worldwide
26 articles with this tag
Frontline Education data breach (school software vendor): 3.09 million people per the Indiana AG list; SSNs, Medicaid IDs and student IDs impacted — what staff and parents should do
Frontline Education, a US provider of administration software for K-12 school districts, posted a Notice of Data Breach dated October 26, 2026. It says its security team found a vulnerability in a third-party software product it uses on August 14, 2026, that the vulnerability allowed unauthorized access to part of its environment starting that day, and that the last day of unauthorized activity was August 15. The affected data relates to two products, Frontline Central and School Health Management. The company says the following data elements were impacted, with which apply varying by person: a Social Security number, date of birth, driver's license number, passport number, other government ID, Medicaid ID and student ID. Frontline says it is not aware of any misuse of the data, and offers adults in the U.S. two years of TransUnion credit monitoring and minors cyber monitoring (its incident page says dark-web monitoring where available). The Indiana Attorney General's data breach list (November 2026 edition) shows 3,085,266 people in total (66,157 Indiana residents; notification date October 26, breach date August 14), where filings in five other states (MA, NH, SC, TX, VT) had added up to about 1.3 million (1,298,917), per SecurityWeek. The number of districts has not been published. Our view: if you work at or have a child in a US school district that uses Frontline, assume your notice applies to you, place a free credit freeze, and treat any call or email that quotes your Medicaid or student ID as unproven.
Denmark CPR register misuse (about 8.8 million people): what was taken, and what residents and organisations that grant lookup access should do
On October 5, 2026, Denmark's Ministry of Research, Education and Digitalisation announced that unauthorized persons had misused a private Danish company's legitimate access to look up data in the civil registration system (CPR), and obtained names, addresses, CPR numbers and more for about 8.8 million registered people, including living, emigrated and deceased persons. The CPR holds about 11 million people. The CPR administration noticed on the evening of October 2 that there had been irregular activity during September, and stopped the company's access. Names and addresses of people registered with name and address protection were not included. According to Danish media, on October 9 the CPR administration reminded the 1,039 companies with lookup access of its security rules, and the minister acknowledged that security had not been good enough. Media also report that the password 123456 was used on lookup accounts; this has not been officially confirmed. This site's take: a caller who knows your name, address and CPR number may still be a fraudster. Residents should never share MitID details or one-time codes, and businesses should stop treating these three items as proof of identity.
AdaptHealth data breach (about 4.1 million people): health insurance and health data exposed — patients should check benefit statements and calls
AdaptHealth, a US provider of home medical equipment, says a June 5, 2026 cyberattack exposed patients' names, contact information, demographic information, health insurance information and health information. Its report to the US Department of Health and Human Services (HHS) covers 4,115,802 people. According to the company, Social Security numbers (SSNs), financial account and card information were not involved, and it is not aware of any misuse. Its July 2 report to the Securities and Exchange Commission (SEC) says the cause was a social engineering attack (tricking people into giving information or access) that compromised a user session associated with a third-party contractor; a stored password file associated with insurance billing was taken and external electronic health record portals were accessed. Our view: with no SSNs, the priority is reading Explanation of Benefits statements for care or equipment you did not receive, and not giving insurance numbers to callers about supply reorders. For organizations, the lesson is how far one contractor account can reach.
DC Medicaid data exposure (about 400,000 people): Medicaid IDs left in published reports — what members and report publishers should do
The District of Columbia Department of Health Care Finance (DHCF), which runs DC Medicaid, said two statistical reports posted on its website from 2023 to July 2026 contained the underlying personal data in hidden fields that people without permission could access. The data included Medicaid ID numbers, dates of birth, provider names, race, gender, ward and ethnicity; DHCF says beneficiary names, Social Security numbers and financial account information were not included. DHCF learned of the issue on July 21, 2026 and removed the reports. Its report to the US Department of Health and Human Services (HHS) lists 399,086 people. Our conclusion: a report that shows only totals on screen can still carry the source data inside the file. Members should watch for medical services they never received; publishers should rebuild public files so that they never contain the source rows.
