The toll from the 2025 attack on Oracle Health’s legacy Cerner systems has climbed to nearly 20 million people, Bloomberg reported, with personal and medical information compromised. Oracle said the attacker used stolen customer credentials to access a legacy server and copy data.
Outside providers connect several of the largest breaches: hackers stole patient information from third-party-hosted applications used by iRhythm, while an intruder downloaded clients’ tax and financial documents from EY’s support platform. In Denmark, an attacker misused IT company Pays’ authorized access to the national population register, exposing nearly 8.8 million records; Politiken reported that several Pays accounts, including an administrator account, used “123456” as a password.
Unpatched software also left sensitive records exposed: attackers stole defense-community data through a file-sharing flaw, and the FBI said a contractor failed to patch a platform involved in an employee data breach. Other reports remain less certain: KFC’s alleged breach is an unverified ransomware claim, and Daiichi Kosho has not confirmed theft of the millions of records put at risk by malware at Nippon Columbia.
Hackers stole personal and patient information belonging to more than 360,000 people from third-party-hosted business applications used by medical equipment provider iRhythm between June 3 and June 8. The stolen data included names, contact details, dates of birth, insurance numbers and device information. The attackers contacted iRhythm on June 9 and threatened to publish the data unless the company paid a ransom.
An attacker abused Danish IT company Pays’ authorized access to Denmark’s Central Person Register, exposing nearly 8.8 million records containing national identification numbers and addresses, Politiken reported. At least three Pays accounts reportedly used the password “123456,” including an administrator account. Pays confirmed its access had been misused; the attacker claimed the weak password helped obtain the data.
The Gentlemen ransomware group claimed it breached KFC in a listing observed on October 10, 2026, identifying the target as KFC in the United States. The claim remains unverified, with no visible stolen files, technical evidence or company confirmation. The listing does not establish whether the alleged target was a corporate network, a franchise operator or another business connected to KFC.
A malware infection at Nippon Columbia put 8,631,000 customer records and 93,000 employee records belonging to Japanese karaoke operator Daiichi Kosho at risk. The data includes names, birth dates, email addresses and phone numbers, but not passwords. Daiichi Kosho said it has not confirmed any data theft or leaks and that its own systems were not breached.
An attack on British retailer ASOS showed how compromising a single identity can lead to deeper access to a corporate network. The article links the breach to risks in customer-facing SaaS but provides no details on the affected platform, the attacker or the scale of the compromise.
A 2025 cyberattack on Oracle Health’s legacy Cerner systems compromised personal and medical information belonging to nearly 20 million people, Bloomberg reported, citing a Texas attorney general report. Oracle told customers an attacker used stolen customer credentials to access a legacy server and copy data. Breach notices listed Social Security numbers, diagnoses, medicines and test results among the potentially exposed information.
A breach of EY’s tax services support platform exposed personal and financial data belonging to clients of Goldman Sachs’ wealth management division and Man Group. An intruder downloaded documents between March 28 and April 12, 2026, exposing names, addresses, tax identifiers, email addresses and financial details. Both financial firms said their own systems were unaffected.
Ransomware group BYOD claims it breached Trump Mobile and leaked personal data belonging to 3,615 people, including names, email addresses, phone numbers, home addresses and order details. The attackers reportedly gained access by infecting an employee of Liberty Mobile, which operates Trump Mobile, with an infostealer. BYOD claims neither company used multi-factor authentication.
An unauthorized third party accessed utility account information for roughly 400,000 Southern Company customers through its online portal, including about 300,000 Georgia Power accounts and 100,000 Alabama Power accounts. Exposed data included names, contact information, the last four digits of Social Security numbers and other account details. The company said bank account, payment card and driver’s license numbers were not accessed.
Japanese chip testing equipment maker Advantest confirmed that attackers stole personal information in a ransomware attack disclosed in February 2026. The stolen data includes names, Social Security numbers, passport and driver’s license numbers, and medical and financial information. More than 500 California residents are affected, along with 14 in Massachusetts and eight in Vermont; the company has not disclosed a total.
Attackers stole personal information on 1.3 million people with unpaid court fees, fines and restitution in a breach of Arizona’s court system. They also took nearly 30,000 protection-order records and 150,000 foster care board reports. Court technology staff stopped the attack on a backup server about two hours after detecting it on Sept. 24; no court cases were affected or delayed.
Jefferson County, Missouri, halted transaction processing after officials shut down its network and phone systems Friday over a security threat they are investigating as a possible cyberattack. The county, with an estimated 233,000 residents, also canceled two zoning meetings. Officials reported no indication of a data breach and said sheriff’s office law enforcement operations were unaffected.
The FBI removed an Accenture contractor after a data breach exposed employees’ personal details, Reuters reported. The bureau said a contractor failed to install a security patch on a third-party-managed platform, which Reuters’ sources identified as Oracle PeopleSoft. ShinyHunters claimed responsibility for the breach and said it exploited the HR system.
Domino’s said attackers accessed a “very small number” of customer accounts using email addresses and passwords stolen from other sites. The company said its internal systems were not breached and no financial information was accessed because it does not store payment details. Domino’s reset affected accounts and reported the incident to the Information Commissioner’s Office.
Attackers breached two Nikkei employee email accounts, using a Microsoft 365 account to send 9,000 phishing emails to staff and interviewees on September 30. A separate Google Workspace breach in late July potentially exposed names and email addresses of 1,646 employees and business partners. Nikkei changed the accounts’ passwords and has not said whether the incidents are connected.
Clover Health Investments and AngMar Management Services reported separate breaches affecting 138,677 and 126,196 people, respectively, involving stolen personal and health information. Attackers compromised three Clover employee accounts through social engineering in early July. AngMar’s stolen records included Social Security numbers and medical histories; the Interlock ransomware group claimed it stole more than 700 gigabytes from the company.
Attackers exploited a vulnerability in third-party software used by Frontline Education to steal school district employees’ Social Security numbers, email addresses and physical addresses. Frontline identified the vulnerability on August 14, 2026, and said it fixed the flaw. One district’s notification listed 1,210 affected employees; the total number of affected districts and individuals remains unknown.
Attackers stole unencrypted personal data on 2.76 million living people and 294,000 deceased individuals connected to the U.S. defense community through a flaw in a Defense Manpower Data Center file-sharing system. The breach ran from October 2025 to July 2026 and exposed Social Security numbers, names, birth dates and military occupational details. DMDC patched the flaw after discovering it on July 16, 2026.
Attackers used compromised credentials for Ribon and Ribon 1.5 apps to inject malicious scripts into a small number of BigCommerce stores between September 13 and 17, 2026, exposing shoppers’ names, email addresses, phone numbers and shipping addresses. BigCommerce removed the apps on September 17 and said its platform was not breached; passwords and payment card data were not exposed.
A breach at Baylor Genetics around June 15 exposed sensitive information belonging to 30,263 veterans, including medical testing details, lab results and partial Social Security numbers. The Department of Veterans Affairs criticized the lab’s notification as untimely and inadequate and worked with Baylor to improve information sharing and revise their security agreement. Baylor is offering affected individuals credit monitoring and identity protection services.
Atlanta-based fintech YouLend US discovered a network intrusion after an internal disruption alert on June 9, later determining an unauthorized party had accessed its systems from June 5 to June 9. State filings show the breach exposed names, Social Security numbers, dates of birth and financial and payment-card information, with a Texas AG filing listing 2,826 affected residents. YouLend has not disclosed how the intruder got in, and no threat actor has claimed responsibility; the company is offering 12 months of credit monitoring to those affected.