Check Now
Breach Roundups

October 2026 Breach Roundup: 90.9 Million Records, and Most of Them Are Years Old

November 13, 2026
October 2026 breach roundup: a time capsule dug out of the ground with glowing letters spilling from it, beside the headline 90.9M records, most of them years old, and the line 10 breaches, oldest from 2019

The biggest breach we added in October happened in January 2020. Pre-pandemic. The third biggest is from 2019.

Ten breaches entered the XposedOrNot index in October 2026, double September’s five, with 90,883,625 records between them. But 90.9% of those records come from five breaches dated 2019 to 2024. Only 8.2 million come from anything that happened this year.

That means a breach you’d long forgotten can land in your results this month. Most of what arrived is older than the phone in your pocket.

I run XposedOrNot, a free, open-source breach checker: you type in an email address and it shows which public breaches that address turns up in. Every count from our breach catalog below was pulled on 11 November 2026, and anything from the news links to its source. It held 798 breaches and 11,718,210,957 records that day.

The ten breaches added in October 2026

Each count is unique email addresses in that breach, so one person can sit in several rows. The gap column runs from the month the breach happened to the day it became searchable here. Breach dates carry month precision, so I count from the 1st.

BreachHappenedRecordsReached the index afterPublicly searchable?
ZooskJan 202037,378,4346.8 yearsNo, sensitive
SuperVPN and GeckoVPNFeb 202120,366,2535.7 yearsYes
LimeLeadsAug 201918,071,5257.2 yearsYes
McKessonAug 20266,832,8229 weeksYes
Angel OneApr 20236,767,2423.5 yearsYes
CrunchbaseJan 2026560,3629 monthsYes
MedelaSep 2026423,8945 weeksNo, sensitive
Double CounterOct 2026294,74110 daysYes
Gîtes de FranceMay 2026117,6786 monthsYes
Assurance RetraiteSep 202470,6742.1 yearsYes

Half the list is from 2026 and half is older, but the records don’t split anywhere near that evenly.

Stacked bar of the 90,883,625 records added to the XposedOrNot index in October 2026: five breaches dated 2019 to 2024 hold 82,654,128 records (90.9%), led by Zoosk at 37.4 million, while five breaches dated 2026 hold 8,229,497 (9.1%)

The median gap was 533 days. About a year and a half from breach to searchable, for the typical October entry. (September’s median was 55 days, which tells you how lopsided this month is.)

Why a 2020 breach shows up in 2026

Zoosk wasn’t hacked again last month. What changed is that we got hold of a copy of the 2020 data and could check it.

That’s normal, and it never makes headlines. Data gets stolen, sold, traded and passed around for years (the Zoosk file has been doing the rounds since 2020). So the gap in the table measures how long each copy took to reach our index, and nothing more.

Timeline from 2019 to 2026 with one bar per October 2026 addition, each running from the month the breach happened to the day it entered the XposedOrNot index: LimeLeads 7.2 years, Zoosk 6.8 years, SuperVPN 5.7 years, Angel One 3.5 years, Assurance Retraite 2.1 years, then five 2026 breaches from 10 days to 9 months

We’ve written about the same effect from the other end, in the Anti Public combo list post: a file from 2016 that still turns up in checks today. Old data doesn’t expire. It just changes hands.

What should you take from that? The date on a breach tells you when your data left, and nothing at all about when someone will start using it.

The rows worth a closer look

Zoosk is the big one, and you can’t search it publicly. The copy of the dating site’s January 2020 breach that we verified holds 37.4 million unique email addresses (the sellers claimed 30 million user records at the time), next to dates of birth, religions, ethnicities, political views and sexual orientations. We flag breaches like this as sensitive, which means they don’t appear in a public search of an email address.

So how do you find out if you’re in it? Turn on Alert Me, our free breach alerts, and confirm your address. Sensitive breaches then show up in your alert results and in your dashboard, where only you can see them.

Why bother hiding it? Because a public “this email was on a dating site” result could out someone to whoever typed the address in. That’s a harm we won’t hand to whoever happens to type your address in.

If you had a Zoosk account around 2019, assume your profile details are out there. There were no usable passwords in the copies that circulated, so this one is about being recognised by people who were never meant to know.

SuperVPN and GeckoVPN were free VPN apps whose user data went up for sale together in February 2021, with a third app in the same file. Our copy holds 20.4 million unique addresses with rough location and device details (make, model, serial numbers). There’s an irony in a privacy app leaking your location, and I don’t think it’s lost on anyone.

LimeLeads is a sales list you never joined. It was a B2B leads database left open on an unsecured server in 2019, and our copy holds 18.1 million unique work email addresses next to employers, job titles and phone numbers. The broker gathered your work details to sell, and then lost them.

That makes it a work problem. If your company address shows up, it’s worth telling IT, and whoever looks after the domain can watch every address on it for free instead of hearing about breaches one mailbox at a time.

McKesson keeps a promise from last month. It sat on our radar in August as a claim of 284 million records, entered the index on 2 October, and September’s roundup said it would count here. It does: 6.8 million unique addresses with names, phone numbers, home addresses and dates of birth.

Angel One matters most if you trade in India. The copy we verified from the stock broker’s April 2023 breach carries 6.8 million unique email addresses alongside names, addresses, phone numbers, bank account numbers and PANs (India’s tax ID). That’s close to a full identity kit, and it’s exactly what a fake “your trading account is blocked, verify your KYC” call needs.