LMU Munich Data Breach (2026): Student Data, Risks and Response
On September 19, 2026, Ludwig-Maximilians-Universität München (LMU) said an unauthorized actor had accessed an IT system holding standing data on student enrolments and that it must assume the data was taken. Its September 28 update put the scope at about 600,000 records in the admission system, covering current and former students over roughly 50 years. The data includes names, dates of birth, addresses, phone numbers and email addresses; records from 2005 onward include bank details (IBAN and account holder), and some include health insurance numbers, BAföG (German state student aid) numbers and reasons for leave of absence. Passwords, grades and exam information were not affected. The Bavarian State Criminal Police Office is investigating. The cause has not been disclosed. This site's take: the serious part is that bank details of people who graduated years ago were still in the system. Anyone who gave LMU a German or EU account should check their statements and reverse any direct debit they do not recognize, and should not open links in emails claiming to be from LMU.
Aesto Health Data Breach (9.5 Million): Why a Company You Never Heard of Sent the Notice, and What to Do
US healthcare data migration and archiving vendor Aesto, LLC (Aesto Health) says that from on or about December 2 to December 18, 2025, protected health information belonging to patients of its healthcare provider clients, stored in part of its cloud environment, may have been accessed and/or acquired by an unauthorized actor. The HHS Office for Civil Rights breach portal lists 9,540,683 people affected. The information includes names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, and government ID numbers such as ITINs; Social Security numbers were potentially involved for a limited number of people. You don't recognize the sender because your provider handed old records to an archiving vendor. First confirm whether your provider is on the list. Then protect SSNs and ITINs with a credit freeze and an IRS IP PIN, and medical information by reading your benefit statements. Providers need an inventory of every vendor holding patient data and an end date for archived records.
AssuranceAmerica Data Breach (About 7 Million): What to Do When Your Driver's License Number Leaks
On July 10, 2026, US auto insurer AssuranceAmerica notified people that, following malicious activity targeting one of its employees on March 16, an unauthorized third party accessed part of its IT environment and copied certain data files. The Indiana Attorney General's breach list puts the total affected at 6,998,886. Depending on the person, the data included name, contact information, auto policy or account information, driver or vehicle information, claims information and driver's license number, and for a limited number of people a Tax ID or Social Security number. In the US a driver's license number is used as an identity field on credit, insurance and public-benefit applications. A credit freeze alone leaves gaps, so also tell your state motor vehicle agency that your number was exposed.
Basic-Fit Member Data Breach (Bank Details and Visit Records): 'Payment Failed' Scams and What Members Should Do
On April 13, 2026 Basic-Fit disclosed unauthorized access to the system that records members' visits to its clubs. The company says the access was stopped within minutes, but some data on active members in several countries was downloaded: membership information, name and address, email, phone number, date of birth and bank account details; no passwords were accessed. Basic-Fit told Reuters about 1 million members were affected, in six countries including the Netherlands and Spain. This site's take: gym fees involve recurring payments under the contract, and for members using SEPA direct debit (the euro-area standard for bank debits), a 'your payment failed' message mimics a real Basic-Fit process. Always check your membership status in the app, never through a link; watch for direct debits from creditors you don't recognise; and don't panic-reverse the legitimate gym fee.
Booking.com Reservation Data Breach: How to Spot Scam Messages Posing as Your Hotel
In April 2026 Booking.com notified guests that unauthorized third parties may have been able to access certain booking information, updated the PINs of the affected reservations, and said it had contained the issue. According to the notice and the company's spokesperson as reported, the information included booking details, names, email addresses, phone numbers and messages shared with properties; financial information was not accessed. The number affected and the cause were not disclosed. This site's take: a correct hotel name, date and price no longer prove anything. The test is whether a request matches the payment policy in the booking you open yourself in the official app. Refuse any request to re-enter card details, pay through a link, or make a transfer not in the policy.
