Overview
A data breach is a security incident where unauthorized parties gain access to sensitive data. Not all data exposures are breaches — web-scraping and user-enumeration can expose data without server compromise.
2026 Notable Incidents
Revolut Government Request Fraud (September 2026)
- Date: September 12, 2026
- Type: government-data-request-fraud — not technical breach
- Data: KYC documents, selfies, transaction histories
- Root cause: Fraudulent requests from rogue account in legitimate government email domain (2026-09-12-revolut-customer-data-breach)
Chess.com Scraping Exposure (August–September 2026)
- Date: Data captured July 26 – August 3, 2026; HIBP indexed September 13
- Records: 7.3M user profiles (4.6M unique emails)
- Type: web-scraping via find-friends enumeration — not server breach (2026-09-14-chess-com-leak-ransomnews-primary)
- Data: Emails, names, ratings, internal ad-audience tags; no passwords
Chess.com has not publicly confirmed breach vs. scraping.
MoneyForward GitHub Breach
- Date: May 1-3, 2026
- Affected: Corporate GitHub account
- Data Stolen:
- Source code repositories
- 370 records (MoneyForward Business Cards)
- Root Cause: Sensitive data inadvertently stored on GitHub
Response Framework
- Detection: Identify breach quickly
- Containment: Isolate affected systems
- Assessment: Determine scope and impact
- Notification: Inform affected parties (per GDPR, etc.)
- Remediation: Fix root causes
- Post-Incident: Review and improve