(When a 7.9 million-customer file made the news in 2024, Angel One said it was that same 2023 incident, not a new one.)

The rest is smaller and newer. Crunchbase confirmed in January that files were taken from its network. Medela hasn’t said anything public that I could find, though the data checked out, and it’s flagged sensitive like Zoosk.

Double Counter, a Discord bot, says an attacker got in through an old Metabase analytics server and copied about a million email addresses; 294,741 unique ones are in the copy we verified. The company dates the attack to 4 October, and it was searchable here a week later. And two French entries, Gîtes de France and the national pension fund Assurance Retraite, came in late in the month.

No passwords this month, so what do you change?

None of the ten entries contains a usable password. September had two that did. So the usual “change your password” advice doesn’t fit October very well.

What leaked instead is the stuff you can’t change. Dates of birth turn up in four of the ten, phone numbers in seven, home addresses in six, and government ID numbers in two. Nobody can issue you a new birthday.

Grid of the ten October 2026 additions against six data types: phone number in 7 of 10, home address in 6, date of birth in 4, government ID in 2, bank account in 1 (Angel One), password in none

Here’s what I’d do instead.

Start with the free check: run your email through it and look at the dates on what comes back. An entry from 2019 or 2021 might be an account you forgot you ever had, and our guide to email breach history walks through finding and closing those.

If a phone number came back with it (seven of the ten carried one), expect calls and texts that already know your name. A leaked phone number is harder to live with than a leaked email, and the only real defence is calling back on a number you looked up yourself.

A work address in LimeLeads or Crunchbase goes to IT, as above. And if you look after domains for clients (an MSP or security provider, say), that’s what xonThreatIntel+ is for: every client domain watched from one account.

On the radar: reported in October, not yet verified

Twenty-two breach stories landed on our news feed in October, and one of them (Double Counter) is already in the table above.

I’ve picked five of the other twenty-one. None is in the catalog or counted in the 90.9 million (we only add data we’ve checked ourselves), and here’s why each one matters.

  • Capcom tops my list. The games company confirmed that its CAPCOM ID login service was breached, exposing more than 11.7 million email addresses along with login counts, last-login times and the IP address used at last login. Passwords weren’t taken, says Capcom (though someone changed them on 196 accounts, apparently to lock the owners out).
  • Oracle Health: nearly 20 million people had Social Security numbers, addresses and medical information taken from old Cerner servers, according to a Texas attorney general report. The break-in itself dates to early 2025 (yes, another old one).
  • Quest Diagnostics told US regulators this month that someone accessed patient records on Quanum, the system doctors use to order its lab tests. No count yet.
  • Denmark’s population register (CPR) lost names, addresses and CPR numbers for 8.8 million people, about 80% of the register, by Help Net Security’s count, after attackers misused a private company’s legitimate search access. The ministry’s advice is the right one for everyone: a caller who knows your name, address and ID number is still not proof of anything.
  • Times Car, the Japanese car-sharing service, confirmed on 28 September that data on 6.6 million current and former members was taken, and it reached our feed on 1 October. Driver’s licence images are in there, and so are passwords, stored in a form the company says can’t be restored.

None of these five can be searched here yet. If one of them holds your details, the official notice (from the company, or in Denmark’s case the ministry) is what to act on today, and an alert covers the day the data does reach us.

All five stay on xonPulse, our breach-news feed, until a copy reaches us and checks out. Then it goes into the index and the alerts go out. A week for Double Counter, seven years for LimeLeads.

Since the month closed

Three more have landed in November so far. Neogen, an August 2026 breach, came in on 5 November with 445,899 addresses, and Golf Canada, from May, followed on 9 November with 572,068.

Cook Medical, also from August, arrived on 13 November with 147,133 (I checked that one the morning it landed). No passwords in any of them, and all three count in November’s post.

Check once, then let the alerts do it

Ten seconds against the full index, free, no signup: xposedornot.com

Then set up alerts, so the next 2020-vintage surprise lands in your inbox. Every catalog number in this post comes from the free API (breaches endpoint, fields breachedDate, addedDate, exposedRecords, exposedData, sensitive), pulled on 11 November 2026, and every searchable breach above has its own page in the breach directory.

And if these monthly write-ups are useful, a star on GitHub helps other people find the project. It’s free, and it genuinely makes our week.

FAQ

How many data breaches were added in October 2026? Ten breaches entered the XposedOrNot index in October 2026, totalling 90,883,625 records. Five happened in 2026 (McKesson, Crunchbase, Medela, Double Counter and Gîtes de France) and five are older, from 2019 to 2024 (Zoosk, SuperVPN and GeckoVPN, LimeLeads, Angel One and Assurance Retraite). The older five hold 90.9% of the month’s records.

Why are old breaches like Zoosk 2020 being added now? A breach enters the index when we get a copy of the data and can verify it, which can be years after the theft, even when the data has been passed around the whole time. Zoosk was breached in January 2020 and reached the index on 14 October 2026, 6.8 years later. The median gap for October’s ten additions was 533 days.

Did any October 2026 breaches include passwords? No, none of the ten October additions carries usable passwords (in September, two of five did). What they do carry is harder to change: phone numbers in seven, home addresses in six, dates of birth in four and government ID numbers in two.

Appendix: Sources and references

Get alerted when your email shows up in a new breach. Set up free breach alerts, it takes two minutes.

Check out some of our posts for you.

Facebook Twitter Linkedin Mastodon
| © 2026 XposedOrNot.com.