October 2026 Data Breaches: India and Worldwide Roundup

Last updated: 29 October 2026. Covers incidents first disclosed or confirmed between 1 and 29 October 2026.

We tracked about 70 breaches and data-theft incidents disclosed in October 2026. However, this post covers the ones that matter most to readers in India: Indian victims, services Indians use, and attacks that point to a risk your own organisation probably has.

First, a word on numbers. Companies, regulators and attackers count differently. For example, “records” is often not the same as “people”, and a figure posted on a leak forum is a claim until the organisation confirms it. So each entry below says which kind of number it is.

The short version

Above all, most of October’s big breaches started with a stolen password, token or API key that let the attacker simply log in.
Suppliers were the weak point again. For example, a Japanese email-delivery vendor (Ymir Link), a cloud provider (IDC Frontier), a fax-to-email platform and an analytics tool (Amplitude) each exposed data belonging to their customers’ customers.
Meanwhile, Japan had an unusually bad month: at least eight incidents above one million records.
In India, SBI confirmed a leak through a stock-exchange filing, researchers found that eMudhra’s certificate keys were weak, and ransomware hit a hospital in Chhatrapati Sambhajinagar. CERT-In also issued two advisories about stolen API credentials and AI agents.
Attackers also went after developer platforms for the secrets they store: Zeabur, Railway, LiteLLM, OpenCode, PingCAP and others.
Finally, at least one large leak came from inside: a Panasonic group employee uploaded HR data on about 334,000 people to a generative-AI service the company had banned.

India: what was disclosed

Date	Organisation	What happened	Status
9 Oct	Indian NBFCs, digital lenders, fintechs, wallets (not named)	CERT-In advisory: stolen API credentials used to call fund-transfer and disbursal APIs, with money moved to mule accounts	Reported by CERT-In
15 Oct	Unnamed Indian organisations	CERT-In advisory: AI agents under test used credentials left in app configs and public code to read live personal and business data	Reported by CERT-In
20 Oct	eMudhra (emSign intermediate CAs)	Private keys of 8 intermediate CAs could be computed from the public certificates because of weak randomness in an April 2025 key ceremony. Browsers blocked them; no exploitation reported	Confirmed
21 Oct	State Bank of India	3,897 customer records with personal data confirmed by the bank, inside a set of about 3.75 lakh rows offered on the dark web	Confirmed (bank’s count); 3.75 lakh is the seller’s claim
21 Oct	HDFC Bank	Internal probe found two senior executives shared confidential business information with outsiders	Reported
21 Oct	Rajasthan Police	A group calling itself Scarlettgroup claims about 70,000 identity records and 59,460 mobile numbers. Police had not commented	Claimed, unverified
27 Oct	Kamalnayan Bajaj Hospital, Chhatrapati Sambhajinagar	Ransomware encrypted 9 servers including the hospital management system on 18 Oct. FIR registered, CERT-In informed. The attackers claim to have taken patient data	Attack confirmed; data theft claimed

We wrote separate guides on two of these: what SBI customers should do and the eMudhra certificate problem. We also covered the CERT-In advisory on AI agents and leaked keys in this post.

What Indian organisations should take from this

Two things stand out. First, both CERT-In advisories describe credential theft, and SBI said its source was still under investigation when it filed. Second, the Bajaj Hospital case shows how ransomware takes down a hospital’s patient, billing and insurance systems at the same time.

Meanwhile, if you are a covered entity under the CERT-In Directions of 28 April 2022, you must report a cyber incident to CERT-In within 6 hours of noticing it. Under the DPDP Rules, the detailed breach report to the Data Protection Board within 72 hours (Rule 7) applies from May 2027, so now is the time to write your breach plan. Our DPDP compliance checklist covers what to prepare.

Japan’s record month

Japanese companies disclosed one large breach after another in October, and several of them came through suppliers.

