Intelligence · Disclosure tracker
Every public disclosure, dated and sourced.
Public breach disclosures from regulators, court filings, company notices and news reporting, each recorded with its date and a link to the original. Updated daily.
5,582
Disclosures in the tracker, all years
2,082
Of those, indexed in 2026
146
Added in October
21
Added in the last 7 days
7
Sectors covered
Source: LeakTrace disclosure tracker, 31 Oct 2026. Counts of records in the index, not estimates. Software advisories and security news are not counted.
Worldwide · How they got in
Incidents worldwide, by country.
78 incidents from 12 countries in the last 90 days, each from a public source and reviewed before it is shown. Where the source says how the attackers got in, the row says so.
- United States29 Oct 2026The Research Foundation for Mental Health, Inc.The source does not say how they got in.Vermont Attorney General
- United States29 Oct 2026Del Monte Foods Corporation II Inc.The source does not say how they got in.California Attorney General
- United States29 Oct 2026Bangkok Bank PCL - New York BranchThe source does not say how they got in.California Attorney General
- United States29 Oct 2026IRhythm TechnologiesThe source does not say how they got in.SecurityWeek
- United States28 Oct 2026Photon HealthHow they got in: a known flaw in software the victim ran.California Attorney General
- United States28 Oct 2026CodeSecure Inc.The source does not say how they got in.Vermont Attorney General
- United States28 Oct 202611252227 Canada Inc.The source does not say how they got in.Vermont Attorney General
- United States28 Oct 2026Troutman Pepper Locke LLPThe source does not say how they got in.California Attorney General
- United States28 Oct 2026Legacy CooperativeThe source does not say how they got in.Vermont Attorney General
- United States28 Oct 2026Metro Tulsa Foot & Ankle SpecialistThe source does not say how they got in.Vermont Attorney General
- United States28 Oct 2026Quantum Health, Inc.The source does not say how they got in.Vermont Attorney General
- United States27 Oct 2026Sarasota US Topco, Inc. d/b/a Sarku Japan (“Sarku”)The source does not say how they got in.California Attorney General
Critical25 Sep 2026
US Healthcare Provider (CHC)
Healthcare · 1,000,000 records
Data breach impacting 1 million patients exposed
25 Sep 2026
Critical25 Sep 2026
T-Mobile
Technology · 76,600,000 records
Cyberattack exposed 76.6 million people including SSNs and driver's license info
25 Sep 2026
Critical25 Sep 2026
Kirkland & Ellis
Legal · Records not stated
Law firm affected by MOVEit data breach affecting sensitive client data
25 Sep 2026
Critical25 Sep 2026
Welltok
Healthcare · 14,760,000 records
MOVEit Transfer vulnerability exploitation exposed 14.76 million individuals' patient data
25 Sep 2026
High25 Sep 2026
Mizuno
Retail · Records not stated
Confirmed data breach after 2024 ransomware attack; customer data exposed
25 Sep 2026
Critical25 Sep 2026
Meta
Technology · Records not stated
2018 data breach; EU privacy regulator fined Meta 251 million euros for personal data exposure
25 Sep 2026
Critical25 Sep 2026
Free Mobile and Free
Technology · Records not stated
2024 data breach exposing customer data; French regulator CNIL fined €42-49 million for security vulnerabilities and GDPR violations
25 Sep 2026
Critical25 Sep 2026
Ransomware attack
Healthcare · 1,200,000 records
Ransomware attack exposed personal data of 1.2 million individuals
25 Sep 2026
High25 Sep 2026
US Bank
Finance · Records not stated
Data breach investigated following LockBit ransomware group claim with threat to publish stolen data
25 Sep 2026
Critical25 Sep 2026
Intesa Sanpaolo SpA
Finance · Records not stated
Employee unauthorized access over two years; insider threat resulted in €31.8m fine for data protection failures
25 Sep 2026
High25 Sep 2026
Miljödata
Technology · 2,200,000 records
2.2 million records exposed including sick leave and school data from HR software vendor
25 Sep 2026
Critical25 Sep 2026
Coupang
Retail · 33,700,000 records
33.7 million accounts exposed, resulted in $409 million South Korea fine
25 Sep 2026
Critical25 Sep 2026
Qantas
Sector not stated · 5,670,000 records
Vishing attack via fake IT support exposed 5.67 million customer records
25 Sep 2026
Critical25 Sep 2026
Bankinter/EVO Banco
Finance · Records not stated
API vulnerability exposed 1.27 million financial and identity records in Spain
25 Sep 2026
Medium25 Sep 2026
Cyberattack
Government · Records not stated
Dyfed-Powys Police in Wales said a cyberattack affecting the force disrupted some non-emergency systems and may have compromised staff information.
25 Sep 2026
Critical24 Sep 2026
Organisation not named
Healthcare · 1,200,000 records
The disclosure as indexed does not name the organisation.
2025 ransomware attack exposed personal data of 1.2 million individuals
24 Sep 2026
Critical24 Sep 2026
Marquis Software Solutions
Technology · Records not stated
Ransomware attack exposed 788,000 financial records and sensitive banking customer data
24 Sep 2026
Critical24 Sep 2026
AT&T
Technology · 109,000,000 records
Two separate incidents in 2024 exposed data from over 100 million customers
24 Sep 2026
Critical24 Sep 2026
Intesa Sanpaolo S.p.A.
Finance · Records not stated
Employee unlawfully accessed customer data over two years, serious security shortcomings
24 Sep 2026
Critical24 Sep 2026
UnitedHealthcare
Healthcare · Records not stated
2024 cyberattack exposed sensitive data from millions of patients including health and insurance information.
24 Sep 2026
High24 Sep 2026
AnMed
Healthcare · Records not stated
Cyberattack on nonprofit health system forced facility closures and limited operational capacity
24 Sep 2026
Critical24 Sep 2026
Coupang
Retail · 33,700,000 records
Data breach exposed 33.7 million accounts, resulted in $409 million South Korea fine
24 Sep 2026
Critical24 Sep 2026
Qantas
Sector not stated · 5,670,000 records
Vishing attack on overseas contact center exposed 5.67 million customer records in 2025
24 Sep 2026
Medium23 Sep 2026
Canva
Sector not stated · Records not stated
A new dedicated leak site by threat actors calling themselves “The Seven Deadly Sins” lists Canva Pty Ltd among the sites that haven’t paid them. DataBreaches obtained additional details on the…
23 Sep 2026
Were you affected?