Gospel Church
Invest · October 6, 2026 · Confirmed3 publishers
- Denmark says hackers reached 8.8 million people's records through a company's register access
Security · October 6, 2026 · Confirmed15 publishers
- Rhysida gives Berlin seven days before it auctions 5.79TB of city data
Security · September 5, 2026 · Confirmed3 publishers
- One phishing click let attackers copy over 150,000 foster-care reports from Arizona court backups
Security · September 30, 2026 · Confirmed6 publishers
- Korean regulators put about 500 financial firms on emergency security deadlines after seven breaches
Invest · October 4, 2026 · Confirmed2 publishers
- FSC chief Lee Eok-won promises strict accountability for whichever Korean lender is breached next
Invest · October 4, 2026 · Confirmed2 publishers
- Korea orders every bank and card firm to audit exposed systems after leaks at four lenders
Invest · October 3, 2026 · Confirmed2 publishers
- Pentagon personnel agency discovered the file-server flaw nine months after intruders began using it
Security · September 29, 2026 · Confirmed7 publishers
- Pentagon breach exposes the job specialties of 2.8 million current and former personnel
Product · October 1, 2026 · Confirmed2 publishers
- Arizona's court system says hackers copied residents' data without deploying ransomware
Security · October 1, 2026 · Confirmed2 publishers
- Ransomware at Tokyo rail operator Keio reaches the group's hotel business
Security · September 30, 2026 · Confirmed4 publishers
- ShinyHunters' leak samples expose named FBI agents' medical exams
Security · September 28, 2026 · One report1 publisher
- Beacon cannot tell what the attacker took, so 1,000-plus charities must assume everything
Security · August 14, 2026 · Confirmed2 publishers
- RingCentral's platform held. Its customer records are on the internet anyway.
Security · August 14, 2026 · Confirmed3 publishers
- SafePal's breach came through an order-tracking plug-in, and that is the point
Product · August 16, 2026 · Confirmed3 publishers
- Stolen logins, not a SaaS breach: nine enterprises' Entra directories are now for sale
Security · August 17, 2026 · Confirmed5 publishers
- SafePal's leaked order book is a target list: 39,798 wallet buyers, with addresses
Security · August 16, 2026 · Confirmed8 publishers
- Heights Finance says its loan systems held. 1.2 million records went anyway.
Security · August 18, 2026 · Confirmed5 publishers
- The counter scan that cleared a customer for entry is now for sale by name
Product · September 2, 2026 · Confirmed7 publishers
- MAG's car park and airport Wi-Fi systems gave up 8.7 million identity records
Security · August 28, 2026 · Confirmed6 publishers
- Nexus sells 153 million license scans that Krebs traces to a Louisiana IDV vendor
Security · September 1, 2026 · Confirmed7 publishers