Data Breach

A data breach is an incident in which an outside party gets into an organisation's systems and takes or exposes the personal or confidential records it holds, from names and national identity numbers to medical and tax files. Breached organisations warned that stolen records could fuel identity fraud and phishing, attackers used them for extortion, and researchers described stolen US personnel records as a potential espionage haul. Many breaches came through a side door: a vendor's platform, a contractor's computer, a third party's lawful access or a stolen password.

The fullest case was a wave of breaches at 16 South Korean financial firms, disclosed from October 2026, in which investigators traced the attack tool to an open-source AI penetration-testing system. Elsewhere attackers abused trusted third parties, logged in with stolen credentials, deceived staff or exploited software flaws, as in a Pentagon breach that exposed 2.76 million living people. Disclosure often trailed the intrusion by months, and attackers' claims of scale ran ahead of what victims confirmed. The ShinyHunters investigation produced arrests in the Netherlands and the United States, though the group denied any link to the Amsterdam suspect. As of October 2026, Korean regulators had found no evidence that account or card numbers were taken, and the FBI director said more ShinyHunters arrests were on the table.

AI-assisted attacks on South Korean finance

The South Korean wave began when Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Financial Group each disclosed a separate breach on 1 and 2 October 2026, all through loan-inquiry or employee-support systems rather than core banking platforms. It spread to savings banks, capital firms and cryptocurrency businesses, and investigators said attackers had gone undetected for up to 43 hours. By 14 October the Financial Services Commission counted 16 financial firms with confirmed breaches and about 100,000 personal records exposed, with no evidence that account or card numbers were taken, and it was investigating whether one group was behind every attack.

Investigators traced the attack tool to ARTEX AI, an open-source, agentic penetration-testing system that runs reconnaissance, finds weak login pages and launches attacks with little human direction. It began as a winning entry in a Baidu security challenge rather than a state programme, and its developer took it closed-source after confirming real-world misuse, though open derivatives stayed in circulation. CrowdStrike assessed with moderate confidence that the operator was a financially motivated Chinese speaker, after finding the attacker's Claude Code session histories in an open directory. A review of 555 financial firms' security checklists found deficiencies at 130, mainly missing patches, unsupported ageing systems and missing authentication on externally accessible systems, and the commission planned to map every external connection point.

Vendors, contractors and trusted access

Trusted third parties with legitimate access were a recurring route to data other organisations held. Denmark's Central Person Register, the national identity database, was breached in September 2026 by abusing a Danish company's lawful access to search it, exposing about 8.8 million people in what the government called the biggest breach in Danish history; the count exceeds Denmark's population because the register keeps records on the dead and on emigrants. A third-party platform EY used for tax work leaked names, tax identification numbers and financial details of Goldman Sachs wealth-management and Man Group clients, though both firms said their own systems were not compromised.

Contractors and add-on services carried the same risk. Malware on one computer at the subcontractor that handles customer data for Daiichi Kosho, Japan's largest karaoke operator, may have exposed about 8.63 million customer records, though neither company had confirmed an actual leak. An attacker reached data tied to about 28 million Discord accounts without breaching Discord, by entering Double Counter, a third-party verification bot, through an abandoned server that still ran an internet-exposed analytics tool.

Stolen logins, social engineering and software flaws

Other breaches began with a valid login. An attacker used compromised credentials to enter the identity management system of the Technical University of Denmark, which stores records on up to 200,000 current and former users, including civil registration numbers and, for active users, next-of-kin details, and the university warned the data could feed identity fraud and more convincing phishing. Oracle said evidence suggested its breach began with stolen customer credentials used on an old Cerner server not yet migrated to Oracle Cloud.

Social engineering supplied the entry elsewhere. Attackers impersonated Astrana Health staff and spoofed its main phone number to win access to its servers, and social engineering also opened iRhythm's third-party-hosted business applications in June 2026. Holland & Knight said a threat actor used social engineering to reach one of its computers; it and Squire Patton Boggs both disclosed exposed Social Security numbers in October, extending a run of 2026 law-firm breaches that included Jones Day and Greenberg Traurig.

Software flaws accounted for others. A vulnerability in a Defense Manpower Data Center file-sharing system was exploited from October 2025 until July 2026, and the Pentagon notified 2.76 million living people that their Social Security numbers and military occupational specialties were exposed. Researchers said the breach and ShinyHunters' claimed hack of the FBI's recruitment site together amounted to one of the largest potential espionage hauls of US government personnel data since the 2015 Office of Personnel Management breach.

Late disclosure and disputed scale

People often learned of their exposure long after the intrusion, and sometimes not from the company breached. The toll of Oracle Health's 2025 Cerner breach, which may have exposed Social Security numbers and patient medical records of nearly 20 million people, surfaced in October 2026 through a Texas attorney general report rather than any Oracle statement. iRhythm began notifying patients more than four months after a June breach in which a threat actor demanded payment; at least 360,000 people were confirmed affected by October, and the company declined to give a total.

Attackers' claims ran ahead of confirmation. Hackers claimed data on about 19 million Pathao accounts and demanded $400,000, while the Bangladeshi ride-hailing and fintech platform confirmed only that names, email addresses and phone numbers were taken. A group calling itself Xuanye hijacked the ASOS app to push an "ASOS HACKED" ransom message to customers and claimed to have compromised the retailer's Snowflake data environment, a claim ASOS did not confirm.

Japanese breach notices arrived in clusters in October 2026. Bookoff disclosed that up to 6.43 million customer records, including hashed passwords, may have been exposed, on the same day East Japan Railway reported about 6.09 million exposed accounts. Notices from Times Car, Lawson, Daiichi Kosho and H.I.S. came in the same run, and the government urged businesses to tighten security.

ShinyHunters and law enforcement

ShinyHunters, an extortion brand that in September 2026 claimed a hack of the FBI's own jobs portal, became the target of a widening investigation. Dutch police arrested a 24-year-old Amsterdam man that month, whom the FBI tied to hacking more than 140 organisations and collecting at least $70 million in extortion payments since 2025, though the group denied any link to him. After that arrest, researchers said the group, which works more as a decentralised brand than a fixed crew, was unlikely to stop. A suspected administrator of the wider Scattered Lapsus$ Hunters alliance was then detained in Jordan and was cooperating with the FBI, people familiar with the matter told Reuters.

On 8 October the FBI arrested a Canadian cybersecurity executive in Pennsylvania, a former managing director of the ransomware-negotiation firm CYPFER, whom outlets identified as a suspected co-conspirator in the jobs-portal hack; he faces Hobbs Act extortion and conspiracy charges in the Eastern District of Texas. FBI Director Kash Patel said "more arrests are on the table".