Disclosed	Organisation	Size (as stated)	Data
5 Oct	Monogatari Corp. (Yakiniku King app)	about 10.79 million app members	Names, emails, phone numbers, member numbers
9 Oct	Adventure Inc. (skyticket)	about 14.64 million records, incl. about 4.13 million hashed passwords	Contact details, birth dates, hashed passwords, some refund bank details
9 Oct	Daiichikosho (Big Echo karaoke), via contractor Nippon Columbia	about 8.72 million customers and employees	Names, gender, birth dates, emails, phone numbers
9 / 13 Oct	Bookoff	6,383,279 people (second report)	Names, birth dates, contact details, addresses, member numbers
15 Oct	Burger King Japan	11.18 million app user records	Contact details, birth dates, order history (no cards)
22 Oct	Capcom (CAPCOM ID)	more than 11.7 million accounts	Mostly emails and login metadata
26 Oct	Ymir Link (Cuenote FC email service)	51.6 million records across about 50 client systems, counted with duplicates	Mostly email addresses
27 Oct	Sony Network Communications (So-net, plala)	2,585,481 member records, plus 54,401 mailbox passwords	Names, phone numbers, emails, birth dates
28 Oct	Hana Cupid	4,238,242 member records	User IDs, encrypted passwords, emails

Suppliers behind the Japanese leaks

The Ymir Link case reaches furthest because its email-delivery service sends newsletters and notices for banks, railways and retailers, and after its second report on 26 Oct, JR Central, JR West, JR Kyushu, Resona Bank and others told their customers their addresses may have leaked. As a result, expect very convincing phishing that looks like it comes from a bank or railway you actually use.

Similarly, the ransomware attack on IDC Frontier (a SoftBank cloud subsidiary) shows how one provider’s incident spreads to its clients. At first JR East said the incident might affect up to about 6.09 million records. However, on 14 Oct IDC Frontier said it found no trace of anyone taking data, and on 15 Oct JR East said no leak occurred for its Eki-net and Otona no Kyujitsu Club members.

Meanwhile, GMO Internet shut down all of its Onamae.com Desktop Cloud servers (up to 26,739) on 21 Oct after an intrusion. GMO refused to pay, so the attackers began publishing data on 27 Oct. GMO then offered a reward of up to US$1 million for their identity.

Panasonic’s case is different and, for many Indian companies, closer to home. On 23 Oct Panasonic Holdings said a project member had uploaded part of an HR system extract to an external generative-AI service that staff were not allowed to use. The data covers about 334,000 current and former employees and family members, even though no outside attacker took part.

Healthcare: patient data and stopped hospitals

iRhythm Technologies (USA, 9 Oct): the Oregon AG filing for this maker of Zio heart monitors lists 8,179,772 people, because attackers used social engineering to get into business applications that a third party hosts.
Quest Diagnostics (USA, 22 Oct): confirmed in an SEC filing that an intruder reached patient records through its Quanum LSM ordering and results system. However, it has not given a count yet.
University of New Mexico hospitals (USA, 26 Oct): New Mexico’s only Level I trauma centre diverted ambulances and cancelled clinics after a cyberattack. An extortion group also claims to have data, but nobody has verified that.
Denver Health Medical Plan (USA, 26 Oct): a vendor’s access key sat on a public website for more than a year, so data on 238,083 members was open to anyone who found it.
Icon Cancer Centre (Australia, 12 Oct): patient letters stolen from a supplier’s fax-to-email platform. Icon gives no count, while the seller claims more than 31,000 documents.
Ampath Laboratories (South Africa, 13 Oct): attackers claim 80 million patient records. The company confirmed an incident but says the attackers overstate the figure.

You may also see Oracle Health’s “20 million patients” in October headlines. However, that breach happened in early 2025. It made news again because the Texas Attorney General posted an updated total of 19,929,149 on 2 October 2026.

Developer platforms and the secrets they hold

Several attacks also went after platforms because of the API keys and database passwords their users store there.

Zeabur (Taiwan, 19 Oct): the breach exposed 321,810 accounts and about 3.2 million environment-variable records. Specifically, the attackers used long-lived admin tokens that Zeabur kept in plain text in an internal config repository.
Railway (USA, 21 Oct): attackers reached some users’ encrypted environment variables and decrypted some of them. As a result, Railway asked all users to rotate keys.
LiteLLM 1.107.0 (21 Oct): malicious packages stayed live on PyPI and Docker for roughly two hours after attackers used stolen GitHub tokens on the release pipeline. Our guide: LiteLLM compromise, what to do.
OVHcloud CLI (19 Oct): for about 94 minutes, trojanised versions replaced the real release files on GitHub. See OVHcloud CLI and Railway: rotate your secrets.
OpenCode (17 Oct): attackers took saved OpenAI, Anthropic and Google API keys of about 1.4% of OpenCode Console users from a legacy system that OpenCode was shutting down.
PingCAP TiDB Cloud (19 Oct): stolen service-account credentials gave access from 9 Sep to 7 Oct to user names and emails, SQL editor text, billing records and encrypted API key values.
TeamUpdraft (UpdraftPlus, 18 Oct): attackers used stolen UpdraftCentral connection keys to add admin users and backdoor plugins to customer WordPress sites. Check your site with this guide.
ConnectWise Cloud Backup (16 Oct): attackers used stolen credentials for the app to sign in to customers’ Microsoft 365 tenants, which bypasses MFA. Huntress counted at least 162 compromised tenants, and Microsoft attributes the attack to Storm-0940. Details in our ConnectWise post.

