Monthly roundup
9 incidents across 5 countries. 8 confirmed by the organization or authorities; the rest are under investigation or claimed by attackers.
September 2026 brought 9 breaches and cyber attacks that we could verify, in Japan, United States, New Zealand, Singapore, South Africa. If you use any of these services, expect phishing that mentions the incident, and follow our data breach checklist.
Saga University found files on an administrative NAS being encrypted on 24 September 2026 and later said ransomware had hit part of its administrative information system. On 30 October it said personal data of about 80,000 people may have leaked, including hospital patient information.
Times Mobility detected unauthorized access to the Times Car web system on 25 September 2026 and said on 28 September that about 6.6 million accounts' member data had been taken. ScanNetSecurity reports about 1.6 million of those involved identity document images, and the company later changed how long it keeps such images.
Helpfeel, the developer of Gyazo, said a third party exploited a vulnerability in the service's image upload server on 11 September 2026 and ran arbitrary commands. The company says about 23.62 million user records and about 490 million image metadata records were affected.
MetaMask disclosed an infrastructure incident on 30 September 2026 and exited affected staking validators as a precaution. In a 5 November update it said a threat actor gained access to systems storing reward recipient addresses and diverted about 0.385 ETH in rewards, which it is refunding.
The Arizona court system said an attack that began on 24 September 2026 let hackers copy backup court files. The court puts the FARE debt program exposure at about 1.3 million people and says it has no evidence the data was read or shared. It tells affected people to freeze their credit.
The FBI classified a hack of its FBIJobs.gov portal as a major cyber incident in September 2026. ShinyHunters claimed responsibility. A DOJ memo reported on 3 November says some US attorney office employees may also have had data stolen, and notifications are going out on a rolling basis.
On 27 October 2026 New Zealand's Ministry of Justice said some Coroners Court information was caught up in a cyber incident at Dunedin company Zenith Technology (ZenTech). The attack was claimed by a ransomware group, a High Court injunction bars anyone from using or publishing the data, and a small number of coronial cases have been delayed.
SIMBA Telecom said on 25 September 2026 that a breach discovered the day before exposed the personal details of 23,549 customers. It says no credit card or bank account data was involved and that it has no sign of misuse. Singapore's PDPC is investigating.
GroundUp reported in late September 2026 that the database behind Gauteng's e-Panic Button app was left open, exposing the names, reports and locations of people who asked for help. The Gauteng Department of e-Government says it stopped an attempted breach and that no citizens' personal information was compromised, a position the provincial legislature's committee has not accepted without evidence.