Data Breach Roundup (Feb 13 – Feb 19, 2026)

Sex toys maker Tenga says hacker stole customer information

The Japanese company says that an attacker accessed an employee's inbox, which could reveal the names, email addresses, and correspondence including order tails or inquiries. A number of impacted victims was not given. The company reset the employee's password and required 2FA, among other fixes.

Fintech lending giant Figure confirms data breach

The "blockchain-based" lending company was a victim of the ShinyHunters ransomware gang via the recent Okta breach. After refusing to pay the ransom, 2.5 GB of data was published, including full names, home addresses, dates of birth, and phone numbers. The company did not offer any further details.

Fintech lending giant Figure confirms data breach | TechCrunch

The company said hackers downloaded “a limited number of files” after breaking into an employee’s account. The hacking group ShinyHunters took responsibility for the breach.

TechCrunchLorenzo Franceschi-Bicchierai

Indian pharmacy chain giant exposed customer data and internal systems

This occurred after a researcher discovered a "super admin" API running on DavaIndia's website. It was reported and closed, but it was active since late 2024 and could've revealed information about patient conditions, medicate, or purchases.

Canada Goose investigating as hackers leak 600K customer records

Canada Goose is a luxury outerwear brand. The data includes customer names, email addresses, phone numbers, billing & shipping addresses, IP addresses, and order histories as well as partial payment information like last four of the card, brand, and - in some cases - BIN and metadata. Canada Goose insists their system hasn't been breached but that the data is old data. They didn't comment on where this data might have come from even if it was old.

Eurail says stolen traveler data now up for sale on dark web

Eurail is a Netherlands-based company that sells passes for train travel across Europe. According to the article they're still investigating exactly what records were taken and how many customers were impacted, but the compromised server could've included full names, passport details, ID numbers, IBANs, health information, and contact details like email address and phone number.

This databased - discovered in January by UpGuard - contains at least 3 billion records including email addresses, passwords, and Social Security numbers. It's unclear who it belongs to and appears to have been "cobbled together" from previous data breaches.

Louis Vuitton, Dior, and Tiffany fined $25 million over data breaches

This fine was issued by South Korea over "failing to implement adequate security measures" which resulted in the exposure of the data of over 5.5 million customers last year. That includes names, phone numbers, email addresses, physical addresses, and purchase history.