TechReview tracks every major data breach, ransomware incident and large-scale outage we cover, in one place. This page is updated each time a new incident is confirmed. Numbers are labeled carefully: confirmed means the company or a regulator has stated the figure; claimed means an attacker or an early report put the number out and it has not been verified.
22 incidents tracked so far, newest month first. If your information was exposed in any of them, start with our guide: Data Breach? What to Do When Your Personal Information Is Leaked.
October 2026 Incidents
| Date | Company / Organization | What happened | People affected | Our coverage |
|---|---|---|---|---|
| May-Jul 2026 | AOMEI Backupper | Update servers hijacked for 21 minutes across 3 windows to push SHINYROAD backdoor; disclosed Oct 20 | Unknown (11 countries confirmed) | Read our coverage |
| Oct 16, 2026 | Conduent | $80M proposed settlement over 2024 breach; court approval pending, no claim deadlines yet | 62.2 million | Read our coverage |
| Oct 14-15, 2026 | Zeabur | Second breach in 48 days exposed 3.2M environment variable records; company shutting down by Dec 31, 2026 | 321,810 accounts | Read our coverage |
| Oct 18-19, 2026 | UpdraftCentral (TeamUpdraft) | Backdoor plugins pushed to WordPress sites via stolen UpdraftCentral keys | ~400,000 sites at potential exposure (estimate, not confirmed victims) | Read our coverage |
| Oct 20 | Google Cloud / Revolut | Power event in Google’s London zone knocked Revolut payments offline; UK court hearings disrupted | Revolut’s 80M+ customers (service outage) | Google Cloud Outage: Revolut Down |
| Oct 20 | Hostinger | Google Cloud data-center power failure took the dashboard, API and checkout down for ~8 hours (hosted websites unaffected) | Hostinger customers (dashboard access) | Hostinger Down Today |
| Oct 15-16 | Rank Math PRO (WordPress plugin) | Supply-chain attack: PRO v3.0.123 downloads carried a backdoor for ~11 hours | WordPress sites that updated in the window | Rank Math PRO Supply-Chain Attack |
| October | iRhythm Technologies | Unauthorized access to the Zio heart-monitor maker’s systems | 368,173 confirmed; regulatory filings scope up to 8.2M | iRhythm Data Breach |
| October | Anne Arundel County, MD | Cyber incident detected Aug 28; Rhysida ransomware group later claimed theft (unverified) | County residents; 2.6 TB claimed by attackers | Anne Arundel County Cyber Incident |
| October | California student data (ETS) | Vendor SFTP compromise at tester ETS exposed student data | Millions of student records (per our report) | California Student Data Breach |
| October | BAE Systems / BNC | Cyberattack disrupted the US Bankruptcy Noticing Center’s court services, ongoing since Oct 9 | Service disruption (no records figure) | BAE Systems Outage |
| October | Central Ohio Primary Care (COPC) | Vendor breach at one of the largest US physician groups; free monitoring offered via IDX | 1.4M patients and staff | COPC Data Breach |
| October | CenterPoint Energy | Vendor-related breach disclosed to the Texas Attorney General | 1,062,060 Texans (confirmed, TX AG) | CenterPoint Data Breach |
| October | YAM Store phishing marketplace | Microsoft and Japanese authorities took down the YAM phishing marketplace behind a massive scam-text operation | Scam campaign: 1 billion scam texts (takedown) | YAM Store Data Breach |
| October | Denmark CPR register (Pays ApS) | Payment processor incident exposed Danish CPR data; a vendor password was “123456” (Politiken) | ~8.8M records | Denmark CPR Breach |
| October | South Korea bank hack | Coordinated hack hit 16 South Korean financial firms | 100,000 records leaked | South Korea Bank Hack |
| October | npm “SlugFest” | Flaw in npm trusted publishing put popular packages at risk of takeover | 1,500+ packages at risk | npm SlugFest |
| October | French supermarkets (Danfoss) | Attackers hijacked Danfoss refrigeration controls and overheated hundreds of French supermarkets | Hundreds of stores (operational attack) | France / Danfoss Incident |
| October | Ahold Delhaize | Cyberattack took Food Lion, Stop & Shop and Giant systems down | Store networks (operational outage) | Ahold Delhaize Breach |
| October | Gears of War (Xbox) | DDoS attack disrupted game servers | Players (service outage) | Gears of War DDoS |
| October | ASOS | Fake “ASOS hacked” push-notification scam targeted shoppers | ASOS shoppers (scam campaign) | ASOS Data Breach |
| Oct 2 | Oracle Health | Breach at the health-tech provider; early reports put records in the millions | Up to 20M (reported, not final) | Oracle Health Breach |
How to Read This Tracker
Breach numbers move. Companies routinely revise counts months later, attacker claims are often inflated, and regulators sometimes publish larger scopes than the first notice. We update the figures on this page when a company filing, a state attorney general posting, or the company itself gives a better number, and we say which source the number came from.
Worried about a specific incident? Each linked report explains what was exposed and the exact steps to protect yourself: freezing your credit, watching for phishing, and setting up the free monitoring the company is offering.
Spotted an incident we have not covered? Tips and corrections: contact@techreview.si.