Overview
A data breach is a security incident where unauthorized parties gain access to sensitive data. Not all data exposures are breaches — web-scraping and user-enumeration can expose data without server compromise.
2026 Notable Incidents
U.S. Federal Personnel Breaches (September–October 2026)
- DMDC: dmdc file-sharing vulnerability — ~2.76M living + ~294K deceased; Oct 2025–Jul 2026 dwell; SSNs, job specialties (2026-10-01-federal-agencies-hacks-sensitive-data)
- FBI: shinyhunters claimed FBIJobs.gov breach via oracle PeopleSoft; FBI told staff to assume PII stolen; 2–3 TB alleged (2026-10-02-fbi-shinyhunters-breach-decrypt)
No established connection between DMDC and FBI incidents — parallel personnel-data exposures ( government-personnel-data-breaches).
Revolut Government Request Fraud (September 2026)
- Date: September 12, 2026
- Type: government-data-request-fraud — not technical breach
- Data: KYC documents, selfies, transaction histories
- Root cause: Fraudulent requests from rogue account in legitimate government email domain (2026-09-12-revolut-customer-data-breach)
Chess.com Scraping Exposure (August–September 2026)
- Date: Data captured July 26 – August 3, 2026; HIBP indexed September 13
- Records: 7.3M user profiles (4.6M unique emails)
- Type: web-scraping via find-friends enumeration — not server breach (2026-09-14-chess-com-leak-ransomnews-primary)
- Data: Emails, names, ratings, internal ad-audience tags; no passwords
Chess.com has not publicly confirmed breach vs. scraping.
MoneyForward GitHub Breach
- Date: May 1-3, 2026
- Affected: Corporate GitHub account
- Data Stolen:
- Source code repositories
- 370 records (MoneyForward Business Cards)
- Root Cause: Sensitive data inadvertently stored on GitHub
Response Framework
- Detection: Identify breach quickly
- Containment: Isolate affected systems
- Assessment: Determine scope and impact
- Notification: Inform affected parties (per GDPR, etc.)
- Remediation: Fix root causes
- Post-Incident: Review and improve