So if your team uses any of these, rotate every key the platform held, not only the ones you think the attackers saw.

Other notable breaches

Denmark’s CPR register (5 Oct): names, addresses and national ID numbers of about 8.8 million people, taken by misusing a private company’s legitimate search access.
Educational Testing Service / California (16 Oct): data on more than 5.7 million students, including disability status, after an attacker used one compromised login on an SFTP site from May to September.
Loblaw (Canada, 23 Oct): about 2 million Canadians, although Loblaw found the intrusion back in March.
Canadian Crime Stoppers (21 Oct): a CBC investigation found more than 1.5 million tips exposed, over 850,000 with personal details, which breaks the anonymity promise the service runs on.
ASOS (UK, 6 Oct): attackers tricked an employee into giving up credentials, then used them on third-party platforms, for example to send a rogue push notification.
Coinbase (28 Oct): contact details of “a small subset” of customers leaked through its analytics vendor Amplitude, but customer funds stayed safe.
South Korea: Daishin Securities confirmed attackers took 38,490 customers’ data (28 Oct), and Bithumb reported a breach the same day. In addition, police said a seven-person ring used an AI tool to steal 8.2 million records from more than 90 organisations.
k0t campaign (21 Oct): Group-IB found more than 70,000 firewall and VPN credentials stolen from FortiGate, FortiWeb and GlobalProtect devices, with Asia-Pacific the largest region in the data. Our k0t guide also explains how to check your devices.

What October tells us

Overall, leaked tokens, stolen logins, a vendor key left on a public website and a social-engineered employee explain more of this month’s damage than any CVE. Patching still matters, but so does knowing which credentials exist and who holds them.

In addition, Ymir Link, IDC Frontier, Amplitude, the Icon fax platform and SquareML (Denver Health) all sat one step away from the people whose data leaked, so the companies’ own security could not protect those customers.

Also, in the Panasonic case and the CERT-In AI-agent advisory, data went somewhere nobody had approved, through staff or AI tools, without an attacker.

Finally, Ampath, Rajasthan Police and the 3.75 lakh SBI figure all rest partly on attacker claims. Therefore, treat leak-forum numbers as unconfirmed until the organisation or a regulator confirms them.

What to do now

For people whose details may be in one of these breaches:

Change the password for that service, and also anywhere else you used the same one. Then turn on two-step verification.
Expect phishing that quotes real details: your bank, your booking, your order number. In fact, banks and railways will not ask for an OTP or ask you to “verify” by clicking a link. Paste anything suspicious into our free scam message checker.
If the leak included ID numbers or bank details, watch your statements and do not share OTPs with callers who say they are from the bank or the police.

Meanwhile, if you run IT for an organisation:

First, list every API key, token and service account, and remove the ones nobody can explain. Then rotate anything stored on a platform that reported a breach this month.
Ask your key suppliers (email delivery, analytics, cloud, backup, remote support) what customer data they hold and how they will tell you about a breach. Then put it in the contract.
Also write down which AI tools staff may use and what data they may put into them.
In addition, use phishing-resistant MFA on admin, email and remote-access accounts, and alert on mass exports.
Check your incident plan against the CERT-In 6-hour rule, and start the DPDP work due by May 2027. For example, our free DPDP readiness check takes about five minutes. You can also run your domain through the email security checker to see whether attackers could spoof your emails.

Finally, if you want an outside view of what an attacker would find in your systems, our VAPT service tests your web apps and network with a written report.

Sources

India

Japan

Healthcare

Developer platforms

Other

Need help finding and fixing exposed systems? Our VAPT services find unpatched and exposed systems before attackers do, and our free website safety check grades your site in seconds. Contact us for a quote.

The short version

India: what was disclosed

What Indian organisations should take from this