August 2026 Breach Roundup: 33.8 Million Records, and One Group’s Fingerprints on Five of Them

Nine breaches entered the XposedOrNot index in August. Between them: 33.8 million records.

July’s roundup was about delay. Thirteen breaches, a median wait of 152 days, one entry that took eight and a half years to surface. August is the opposite month. Every one of the nine happened this summer. The median gap between the breach and the day it became searchable here was 29 days. Not because the pipeline got faster (it did not change), but because of who was doing the leaking, and how quickly they publish.

Here is the month, with receipts.

What landed in the index

Every entry is verified and searchable. Counts are records, not people; one person can appear more than once.

A few of these deserve more than a row.

Carhartt is three quarters of the month on its own. 24.9 million unique email addresses, with names, phone numbers, physical addresses and dates of birth, published after an alleged ShinyHunters intrusion in August. A workwear retailer is not where most people expect their home address to leak from. If you have ever bought a jacket online, this is the one to check first.

Five of the nine carry the same name. Carhartt, RingCentral, Brinks Home, Inter-Con Security and Alcon are all attributed, in the source reporting, to the ShinyHunters group. Two more (Questel and Sharecare) are described as exports from Salesforce instances, which is the same playbook that group has been running against corporate CRM systems all year. I am not going to speculate beyond what the reporting says. The pattern is visible enough in the table without help.

Which explains the speed. When a group’s business model is publishing what it took, the data goes public in weeks, not years. July’s Autocentrum entry sat unseen from February 2018. August’s slowest entry, Inter-Con Security, took ten weeks. Faster surfacing is good for the people affected, in the narrow sense that they can find out sooner. It is not good news in any other sense.

And notice what is missing. Not one of the nine contains a password we could assess. Every entry is contact data: names, emails, phone numbers, addresses, job titles, in some cases dates of birth and partial purchase details. That changes what you should do about it, so it gets its own section.

This month’s leaks are about your phone, not your password

The usual advice after a breach is “change your password”. For August, that advice mostly does not apply, because for eight of nine entries there was no password in the data to begin with.

What leaked instead is raw material. A scam call or a phishing email needs a name, a company, a job title, a phone number, a home address, and this month handed over all five. Someone who has your Brinks Home record knows you have a home security system and roughly where you live. Someone with your RingCentral or Questel record knows where you work and what you do there. That is the risk profile of this month: not account takeover, but targeted contact.

So, three things instead of the usual one.

First, expect calls and emails that know things about you. “We are calling from your security provider about your account” is a sentence that lands differently when the caller has your address. Verify through a number you look up yourself, never the one they give you.

Second, if your work email is in any of the corporate entries (Questel, Sharecare, Lumenis, Inter-Con Security), tell your IT team. They can watch for lookalike-domain phishing aimed at the company; we have a free phishing domain scanner for exactly that.

Third, dates of birth do not rotate. Carhartt, Questel, Brinks Home and Lumenis all include them. Combined with a name and address, that is the identity-theft starter kit, and the only real defence is a credit freeze in the countries that offer one. Nothing in a password manager fixes it.

What August says about the lag, then

I will not repeat July’s whole argument, but one number is worth putting next to the other. July: median 152 days from breach to searchable. August: 29. Same catalog, same verification rules, same team. The difference is entirely in what surfaced, not in how we work. When the people holding the data want it public, you find out in weeks. When they do not, you find out in years, if at all. Both months are the normal state of things; neither is the exception.

Which is the same conclusion as last month, from the other direction. A quiet inbox is not evidence. Monitoring is not about reacting fast to one headline; it is about being findable whenever your data surfaces, whether that takes three weeks or eight years.

Since the month closed

Two more entries landed in the first days of September that belong to August’s story. Manchester Airports Group, 8,379,476 records from an August intrusion, published by the same group named above: if you have flown through Manchester, Stansted or East Midlands, do not wait for September’s post. And Baxter International, 488,992 records, also dated August, added on September 4 as this was being written. Both will count in September’s total.

On the radar: reported in August, not yet verified

Far more crossed the news in August than entered the index, and the gap is the point. A claim is not a dataset. Before anything becomes searchable here, the data has to surface, check out as genuine, and map to real accounts. Most loudly reported incidents never get that far. Nothing below counts toward the 33.8 million.

• McKesson: the healthcare distributor says someone got into third-party applications and took data. ShinyHunters puts the haul at about 284 million patient-related records (records, again, not patients) and wants $55.2 million for it. If that dataset ever surfaces, everything else in this post looks small.
• Unlimited Technology Systems: a healthcare software firm, a breach dated 2025, 3.8 million people, and the worst kind of data list: Social Security numbers, insurance details, medical records, every one of them qualified with “potentially”. Disclosed this August, so more than a year late.
• CareCloud: the healthcare IT provider says a March 2026 intrusion into an AWS environment exposed data on 3.76 million people. Five months from breach to disclosure, which by this month’s standards is slow.
• Wesco: the distributor is investigating after ExfilSquad claimed 2.6 million records from its cloud CRM. Another CRM, another extortion group, same shape as the verified table above.
• CEVA Logistics and Valve: a cyberattack on the shipping company’s European warehouses spilled into its customers; Valve has warned European Steam hardware buyers that names, addresses, phone numbers, emails and order details were exposed. One breach, two notification letters.

We track these through xonPulse, our breach-news feed, and when leaked data from any of them surfaces and verifies, it enters the index and alerts go out. Manchester Airports Group is what that handoff looks like when it is quick: on the Pulse feed on August 28, verified and searchable on September 3. Six days. When it is slow, it looks like Autocentrum in July’s post, eight and a half years. Alert subscribers do not need to know which kind they are dealing with; the alert arrives either way.

Check yourself, then stop checking

Ten seconds against the full index, free, no signup: xposedornot.com

Better: verify your domain or set up personal alerts for your whole household, and let September’s additions find you instead. Every number in this post is queryable on the free API, no key needed, and every breach above has its own page in the breach directory.

And if this monthly receipt-keeping is useful, a star on GitHub helps others find the project. It also makes our day, which I mention every month and mean every month.

Appendix: Sources and references

• All 9 August additions with counts and dates: our public catalog; per-entry lookup at api.xposedornot.com/v1/breaches?breach_id=NAME (records pulled 2026-09-04, addedDate filter 2026-08)
• Lag figures: computed from each entry’s breachedDate (month granularity, counted from the 1st) vs addedDate; median 29 days, range 9 to 73 days; July comparison from the July 2026 roundup (median 152 days)
• Attribution language (“allegedly”, “targeted by”, “Salesforce records”) taken from each catalog entry’s description, which follows the original reporting; nothing added
• Manchester Airports Group: catalog entry added 2026-09-03, breachedDate Aug 2026, 8,379,476 records; Baxter International: added 2026-09-04, breachedDate Aug 2026, 488,992 records
• Phishing domain scanner: blog.xposedornot.com/free-phishing-domain-scanner; org-wide alerts: blog.xposedornot.com/free-org-breach-alerts
• On-the-radar items: xonPulse entries dated August 2026; original reporting via bleepingcomputer.com (McKesson, Unlimited Technology Systems, CareCloud, Wesco, Valve) and techcrunch.com (CEVA Logistics). All five checked absent from the catalog on 2026-09-04 (breachID and domain scan).