Independent Reporting · Not Legal or Security Advice · Verify With the Breached Company · Editorial Policy
Newspapers spread out showing headlines

Data Breaches October 2026: Every Incident, Confirmed vs. Claimed

by

On Wednesday, October 21, developers spent the evening rotating keys after the app-hosting platform Railway warned that an outsider might have gotten at the secrets its customers store for their apps. It capped a crowded stretch that began in mid-September and reached across three continents: a national ID register in Denmark, a hamburger chain’s app in Japan, a Texas utility, an Arizona court system and a string of health companies.

Where it stands: Below are the data breaches October 2026 has brought so far, current to October 21. The counts below are as reported by the company, a regulator or established press. Where the only number comes from a hacker, a gang or a forum, it is labelled as a claim. Several of these investigations are still open, so figures may move.

Data breaches October 2026: every incident in one table

Dates are when the incident or a key update became public, in 2026. “Confirmed” means the organization or a regulator gave the figure.

Date Incident Count as reported
Oct 21 Railway (developer platform) No count; “subset of users”
Oct 19 Zeabur (developer platform) 3,218,965 env-var records; 321,810 accounts (confirmed)
Oct 19 Ahold Delhaize (grocers) No data theft found
Oct 16 Burger King Japan 11.18 million records (confirmed)
Oct 16 CenterPoint Energy 1,062,060 Texans (confirmed); 7.49 million (forum claim)
Oct 16 ETS / California students No official count
Oct 16 Nikkei 1.83 million records (confirmed)
Oct 11 Daiichi Kosho / Nippon Columbia 8.7 million records exposed; theft unconfirmed
Oct 9 iRhythm At least 360,000; Oregon list 8,179,772
Oct 8 ASOS Not disclosed
Oct 8 Live Nation Two Vermont residents listed; total unknown
Oct 7 Arizona courts 1.3 million people (confirmed)
Oct 7 Advantest Theft confirmed; count not disclosed
Oct 6 Trump Mobile 3,615 people (reported; no company comment)
Oct 5 Southern Company utilities About 400,000 customers (confirmed)
Oct 5 Denmark CPR register About 8.8 million people (confirmed)
Oct 2 DTU university Up to 200,000 users
Oct 2 Frontline Education Unknown total; one district 1,210 staff
Sept 28 Car-sharing service Times Car About 6.6 million accounts (confirmed)
Sept 25 Supabase-hosted apps (UpGuard) About 16,000 exposed databases
Sept 21 Ridgeway Pharmacy 258,000+ (told HHS)
Sept 16 Luminis Health lawsuit “Tens of thousands” alleged
Sept 14 Paradigm Healthcare (Medi-Cal) 970,000+ (told HHS)
Early Sept Tarter Krinsky & Drogin 196,000+ (told HHS)
Sept 9 Veradigm “Small number of customers”; 3.5 million (gang claim)

Do not add these numbers up. Several count records or accounts rather than people, one person can appear in more than one breach, and some figures are only claims.

The largest confirmed disclosures

Denmark’s case stands out because of what was taken: the CPR number is Denmark’s national personal identification number. The ministry says about 8.8 million people’s details were pulled by abusing one company’s legitimate search access. Our Denmark CPR leak explainer covers what the number unlocks and what it does not.

Japan supplied much of the rest of the top of the table. Burger King Japan’s app server held 11.18 million customer records. Times Car confirmed about 6.6 million compromised accounts, and Nikkei says 1.83 million records were stolen, although roughly 1.68 million of those identify no one. We break the cluster down in our Japan data breaches report.

In the U.S., the Arizona Supreme Court said data was copied for 1.3 million people in its court-debt program, after a court employee reportedly clicked a malicious email link. CenterPoint Energy’s filing with Texas’s attorney general counts 1,062,060 Texans; the exposed data includes Social Security information and driver’s license numbers. Southern Company, parent of Georgia Power and Alabama Power, put its count at about 400,000 customers; both utilities are in our utility breach guide.

Claims that are not confirmed

Some of the biggest numbers circulating this month come from people with a reason to inflate them.

  • CenterPoint, 7.49 million. A forum poster claimed that many records. The company’s SEC filing did not confirm it.
  • Veradigm, 3.5 million patients. That figure is the Gentlemen ransomware gang’s claim. Veradigm’s own account is that only a small number of its customers were hit.
  • Trump Mobile, 3,615 people. The figure comes from PCMag and Straight Arrow News reports of a leaked dataset; The Verge got no reply from the company.
  • ASOS. The retailer says names and contact details may be exposed. BBC News, via TechCrunch, reported the stolen data also included home addresses and website search queries. The Xuanye Group behind it has not said how much it holds.
  • Ahold Delhaize. Its U.S. grocery sites went dark, but the company says it has found no evidence that sensitive customer data was taken. It is a disruption, not a confirmed breach.

