Data Breach Roundup (Nov 6 - 12, 2026)

York University breach exposed personal information dating to 2007

York University is a major university based in Toronto, Canada, with more than 55,700 students across 200 undergraduate and graduate degree programs, and an administrative staff of 7,000. Exposed data includes email address, phone number, date of birth, York identification number, third-party contact information, health information, academic history, employment history, financial status, criminal background, demographic details, and photos & other images.

Vanderbilt University hit in BYOD ransomware attack, data theft claimed

On Monday, the BYOD ransomware group claimed responsibility for the attack on its data leak site, alleging that it had encrypted Vanderbilt's databases and stolen sensitive information belonging to students and employees. The attackers claim t have over 1 million Social Security numbers, full names, email addresses, phone numbers, student & employee records, and more. Vanderbilt has not publicly disclosed the nature of the attack or confirmed whether any data was stolen.

Fireworks AI discloses new breach after cloud provider hack

FireWorks provides a high-performance infrastructure platform for developers who want to deploy and run open-source artificial intelligence models (such as Mistral, Meta's Llama, or Google's Gemma) without worrying about hardware bottlenecks and complex infrastructure tasks. Fireworks already reported a breach in early October that impacted API keys and tokens, but this new one took place October 23 and impacted resource metadata (e.g., Fireworks resource identifiers, display names, descriptions, creation time), billing information (e.g., billing and shipping addresses, invoice and payment history, account balance, and credit usage), and incomplete model weights and datasets for some customers. Payment data was not accessed, and the scope of the breach was not disclosed. The incident also affected some Notion workspaces.

Japanese gaming giant has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. The company says the exposed data also includes 92,300 records with additional information yet to be determined. The breach affects 11 newsletters linked to SEGA and SEGA Fave products and services. The investigation found that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords. Also, email addresses registered with a “SEGA Account” are handled by a separate distribution system and were not affected by this incident.

Hotel giant Wyndham exposed customer data after app security lapse

A security researcher found a password inside the source code of Wyndham’s Android app, which granted access to an internal company database, hosted by tech company Salesforce. The credential exposed personal information including customer names, email addresses, and Wyndham member number. The database also stores customer login tokens that keep customers logged-in to their apps without having to repeatedly enter their own passwords. The database also contained Wyndham files and documents. The database had millions of entries, but the researcher was unable to determine an accurate number of exposed customer records. Wyndham touts some 129 million enrolled rewards members.

Japanese furniture giant Nitori says hackers stole 37.6M customer records

Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion. The potentially exposed information may include membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender of individuals; membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, email addresses, and telephone numbers of corporate customers; and order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces.

Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals. Claroc found sensitive data belonging to other Grok Build users, some working for Fortune 500 companies and a defense contractor.

Maersk confirms data breach as WhiteArmor ransomware demands $5 million

A.P. Moller–Maersk is a Danish shipping and logistics group and one of the world’s largest container carriers by fleet capacity. The company operates ocean freighters, port terminals, warehouses, and air and land transport services across 130 countries. It has 700 container ships, roughly 13.5% of the global fleet capacity, 60 terminals in 35 countries, and employs 100,000 people. Last year, Maersk reported $54 billion in revenue and $2.9 billion in net profit. The investigation into the incident is ongoing, but the shipping firm says that current evidence indicates that "no sensitive data has been disclosed." However, according to the threat actor, the data they hold includes nearly 30,000 drivers records, plaintext passwords, 33 SUPER_ADMIN accounts (the most privileged on a system), signed delivery receipts, and 14.44 inventory rows with purchase orders and Advance Shipping Notice (ASNs). The hacker also claims to hold 27,842 mobile device logs that include phone numbers, emails, and IMEI (International Mobile Equipment Identity) numbers.

Baker Tilly notifies clients of data breach at third-party provider

Baker Tilly is a major accounting firm in the U.S., providing auditing, tax planning, compliance, advisory, and business operations services. Globally, the company operates in 147 countries and reports an annual revenue of $6.8 billion. This breach occurred September 6, but the investigation was completed on October 28. The breach notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder. Data from the Office of the Texas Attorney General reports that Baker Tilly impacted 10,456 individuals in the state of Texas alone. The portal lists Social Security numbers (SSNs), full names, addresses, and other information as exposed data types.

Huge European telecom leak exposes Swedbank, SEB, airBaltic and dozens of other companies’ clients

The Latvian branch of CSCTelecom, a telecommunications provider, left a database containing over 125 million SMS messages exposed. The leaked records span from October 2022 to September 2026 and were updated in real time, meaning attackers could have intercepted authentication codes, password reset links, and private information before the recipients even saw them. CSCTelecom acknowledged that a "security vulnerability" was identified in one of its systems, which is now fixed. The database included messages from major banks, medical institutions, popular shopping sites, government organizations, and even Latvia's national emergency hotline, 112.

Iris Ohyama data cloud breach exposes info of 7.7 million customers

Iris Ohyhama is a Japanese manufacturer and operator of the Iris Plaza shopping center. This breach was discovered last month and disclosed with limited details, saying that a third-party cloud service had been breached. The company is still determining the full scope of how many people were impacted, but has determined that exposed data included full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords. Passwords were "encrypted" but the company did not answer questions about what algorithm was used.

Chainalysis says breach exposed credentials for all customers

An update to last week's breach. Before we knew what information was impacted, but not how many victims. The article didn't provide an exact number, but we know Chainalysis customers include law enforcement, government agencies, financial institutions, cryptocurrency businesses, and more all around the world.