July 2026 Breach Roundup: 58 Million Records and an Eight-Year Echo

Thirteen breaches entered the XposedOrNot index in July. Between them: 58.4 million records.

That number is the easy part. The interesting part is when those thirteen actually happened, because only two of them belong to July. The rest arrived carrying anywhere from a month to eight and a half years of delay, and one of them spent so long in the dark that the affected company probably considers it ancient history.

Here is the month, with receipts.

What landed in the index

Every entry below is verified and searchable. Counts are records, not people; one person can appear many times.

A few of these deserve a sentence.

Paidwork was July’s heavyweight. A gig-economy platform, allegedly breached in March, published online with 23.3 million records: emails, names, passwords, birth dates, banking details, the works. If you have ever signed up there, this is the one to check first.

The education cluster is hard to miss. Three American community colleges plus Harvard in a single month, about 3.4 million records between them. Schools hold identity-grade data and run on thin security budgets. Attackers have noticed. If you carry an address from any of these, the per-breach card shows exactly which data classes leaked.

The middle of the table is quietly damning. ACTMobile’s 10.1 million records come from an October 2021 incident that stayed invisible for almost five years. Paytm’s 3.4 million took six. Nobody was hiding these on purpose; the data just circulated in places where its owners could not see it, which is the normal way this works.

And then there is Autocentrum. Breached in February 2018. Surfaced in July 2026. For eight and a half years, roughly 164,000 people had no way to know their data was circulating. That is not a gap in our pipeline; the data simply was not public until now. Which brings me to the pattern worth understanding.

The lag is the story

Five of July’s thirteen additions were more than a year old by the time they could be indexed. The median delay across the month was 152 days. Meaning: on the day a typical breach becomes searchable, its victims are already five months behind the attackers who had the data from day one. And July was a fast month by the index’s own standards; the long-run picture is worse, which deserves its own post soon.

I keep making this point because the popular mental model of a breach, incident today, headline tomorrow, notification Friday, describes almost nothing in this table. Data leaks slowly, gets traded quietly, and turns public on no schedule at all.

What should you do with that? Two things. Stop treating a quiet inbox as evidence you are fine, because July’s additions prove silence can last eight years. And stop trying to react to breach news manually. Monitoring is not about reacting fast to one event. It is about being findable whenever your data finally surfaces, next week or next decade.

On the radar: reported in July, not yet verified

Plenty more crossed the news in July than entered the index, and the difference matters. A claim is not a dataset. Before anything becomes searchable here, the underlying data has to actually surface, check out as genuine, and map to real accounts, and plenty of loudly-reported incidents never get that far. None of these count toward the 58.4 million above; that total is verified records only. These five were reported during the month and are worth knowing about:

• NYC Health + Hospitals: an extortion group claims an 11TB archive touching 12 million people; about 1.8 million victims are officially confirmed so far. The gap between those two numbers is exactly why “alleged” matters.
• MCBS: the healthcare billing company disclosed a breach affecting over 1.26 million individuals, with Social Security numbers and medical records potentially exposed.
• Accenture: a hacker claims 35GB of company data including source code and security keys. Corporate exposure so far, not consumer records.
• Miinto: the fashion marketplace confirmed attackers reached its order system; names, addresses, and phone numbers, though not full card details.
• Aflac: a breach disclosed at its Japan subsidiary, scope still emerging.

We track these through xonPulse, our breach-news feed, and when leaked data from any of them surfaces and verifies, it enters the index and alerts go out. That handoff, from headline to verified searchable record, is the pipeline this whole post has been describing. Sometimes it takes days. For Autocentrum it took eight and a half years. When any of the five verifies, it will appear in a future roundup; alert subscribers will simply not need to wait for one.

Check yourself, then stop checking

Ten seconds against the full index, free, no signup: xposedornot.com

Better: verify your domain or turn on personal alerts, and let August’s additions find you instead. Every number in this post is queryable on the free API, no key needed.

And if this monthly receipt-keeping is useful, drop us a star on GitHub. It helps others find the project, and honestly, it makes our day.

Appendix: Sources and references

• All 13 July additions with counts and dates: our public catalog, per-entry lookup at api.xposedornot.com/v1/breaches?breach_id=NAME (records pulled 2026-08-10, addedDate filter 2026-07)
• Lag figures: computed from each entry’s breachedDate vs addedDate (median 152 days; 5 of 13 over 365 days; Autocentrum Feb 2018 to Jul 2026 = 3,093 days)
• On-the-radar items: xonPulse entries dated July 2026, original reporting via hackread.com (NYC Health + Hospitals), bleepingcomputer.com (MCBS, Accenture, Aflac), theregister.com (Miinto)
• Domain monitoring walkthrough: blog.xposedornot.com/free-domain-breach-monitoring