Incidents by attack type:
BK Japan, the operator of Burger King's Japanese mobile app, confirmed unauthorized access to its member database exposing about 11.18 million records.
South African pathology group Ampath confirmed a cyber incident and disputed a threat actor's claim to have stolen 80 million records.
Japanese second-hand retailer Bookoff Group disclosed that unauthorized access to a subsidiary's membership system may have leaked the personal data of up to about 6.43 million member records.
Japanese karaoke giant Daiichi Kosho warned that a malware infection at an external contractor may have exposed the personal data of about 8.6 million customers and 93,000 others handled on its behalf.
Switzerland's Ricardo online marketplace disclosed that a security vulnerability exposed the names, postal addresses and phone numbers of about 890,000 user accounts.
Denmark disclosed that unidentified actors misused a private company's legitimate access to the national Central Person Register (CPR) to extract the names, addresses and personal identification numbers of about 8.8 million people.
Denmark's DTU said attackers used stolen credentials to breach its DTUBasen identity system, exposing CPR numbers and other personal data of up to 200,000 current and former users.
A faulty AI-generated mailing script exposed 95,364 Bee Cheng Hiang members' email addresses to one another in Singapore's first AI-related data breach.
The U.S. Defense Manpower Data Center said attackers exploited a file-sharing system flaw to access unencrypted data, including Social Security numbers, on more than three million people.
Polish online invoicing service Fakturownia, used by more than 600,000 businesses, disclosed that an attacker accessed its servers for about 38 hours and copied account, contractor, invoice and payment data, along with password hashes and API tokens.
Tokyo Metro disclosed that an unauthorised third party had accessed the email addresses of roughly 59,000 customers enrolled in its Metpo loyalty programme, warning members to watch for follow-on phishing attempts.
Japanese mobility group Park24 said unauthorized access to its Times Car car-sharing system exposed personal data, including driver's license images, for about 6.6 million members.
US brokerage DriveWealth said a social-engineering attack exposed historic personal data of fintech customers, including Revolut, Stake and Hatch users who once traded US stocks through it.
The FBI declared a cyber security incident and warned staff their personal data may have been exposed after the ShinyHunters group claimed it breached the bureau's FBIJobs.gov hiring portal.
CenterPoint Energy confirmed unauthorized access to customer data through an external system after a hacker claimed to have pulled 7.49 million records from an API lacking authentication.
Florida's Department of Highway Safety and Motor Vehicles confirmed that attackers used a compromised law-enforcement account to breach its DAVID driver database, as the ShinyHunters extortion group claimed to have stolen more than 200,000 driver records.
Helpfeel's image-sharing service Gyazo disclosed that an attacker exploited a flaw in its image-upload server to run commands and reach its database, exposing about 23.6 million user records and roughly 490 million image metadata records.
Japan's Digital Agency disclosed that attackers exploited a vulnerability in a VPN product to access its Government Solution Service and steal personal information belonging to roughly 240,000 people, using a maintenance employee's account.
Identity-verification provider IDScan.net confirmed that attackers stole more than 150 million driver's license and ID records from its cloud systems, after the data surfaced on a dark web site that let anyone look up individuals across the US and Canada.
Healthcare technology firm Veradigm disclosed that attackers used credentials stolen from a third-party vendor to reach a customer-service API and copy patient data, after The Gentlemen ransomware gang claimed to hold roughly 3.5 million records.
Security researchers disclosed that an unsecured Advance Passenger Information System database hosted in Vietnamese IP space had exposed roughly 220 million passenger and crew travel records spanning 2017 to 2026 through misconfigurations and default credentials.
A database of 32.8 million alleged Condé Nast user records, covering readers of Vogue, The New Yorker, GQ, WIRED and other titles, was offered for sale on a Russian-language cybercrime forum, expanding a December 2025 leak that had exposed 2.3 million WIRED accounts.
HYBE's fan platform Weverse disclosed that a vulnerability in an externally exposed payment API leaked purchase, payment and refund records tied to 422,584 accounts, after South Korea's KISA alerted the company to the flaw.
Chess.com began notifying about 4,500 users that their personal information was exposed after an external threat actor gained unauthorised access to a third-party file-transfer application the platform used.