October 2026 brought new breach notices from TELUS Digital, Times Mobility, Frontline Education and Fakturownia plus urgent federal patch warnings. The key takeaway is that stolen third-party credentials, public databases and exploited network flaws caused most harm.
A breach notice is a company statement that unauthorized access exposed stored data. A security advisory is a vendor or agency warning to patch a flaw under attack. This roundup explains who is affected, what was exposed and what to do now.
Table of Contents
- Which companies disclosed breaches?
- What personal information was exposed?
- Why did exposed cloud databases matter?
- Which flaws drew urgent patch warnings?
Which companies disclosed breaches?
TELUS Digital confirmed a breach after ShinyHunters claimed theft of close to 1 petabyte of company and customer BPO data, according to BleepingComputer the breach confirmation. Attackers used Google Cloud credentials taken from the Salesloft Drift compromise to reach BigQuery, then pivoted with TruffleHog-found secrets. Times Mobility confirmed unauthorized access behind Times Car affecting about 6.6 million accounts, according to Hackread and IT Security News the Times Car account report.
Frontline Education began notifying US school districts on Oct 1 2026 after an exploited third party exposed employee data, according to Threadlinqs. Polish invoicing platform Fakturownia confirmed a database breach affecting every account and reported to regulators, according to UndercodeNews. It began individual GDPR Article 34 notices on Oct 1 2026 at about 15:50.
What personal information was exposed?
Exposed Times Car fields included names, addresses, birth dates, phones, emails, license data and passwords in non-recoverable form, according to Security Boulevard. Credit-card information was not affected, which limits direct payment-fraud risk. About 1.6 million identity records included driver-license images and verification documents, according to Hackread and IT Security News.
Frontline's incident exposed school-employee Social Security numbers, emails and physical addresses for district HR and student-administration users, according to Threadlinqs. TELUS Digital's case involved company and customer BPO data in cloud analytics systems, according to BleepingComputer. Social Security numbers and license images carry higher identity-fraud risk because replacements are difficult.
Why did exposed cloud databases matter?
UpGuard found about 16,000 Supabase-hosted databases publicly exposing personal data, according to TechCrunch. Examples spanned an Indian streaming site, US valet plates and immigration-service contacts, with names, addresses, phone numbers, passwords and some auth tokens readable. The cause was customer misconfiguration that left databases open to the web.
The count measures readable databases, not people or records, and does not show when each became readable or how long exposure lasted, according to RuntimeWire. That limit matters because risk depends on access logs and data sensitivity. Customers should act now:.
- restrict public database access and require authentication
- rotate exposed passwords and auth tokens
- audit access logs for unknown reads
Which flaws drew urgent patch warnings?
CISA added Fortinet FortiMail CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on Oct 1 2026, according to CISA via CyberInsider the FortiMail zero-day warning. The catalog lists flaws seen in attacks that require fixes by a deadline. This path-traversal flaw lets unauthenticated attackers write files and gain remote code execution, with a federal fix deadline of Oct 4.
CISA added Cisco Catalyst SD-WAN Manager CVE-2026-76504 on Sep 30 2026 after observed exploitation, according to Security Affairs. It is a CVSS 9.8 session-authentication bypass that allows remote admin access without credentials, with federal remediation due Oct 3 2026. CISA also added Apple CoreGraphics CVE-2026-86950 affecting iOS, iPadOS and macOS, with Apple updates released and federal deadline Oct 2 2026.
You Might Also Like
- How to Verify Government Data Breach News Claims in 2026: breach notices and security advisories, Evidence, and Red Flags
- Government Data Breach News Explained for 2026: Who It Affects, Key Evidence, and What to Do Next
- Government Data Breach News 2026 Guide: exposure, response, and recovery; Key Facts and Questions to Ask