Data Breach Roundup (Oct 16 - 22, 2026)
Burger King Japan data breach exposes 11 million customer records
The breached servers stored the personal information for users of the company's official smartphone app, including their names, dates of birth, gender, email addresses, phone numbers, and order history. However, the company says the compromised server did not store customer credit card numbers and that it found no evidence that the threat actors accessed user credentials.
Sergiu Gatlan
Hackers steal personal data of millions of California students in massive breach
Educational Testing Services (ETS) is a nonprofit that helps manage and provide testing-related services for students in California public schools, including the annual standardized tests. ETS suffered a data breach, exposing the data of 5.7 million students as far back as 2006. Impacted data includes names, addresses, disability records, grade level, date of birth, what school the student attends, student ID number, gender, race, primary language, country of origin, and more.
Howard Blume and Andrew Khouri and Jaweed Kaleem
Florida DMV hacked after police dept insecurely stored login info
This hack appears unrelated to last month's IDscan.net breach. This breach occurred on September 4th, though the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) is just now sending out notifications. There are few details at this time, such as how many people or what data was impacted. The FLHSMV says that they may not have current records for impacted victims who have moved out of state. The article offers an email address to contact if you want to ask if you were impacted.
Ashley Belanger
Nikkei discloses third data breach in a month, 1.8M records exposed
The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records. The remaining 1.68 million records contain no identifiers, the company said, and no credit card information was exposed.
Bill Toulas
Zeabur shutting down after second security breach in two months
Zeabur is a developer hosting and deployment platform that lets developers connect a GitHub repository and have the platform handle deployment, databases, HTTPS, and infrastructure management. Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines. After discovering the latest security incident, Zeabur announced over the weekend that it will shut down its services starting December 1, 2026, and finish by December 31, 2026.
Bill Toulas
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
The data was stolen last March by hacktivist collective Internet Yiff Machine. The group said it wanted to disprove the claim that the platform was "anonymous" and "secure." The stolen data goes back 25 years. More than 850,000 tips — about half of all Canadian records identified by CBC — included personally identifiable information about tipsters, individuals named in allegations and even Crime Stoppers staff and police. Street addresses and phone numbers appeared most frequently, alongside tens of thousands of personal emails, licence plates and hundreds of banking details related to cash rewards. In over 4,300 reports, tipsters introduced themselves with a full name. Copies of the data are not publicly available online, though general consensus is that it's probably somewhere if it's already being shared this widely.
Capcom confirms data breach affecting 11.7 million accounts
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Apart from emails, exposed data includes account creation date, last login timestamp, number of logins, and the IP address used at the last login. Capcom found that for a small subset of 43 accounts, dates of birth, gender, nicknames, and countries were also exposed. For another subset of 196 accounts, the hackers changed the CAPCOM ID login passwords in an attempt to lock the owners out, but the company took action and reset them. Although the timing of the breach remains unclear, Capcom said it detected suspicious activity and confirmed unauthorized access on October 19.
Bill Toulas
Community Discussion