Weekly briefing No. 41 published 4 Oct 2026
Intelligence · Disclosure tracker

Every public disclosure, dated and sourced.

Public breach disclosures from regulators, court filings, company notices and news reporting, each recorded with its date and a link to the original. Updated daily.

5,339
Disclosures in the tracker, all years
2,052
Of those, indexed in 2026
111
Added in October
18
Added in the last 7 days
7
Sectors covered

Source: LeakTrace disclosure tracker, 25 Oct 2026. Counts of records in the index, not estimates. Software advisories and security news are not counted.

Worldwide · How they got in

Incidents worldwide, by country.

74 incidents from 11 countries in the last 90 days, each from a public source and reviewed before it is shown. Where the source says how the attackers got in, the row says so.

  1. United States23 Oct 2026Ford Audio-Video Systems, LLCThe source does not say how they got in.Vermont Attorney General
  2. United States23 Oct 2026Industrial and healthcare organizationsHow they got in: a known flaw in software the victim ran.The Hacker News
  3. United States23 Oct 2026EyeMed Vision Care, LLCThe source does not say how they got in.Vermont Attorney General
  4. United States23 Oct 2026Alabama Fire CollegeThe source does not say how they got in.Vermont Attorney General
  5. United States23 Oct 2026UltraMobile ImagingThe source does not say how they got in.HIPAA Journal
  6. United States23 Oct 2026Washington GastroenterologyThe source does not say how they got in.HIPAA Journal
  7. United States23 Oct 2026Tarter Krinsky & DroginThe source does not say how they got in.HIPAA Journal
  8. United States23 Oct 2026Quest DiagnosticsThe source does not say how they got in.SecurityWeek
  9. United States22 Oct 2026Dill Dill Carr Stonbraker & Hutchings, P.C.The source does not say how they got in.California Attorney General
  10. United States22 Oct 2026BASS Medical GroupThe source does not say how they got in.California Attorney General
  11. United States22 Oct 2026Summit School DistrictThe source does not say how they got in.Vermont Attorney General
  12. United States22 Oct 2026Nordace Limited d/b/a NordaceThe source does not say how they got in.Vermont Attorney General
High1 Jun 2026
Huntsville Hospital Health System
Healthcare · Records not stated
Personal health information of patients compromised through third-party data breach
1 Jun 2026
High1 Jun 2026
Data breach
Legal · 13,000 records
Data breach exposed hospital records of nearly 13,000 patients in New Jersey through cyberattack on law firm
1 Jun 2026
High1 Jun 2026
Organisation not named
Healthcare · 900,000 records
The disclosure as indexed does not name the organisation.
Thousands of NHS patient records stolen during major ransomware attack disrupting healthcare services
1 Jun 2026
High1 Jun 2026
Essex NHS Trust
Healthcare · 900,000 records
Thousands of patient records stolen in cyber attack; disclosure more than six months after notification
1 Jun 2026
Critical1 Jun 2026
Department for Education
Government · 607,000 records
Cyber attack exposed approximately 607,000 records
1 Jun 2026
Critical1 Jun 2026
Fortinet FortiGate
Technology · Records not stated
FortiBleed exposed verified admin credentials for 73,000+ firewall and VPN devices
1 Jun 2026
High1 Jun 2026
Organisation not named
Healthcare · 900,000 records
The disclosure as indexed does not name the organisation.
Thousands of NHS patient records stolen in major ransomware cyberattack
1 Jun 2026
Critical1 Jun 2026
Unknown (Elasticsearch database)
Sector not stated · Records not stated
Publicly exposed Elasticsearch database leaked 24 billion stolen credentials; largest infostealer log compilation
1 Jun 2026
Critical1 Jun 2026
Medical billing company (unnamed)
Healthcare · 1,300,000 records
Ransomware attack exposed 1.3M people's protected health data leaked to dark web in 2025
1 Jun 2026
High1 Jun 2026
Ernst & Young (EY)
Finance · Records not stated
Tax client data exposed via third-party vendor breach with 81-day delay in notifying customers
1 Jun 2026
High1 Jun 2026
FirstClass Travel
Sector not stated · Records not stated
Customer records allegedly breached at Australian travel agency
1 Jun 2026
High1 Jun 2026
Ernst & Young
Finance · Records not stated
Third-party vendor breach exposed tax client data after 81-day delay in notification
1 Jun 2026
High1 Jun 2026
Tata Electronics
Technology · Records not stated
Data breach confirmed affecting major tech supplier to Apple and Tesla
1 Jun 2026
High1 Jun 2026
FirstClass Travel Agency
Retail · Records not stated
Customer records allegedly breached by threat actors operating on underground forums
1 Jun 2026
High1 Jun 2026
Bank of Baroda
Finance · Records not stated
Cyber incident after employee email account compromised allowing unauthorized data access
1 Jun 2026
Critical1 Jun 2026
Aflac
Finance · 1,300,000 records
Aflac Japan data breach exposed 4.38M customers in June 2026; company's second major hack in over a year
1 Jun 2026
Critical1 Jun 2026
Japanese Telco (unnamed)
Technology · 12,000,000 records
Cyberattack exposed 12 million customer email accounts and webmail services
1 Jun 2026
Critical1 Jun 2026
Fortinet (FortiBleed)
Technology · Records not stated
FortiBleed campaign exposed verified administrator credentials for 73,000+ devices
1 Jun 2026
Critical1 Jun 2026
PEAR ransomware attack
Healthcare · 1,260,000 records
PEAR ransomware attack exposed 1.26 million patients; healthcare billing and practice-management data breached
1 Jun 2026
High1 Jun 2026
FirstClass
Sector not stated · Records not stated
Australian travel agency hit by alleged data breach with customer records exposed on underground hacking forums
1 Jun 2026
High1 Jun 2026
Charter Communications (Spectrum)
Technology · Records not stated
Data breach at internet service provider exposing customer records, facing lawsuits
1 Jun 2026
High1 Jun 2026
Law firm (unnamed)
Legal · 13,000 records
Cyberattack exposed hospital patient records for 13K patients in New Jersey
1 Jun 2026
Critical1 Jun 2026
Medical Billing Company
Healthcare · 1,300,000 records
2025 ransomware attack leaked protected health data on 1.3 million people to dark web
1 Jun 2026
Critical1 Jun 2026
Accenture
Technology · Records not stated
Threat actor claims to have stolen sensitive data from consulting giant in recent cyberattack
1 Jun 2026
Were you affected?