
September 2026 Breach Roundup: 13.6 Million Records, and the Passwords Are Back
Five breaches, 13.6 million records, and two of them carry password hashes: September 2026 in the XposedOrNot index, why the

Five breaches, 13.6 million records, and two of them carry password hashes: September 2026 in the XposedOrNot index, why the

Nine breaches, 33.8 million records, a 29-day median delay, no passwords: August 2026 in the XposedOrNot index, and why it

Thirteen breaches, 58.4 million records, and a median 152-day delay: July 2026 in the XposedOrNot index, plus five reported breaches

LastPass, Xsolis, Tata Electronics, Kodak, Novo Nordisk, Nintendo, Klue, and London Hydro.

Vimeo, NVIDIA, Braintrust, Trellix, and Instructure.

Hungarian government, Orrick Herrington & Sutcliffe, Rockstar Games, LAPD, and Eurail

Dutch National Police, European Commission, AFC Ajax, Crunchyroll, and Infinite Campus.

McDonalds India, UStrive, Canadian Investment Regulatory Organization (CIRO), and Ingram Micro.

Instagram, Nissan, University of Hawaii Cancer Center, Betterment, Eurail, Central Maine Healthcare, and Grubhub.