Carnival Data Breach: What Travellers Should Do When a Passport Number Leaks
Carnival Corporation, the parent of Carnival Cruise Line, says that on April 14, 2026 its IT security team identified unauthorized activity involving an employee's account: an unauthorized actor used social engineering to deceive an employee and gained access to a limited portion of its IT system. On April 22 the company determined that personal information had been copied. Its filing with the Maine Attorney General lists 5,995,277 people affected. The data varies by person and includes name, address, email address, phone number, date of birth and government-issued ID numbers such as driver's license and passport numbers. What leaked is a passport number, not the passport. The official lost-or-stolen process in the US (and in Japan) cancels the document itself and is meant for passports that are actually lost or stolen. The real risk is messages from people who seem to know your trip and your ID. US residents should freeze their credit. Everyone should ignore links in emails posing as the cruise line, and know when a passport really does need to be reported.
Cegedim Santé MLM Data Breach (2026): Patient Risks and Response
Cegedim Santé, the Cegedim Group subsidiary that publishes software for healthcare professionals in France, said on February 26, 2026 that at the end of 2025 it identified abnormal application request behaviour on the accounts of doctors using its MLM (MonLogicielMedical.com) software. Of the 3,800 doctors using MLM, 1,500 were affected, and personal data of patients in the MLM database was illegally accessed or extracted. The data comes from the patient's administrative file (name, gender, date of birth, phone number, address, email) and administrative comments written in free text at the doctor's discretion. For a very limited number of patients, those comments may have contained the doctor's personal notes about sensitive information. The company says structured medical records remained intact. France's Ministry of Health was reported to put the number of patients who may be concerned at about 15 million, with about 1% involving sensitive notes. When one cloud vendor stores the patient data of thousands of practices, a breach affects every practice using the software, not just one clinic. The most sensitive data sat in a field with the harmless-sounding label 'administrative comment'. Patients should prepare for impersonation and pressure messages. Clinics should check what goes into free-text fields and who would notice unusual activity on each doctor's account.
Companies House WebFiling Flaw (2026): Exposed Data and Checks
On March 13, 2026, UK Companies House became aware of an issue that meant a logged-in registered user of its WebFiling service could potentially view and change another company's details after a specific set of actions. It closed WebFiling at 1:30pm that day and reopened it at 9am on March 16. According to Companies House, the cause was a defect introduced during a major system update on October 11, 2025, and it was not a cyber-attack. Data that may have been visible includes the day of the date of birth and residential addresses of directors and people with significant control (PSCs), and company registered email addresses; unauthorised filings such as new accounts or changes of director were also technically possible. Passwords, identity verification data and existing filed documents were not affected. An April 8 update said a very small number of instances of unauthorised access or attempted changes had been identified. This was an authorization failure, not an intrusion. The login check worked; the check on whether this user may handle this company did not. Directors should review their filing history and turn on Follow alerts; developers should test, on every release, that requesting someone else's data is refused.
DentaQuest Data Breach: An MFA Code Handed Over to a Scammer, and What Members Should Do
DentaQuest, a US dental and vision benefits administrator, says unauthorized individuals accessed data on its network between May 17 and May 20, 2026. Its filing with the Washington State Attorney General says a social engineering attack tricked a single employee into providing credentials and a multifactor authentication code. The data includes names, addresses, dates of birth, Social Security numbers, member and health plan numbers, Medicaid and Medicare numbers, and dental or vision health information. Data elements vary by individual. The company told the Washington AG on August 3, 2026 that it was aware of more than 27.4 million people nationwide. An SSN cannot be changed, so members should freeze their credit at all three bureaus, get an IRS IP PIN and watch benefit statements. For organizations, the lesson is that any MFA a person can read out or type in can also be handed over; phishing-resistant MFA (passkeys, FIDO2 security keys) and a help desk that verifies callers are what prevent this.
