data breach - Page 8

Japanese hotel-booking software firm Temairazu says details of up to about 4.45 million guests may have been viewed or obtained. What it confirms.

Pays ApS told TV 2 its lawful access to Denmark's CPR register was abused. Politiken reports '123456' passwords on at least three accounts. What is confirmed.

FBI Director Kash Patel says agents have arrested another suspected ShinyHunters co-conspirator over the FBIjobs.gov incident. The suspect's name and charges are not public; reports of a Canadian arrested in Pennsylvania rest on unnamed sources. What is confirmed, what is reported, and what is only the group's own claim.

JR East and Viewcard say about 6.09 million accounts, mostly email addresses, may be exposed after the IDC Frontier ransomware attack. What the companies and Japanese media report, what is not affected, and what it does not prove.

CrowdStrike says an unnamed, likely Chinese-speaking attacker used ARTEX, an open-source AI penetration-testing agent, alongside several AI models to steal data from South Korean financial firms. What CrowdStrike found, what Korean investigators say, and what it does not prove.

Travel site skyticket says about 14.64 million records were taken. Bookoff says up to about 6.43 million, and Times Car, Lawson, karaoke firm Daiichikosho, H.I.S. and resort operator Resorttrust have also disclosed leaks. What each company has confirmed, what Kyodo reports, and what it means for customers.

Three newly disclosed incidents: Ginkgo Bioworks says an outsider accessed data from cloud environments tied to its former biosecurity business; Turkey's data regulator says a ransomware attack on Yıldız Technical University may affect about 140,000 students and 4,500 staff; and Green Clinic in Ruston, Louisiana, is rebuilding after ransomware locked its records. What each organisation has confirmed.

A ransomware attack on SoftBank's IDC Frontier knocked out services for 495 customers, halting Nissui's logistics and Ibaraki's websites. Japan's police say Qilin has hit 53 Japanese firms. MrMax, GMO's infoQ and Nikkei disclosed breaches; Asos says hackers took detailed customer profiles; Oracle Health's count may near 20 million; and Denmark says its population register was looked up for 8.8 million people. What each organisation confirmed.

Arizona’s courts confirm data on 1.3 million people was copied; ccTLD registry hijacks let attackers obtain certificates for Google and other domains; exploitation attempts follow a public Atlassian PoC; Yoido Full Gospel Church confirms 850,000 members’ data exposed; the Double Counter Discord bot is breached; a MonsterCloud owner is charged; and the US offers $10m for accused HAFNIUM hacker Zhang Yu. Confirmed vs alleged, case by case.

From FortiBleed credential harvesting and ASOS customer notifications to UIC ransomware, Citrix NetScaler KEV deadlines and a new NetScaler flaw, CVE-2026-107406 (patch out; no known exploitation), Southern Company portal access and Advantest’s delayed PII notices — what is confirmed, what is alleged, and the patterns linking initial access to disclosure timing.