Developer platforms: three separate cases

Three incidents involve the services developers use to run apps, and each matters to the end users of those apps. Railway said an unauthorized third party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” It has not given a count, and it asks all users to rotate secrets; our Railway incident explainer follows it.

Hosting platform Zeabur published a report on October 19 saying an attacker read its platform database on October 14-15, covering 3,218,965 environment-variable records and 321,810 accounts. Separately, security firm UpGuard told TechCrunch it found around 16,000 Supabase-hosted databases exposing some personal data; Supabase says customers control how their own projects are configured.

No source links these three. Treat them as unrelated cases unless that changes.

Health data: the slow-moving pile

Healthcare disclosures this period tend to describe older attacks. Paradigm Healthcare Services, a Medi-Cal billing vendor, told HHS more than 970,000 people were affected by an intrusion first detected in 2025. Ridgeway Pharmacy reported more than 258,000 and the law firm Tarter Krinsky & Drogin more than 196,000. iRhythm, maker of the Zio heart monitor, said at least 360,000 people were affected by its June attack; The HIPAA Journal later reported that Oregon’s attorney general lists 8,179,772 individuals. Our healthcare breaches roundup has the detail.

Free monitoring offers and deadlines

Breach Offer as reported
ETS / California students Two years of identity protection
Frontline Education Two years via TransUnion (adults)
Southern Company One year via Equifax
Advantest 18 months via Kroll; activate by January 4, 2027

Use the code in your own letter, and type the enrollment address yourself rather than clicking a link in an unexpected email.

What to do if you are on this list

  • Social Security number involved (CenterPoint, Arizona courts, Frontline, some Veradigm patients): place a free credit freeze with Equifax, Experian and TransUnion.
  • Only contact details exposed (ASOS, Burger King Japan, Trump Mobile): expect phishing that uses your real name, order history or phone number. Verify through the company’s app or website, never through the message.
  • Health or insurance data (iRhythm, Paradigm, Ridgeway): read explanation-of-benefits statements for services you never received.
  • Developer secrets (Railway, Zeabur): rotate keys, tokens and database passwords at the provider, then check usage logs for activity you did not cause.

Live Nation, sued at least three times over its breach, has so far listed two Vermont residents with the state, and the Vermont log notes that numbers can rise as a company finishes its count.

Frequently Asked Questions

What were the biggest data breaches in October 2026?

By reported size: Burger King Japan, whose app server held 11.18 million customer records; Denmark’s CPR register (about 8.8 million people); the Nippon Columbia malware incident affecting more than 8.7 million Daiichi Kosho records (theft not confirmed); Times Car (about 6.6 million accounts) and Arizona’s court system (1.3 million people). Records and accounts are not the same as people, so these figures cannot be compared one to one.

Was the Railway breach confirmed?

Railway confirmed suspicious activity in the systems holding customer secrets and said some values may have been read in decrypted form. It has given no count of affected accounts and is telling every user to rotate their secrets.

Is the 7.49 million CenterPoint Energy figure real?

It is a claim made on a cybercrime forum, not a confirmed count. The confirmed figure is the 1,062,060 Texas residents CenterPoint reported to the Texas attorney general; customers in other states may also be affected.

Which October 2026 breaches come with free credit monitoring?

Among those in this roundup: ETS student data (two years of identity protection), Frontline Education (two years through TransUnion for adults), Southern Company (one year through Equifax) and Advantest (18 months through Kroll, with activation by January 4, 2027). Check your own letter for the code and deadline.

Did Ahold Delhaize lose customer data in October?

Ahold Delhaize says it has no evidence so far that sensitive customer data was taken. Its websites and apps went offline, but it has not confirmed a data breach.

Sources

This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.

Owed money from a settlement? Check what is open at OpenClassActions.com. Caring for someone with dementia? Find practical guides at HelpDementia.com. Working out a skin routine? Evidence-based answers at AcneAdvocate.com. Forgot the name of a movie? Identify it at FindThisMovie.com.

We use cookies to run this site, measure how it’s used, and show ads. Choose “Essentials only” to limit cookies to what the site needs to work. Privacy Policy. Cookie Policy.