Endesa Data Breach (ID and Bank Account Numbers): Handling Scam Calls That Know Your Contract
Endesa Energía told customers (around January 12, 2026) that a malicious actor gained unauthorized access to its commercial platform and may have exfiltrated basic identification data, contact details, national ID (DNI) numbers, energy contract data and, in some cases, IBANs; passwords were not affected. Endesa reported the incident to the Spanish Data Protection Agency (AEPD) and has not published how many customers were affected. This is exactly the kind of data that makes the long-running energy phone scam ('tariff change', 'supply cut-off') believable: a caller who already knows your DNI and your contract doesn't sound like a scammer. Knowing your details proves nothing, so hang up and call the official number yourself. And because an IBAN can be used for direct debits, check your statements: a debit you never authorized can be refunded for up to 13 months.
ANTS (France Titres) Data Breach (2026): Affected Accounts and Response
France Titres, the French national agency for secure documents (ANTS), detected on April 15, 2026 a security incident that may have exposed data from individual and professional accounts on its ants.gouv.fr portal. On April 21 the Interior Ministry said about 11.7 million accounts may be affected. In its answer published May 13, the government said data had been extracted from 11.67 million individual and professional accounts. The data includes login ID, title, surname and first names, email address, date of birth and a unique account ID, and for some accounts a postal address, place of birth and phone number. According to the government, attachments submitted with applications and biometric data are not included. The government asked users to change their password at their next login and to be very careful with suspicious texts, calls and emails that appear to come from ANTS. ANTS put its application pages into maintenance from April 24 and says two-step authentication has been in place since April 29. What leaked is not the ID documents themselves but the fact that a person has dealt with ID, licence or registration paperwork, which is exactly what a convincing ANTS or 'permis de conduire' scam needs. There is no need to replace your documents; the habit that works is never using a link in a message and opening ants.gouv.fr yourself.
Four Government Data Breaches of 2026 (US DoD, Illinois, Latvia, French Tax Authority): What Citizens Can Do
In 2026, government agencies in the US, Latvia and France lost control of citizens' personal data. Lining up the agencies' own accounts, there were three ways in: a wrong sharing setting (Illinois DHS's internal maps), a vulnerable system (the DoD's DMDC file-sharing system, a CSDD web application), and impersonated credentials of staff and an authorized third party (France's DGFiP). When the data holder is the state, 'stop using the service' isn't an option. A citizen's defense shifts to four things that work after a leak: verify notices through official channels, protect the logins to your tax and benefit accounts, call back on a number you look up yourself, and use your right of access to learn what was held and what leaked.
Manchester Airports Group (MAG) Data Breach (2026): What to Check
In a statement dated August 27, 2026, Manchester Airports Group (MAG) said it was subject to a cyber security incident by an unauthorised third party in August 2026, and that customer data relating to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports was obtained. The data includes email addresses, phone numbers, vehicle registrations and postcodes. MAG says neither it nor the system accessed holds customers' bank or payment details. MAG says that for people notified that they were affected, their data was made publicly available. According to press reports, a MAG spokesperson put the number affected at roughly 8.7 million. Operational airport systems were not involved. Contact details combined with a vehicle registration or postcode can make a fraudulent message seem more convincing. Whatever a 'refund', 'booking problem' or 'parking fine' message says, don't follow its link; open the airport's official Manage Booking page yourself. MAG says changes and cancellations there are free.
Mathspace Data Breach (About 1.08 Million Students, Parents and Staff): What Parents and Schools Should Do
In a blog post dated September 5, 2026 (updated September 8), maths learning platform Mathspace said attackers exploited a security vulnerability in its self-hosted internal reporting system and downloaded information on students, parents or guardians, school staff and Mathspace staff. 1,079,819 people in Australia and New Zealand were affected. The data includes user ID, username, first and last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date and date joined. The company says passwords (including hashes), authentication tokens, SSO credentials, academic records and results were not exposed. According to Mathspace, the software's developer published a critical advisory and patch on August 6, its own vulnerability-notification process did not escalate it, unauthorised access dated back to August 10, and data was downloaded on August 27. This site's take: this is a roster that includes children's accounts, and it can be used to make fake messages claiming to be from Mathspace or your school look genuine. Families should agree with their children never to sign in from a link or share a code. Operators should treat internal reporting tools, which tend to be patched last, like production systems: patch them just as quickly, and check for signs of compromise after patching.
