Breach news · weekly · sourced · RSS
Breach news
What entered the public record, who it actually affects, and what is worth doing about it. One piece a week, and nothing at all in a week with nothing in it. If you want the raw list rather than the reading, the index is over here.
A breach in a country you only visit
Everything that joined the public record this week came from French organisations: booking files from a holiday-rental network, and assistance records from the state pension fund. No entry lists a password. What they carry is home addresses, phone numbers, dates of birth, French social security numbers — and in one case the names of relatives who never dealt with the organisation themselves.
5 min read
A breach at a company you never used
Everything that joined the public record this week came out of a company's sales database rather than its customer list. The people in those records were leads: they never opened an account, never agreed to anything, and mostly will not recognise the company's name. No entry lists a password. What they list is home addresses, phone numbers, employers and job titles.
4 min read
Three days, or three and a half years
Everything that joined the public record this week had already happened — one of them on Sunday, one of them in April 2023. No entry in the window lists a password. What they list instead is home addresses, employers, and in one case bank account numbers and tax identity numbers.
5 min read
The company that lost it was not the one you chose
Everything that joined the public record this week was lost by a firm the affected people had never dealt with directly. One of them reaches British Revolut customers, and what it took was home addresses, employers and ages.
5 min read
A quiet week, and why we are telling you anyway
One entry joined the public record in the last seven days. It is American, it is healthcare, and most British readers will not be in it. Here is what it is worth knowing anyway.
4 min read
Breach records from Have I Been Pwned, CC BY 4.0. We cover only entries we would put our name to; stealer-log dumps and carding forums are excluded on purpose.