Intelligence · Disclosure tracker
Every public disclosure, dated and sourced.
Public breach disclosures from regulators, court filings, company notices and news reporting, each recorded with its date and a link to the original. Updated daily.
5,314
Disclosures in the tracker, all years
2,028
Of those, indexed in 2026
76
Added in October
21
Added in the last 7 days
7
Sectors covered
Source: LeakTrace disclosure tracker, 21 Oct 2026. Counts of records in the index, not estimates. Software advisories and security news are not counted.
Worldwide · How they got in
Incidents worldwide, by country.
72 incidents from 9 countries in the last 90 days, each from a public source and reviewed before it is shown. Where the source says how the attackers got in, the row says so.
- Canada21 Oct 2026Canadian Crime Stoppers AssociationHow they got in: a supplier or vendor that was compromised first.CBC News
- Canada19 Oct 2026City of HamiltonThe source does not say how they got in.CBC
- Canada17 Oct 2026More RewardsThe source does not say how they got in.CTV News
- Canada16 Oct 2026McMurray MétisHow they got in: email made to look like it came from a trusted sender.Yahoo News Canada
- Canada14 Oct 2026Nova Scotia minor hockey communityHow they got in: email made to look like it came from a trusted sender.PNI Atlantic News
Critical9 Jul 2026
KDDI Japan ISP Network
Technology · 14,200,000 records
14.2M email credentials exposed across six ISPs
9 Jul 2026
Critical9 Jul 2026
HSIN platform
Government · Records not stated
HSIN platform breached, national security data exposed
9 Jul 2026
High9 Jul 2026
9 Jul 2026
Critical9 Jul 2026
9 Jul 2026
Critical9 Jul 2026
Infostealer Credential Megadump
Sector not stated · 24,000,000,000 records
24B credentials from 36 sources exposed
9 Jul 2026
Critical9 Jul 2026
June 2026 Stealer Logs
Technology · 124,000,000 records
56M unique emails and 124M passwords indexed on monitored breach databases
9 Jul 2026
High9 Jul 2026
Texas Parks and Wildlife
Government · Records not stated
3M hunting and fishing license records exposed
9 Jul 2026
High9 Jul 2026
Kodak Corporation
Sector not stated · 2,200,000 records
2.2M customer records stolen by ShinyHunters
9 Jul 2026
Critical9 Jul 2026
Madison Square Garden
Sector not stated · 26,000,000 records
26M records leaked after ransom deadline passed
9 Jul 2026
Critical9 Jul 2026
KDDI Japan Telecom
Technology · 14,200,000 records
14.2M email credentials exposed across six ISPs
9 Jul 2026
Critical9 Jul 2026
NYC Health Hospitals
Healthcare · 1,800,000 records
1.8M patient records leaked including biometrics
9 Jul 2026
Critical9 Jul 2026
ADT Security
Sector not stated · 30,814 records
5.5M unique emails and PII leaked after breach
9 Jul 2026
Critical9 Jul 2026
Conduent
Government · 62,200,000 records
62.2M records exposed including SSNs and medical data
9 Jul 2026
Critical9 Jul 2026
KDDI Six ISPs Japan
Technology · 14,200,000 records
14.2M email credentials exposed in plaintext
9 Jul 2026
Critical9 Jul 2026
NAIC Insurance Regulators
Finance · 12,000 records
3.1TB stolen via Oracle PeopleSoft zero-day
9 Jul 2026
High9 Jul 2026
Acworth City Government
Government · Records not stated
Government systems hit by INC_RANSOM ransomware
9 Jul 2026
High9 Jul 2026
9 Jul 2026
High9 Jul 2026
Eurail Interrail
Sector not stated · Records not stated
300K traveler passports and IBANs exposed
9 Jul 2026
Critical9 Jul 2026
Global Infostealer Credential Dump
Sector not stated · Records not stated
24B stolen credentials exposed online
9 Jul 2026
Critical9 Jul 2026
NYC Health and Hospitals
Healthcare · 1,800,000 records
1.8M records stolen including biometrics
9 Jul 2026
Critical9 Jul 2026
Conduent Business Services
Sector not stated · 62,200,000 records
62.2M records exposed in ransomware attack
9 Jul 2026
Medium8 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
The threat actor claiming responsibility says they stole source code, encryption keys and more.
8 Jul 2026
Medium8 Jul 2026
Organisation not named
Technology · Records not stated
The disclosure as indexed does not name the organisation.
A financially motivated operation uses lures of cracked or pirated software to deliver a malware two-for-one combo for data theft and cryptomining.
8 Jul 2026
Medium8 Jul 2026
Organisation not named
Sector not stated · Records not stated
The disclosure as indexed does not name the organisation.
For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for…
8 Jul 2026
Were you affected?