Medtronic Data Breach (About 3.83 Million): What Patients Using Its Devices Should Check
On April 24, 2026, medical device maker Medtronic disclosed that an unauthorized party had accessed data in certain of its corporate IT systems. Per its notice letter, the access ran from April 13 to April 19, 2026. The Indiana Attorney General's breach list shows 3,834,294 people affected nationwide, with notices sent on June 29. The information involved: name, contact information, date of birth, Social Security number and health-related information. The company says it has not identified any impact to product security or patient safety, including the ability of any Medtronic device to operate safely and deliver intended therapy. This site's take: device makers hold patient data so that product updates and safety notices can reach you. Don't stop using the device or drop your registration; protect the SSN with a credit freeze and an IRS IP PIN, and verify any call that mentions your device by calling back a number you already have.
Odido Data Breach (About 6.39 Million): What to Do When Your ID Number Leaks
On February 12, 2026, Dutch telecom operator Odido disclosed that customer data had been taken from a customer contact system it uses. Its spokesperson put the scale at about 6.2 million accounts; Odido's later FAQ says about 6.39 million people were affected (current and former customers of Odido and its brand Ben). Depending on the person, the data included name, address, mobile number, customer number, email, IBAN, date of birth, and ID document number and expiry; passwords, call records and ID scans were not included. This site's take: an ID number on its own cannot be used to sign contracts or complete procedures; it mainly identifies who you are. The Dutch Central Identity Fraud Reporting Centre (CMI) says this data alone cannot be used to take out a loan, open a bank account, sign a phone contract or apply for a new ID document, and neither replacing passports nor changing account numbers is recommended. The real danger is contact from someone who quotes your leaked numbers to seem genuine. And the broader lesson: ID numbers that businesses collect to verify identity can leak from those same businesses.
Quest Apartment Hotels Data Breach (About 1.99 Million): What Guests Should Do After Card and Passport Numbers Leaked
Australian serviced-apartment chain Quest Apartment Hotels identified unauthorised access to a database system on August 17, 2026, arising from a vulnerability through a third-party service provider, and disclosed it on August 19. Its September 16 update says information on approximately 1,991,613 customers (records from before June 2025) was affected, including 46,727 credit card numbers with CVV and 297,739 without CVV (both including expired cards), 104,268 passport and/or driver licence numbers, 225,300 vehicle registration numbers, 271 NDIS numbers and 46 Medicare card numbers. This site's take: if you were told a card with its CVV was affected, ask your card issuer about a replacement. The card industry standard PCI DSS does not allow card verification codes to be kept after authorization. Quest has not said why CVVs were in these records, and we make no judgment about compliance, but guests should know that a hotel's records can end up holding them.
Shun Hing Group Data Breach in Hong Kong (About 920,000): Handling Scams Posing as Repair or Warranty Calls
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) received a data breach notification from Shun Hing Group on 23 March 2026 and has opened an investigation. On 2 July 2026, citing the latest information provided by the organisation, the PCPD said the personal data of more than 921,000 people may have been leaked, including about 920,000 customers' names/titles, addresses, phone numbers and email addresses, and about 1,000 staff and service/product/supplier personnel whose data also included identity document numbers, bank account numbers and salaries. About 1,050,000 people's data may have been maliciously encrypted. In its 9 July 2026 notice, Shun Hing Group said there was no evidence of misuse at that time and that its PanaClub system was suspended. This site's take: the potentially involved information includes after-sales contact details, such as an address or phone number given for appliance delivery, installation or warranty registration. A caller who knows your address and what you bought does not prove they are genuine. Don't follow a message's password-reset link; open the official website yourself to check the latest PanaClub guidance.
Standard Bank Data Breach (South Africa): Handling Scam Calls That Know Your ID and Account Numbers
On 23 March 2026, The Standard Bank of South Africa said it had identified unauthorised access to select data. By its 14 April update, the bank said the affected information includes names, ID numbers or company registration numbers, contact details (phone numbers, physical and/or email addresses) and account numbers, later adding B-BBEE categorisation and VAT registration numbers, and that the data 'now appears to have been published'. The bank says its transactional banking and core operating systems were not accessed and client funds are not affected. It has not published how many clients were affected. This site's take: the danger is not someone logging in with this data. It is someone calling you as 'Standard Bank' while reading out your real ID and account number. A caller knowing those numbers doesn't prove it is the bank, and the bank says it will never ask for your passwords, PINs or OTPs. Hang up, call the number on your card, register with SAFPS, and check your credit report.
Texas Parks and Wildlife Data Breach (2026): Affected Users and Response
The Texas Parks and Wildlife Department (TPWD) says that on May 13, 2026 Texas Cyber Command detected a cybersecurity incident involving the TPWD license system vendor that handles the sale of hunting and fishing licenses. According to TPWD, an unauthorized actor may have obtained driver license information, passport numbers (if provided), email addresses, phone numbers and residential addresses for more than 3 million customers; TPWD says Social Security numbers, dates of birth and financial information were not obtained. The Texas Attorney General's breach list shows 3,087,721 Texans affected. This site's take: the licence comes from a state agency, but the ID numbers buyers gave were stored in the systems of TPWD's vendor, a company buyers didn't choose themselves. And because licences are renewed every year, a message from TPWD looks normal, which makes it easy for scammers to imitate. Freeze your credit (a free block that makes it harder to open new accounts in your name), learn the Texas DPS route for a misused licence number, and only renew or pay through a TPWD address you type yourself.
Trenitalia Data Breach: Protecting Yourself from Fake Delay-Refund Scams
Italian rail operator Trenitalia sent customers a notice under Article 34 of the GDPR saying a cybersecurity incident caused by unidentified external parties led to unauthorised access to some personal data linked to travel tickets (titoli di viaggio). Follow-up notices for jointly controlled tickets describe it as the same event Trenitalia communicated on June 26, 2026. The data may include name, date and place of birth, email and phone number, itinerary details such as route, date, time and ticket number, loyalty card code, employer, and identity document details; the notice for UnicoCampania regional tickets also lists the Italian tax code (codice fiscale) and gender. Trenitalia says account login data, passwords and payment information were not involved. It notified the Italian data protection authority (Garante) and CSIRT Italia and filed a criminal complaint with the Rome prosecutor. This site's take: what leaked is an itinerary — when, where and on which train — and that is exactly what makes a fake 'your train was delayed, claim your refund' message convincing. Real delay compensation is either requested by you through Trenitalia's own channels or, for regional digital tickets, paid automatically to the card you bought with. No genuine refund asks you to type your card number into a link from a text message.
Six US Healthcare Data Breaches of 2026: How to Check a Notice from a Company You Don't Know
In 2026 a string of US healthcare data breaches happened at companies most patients have never heard of. Lining up six cases from the HHS breach portal: four are business associates that do work for providers and plans, one is a lab that receives samples and data from providers, and the sixth is a hospital system that says the unauthorized actor may have gotten in through a security breach at a third-party vendor. This site's take: a notice from a company you don't know is not, by itself, evidence of a scam. Before you use any number or link in it, open the HHS breach portal and your state attorney general's breach listing yourself and compare. For organizations, start with three things: a list of everyone you've handed patient data to, confirmation of return or destruction when a contract ends, and MFA that can't be phished.