8.8 Million Danish ID Numbers Exposed: October 2026 Data Breach Report

Incident overview:
• Victim: Denmark's Central Person Register, the national civil registration system
• People affected: about 8.8 million, including current residents, people who moved abroad and deceased people
• Data exposed: names, addresses and CPR numbers; people registered with name and address protection were not affected (SecurityWeek)
• Method: misuse of a private Danish company's lawful access; the Danish Data Protection Agency described "some form of brute-forcing to enumerate valid CPR numbers"
• Timeline: activity during September; the CPR administration became aware on October 2 and announced the breach on October 5; the company's access was blocked and police opened an investigation

Authorities have not publicly named the company or explained how its access was compromised, per BleepingComputer. The pattern matters more than the name: a trusted integration made enormous numbers of lookups, and nothing stopped it until abnormal activity was flagged.

What this means for your business:
• Every partner, plugin or API client with access to customer data is a potential path to all of it. List them.
• Set per-client query limits and alert on volume spikes. Enumeration attacks look like a sudden flood of lookups from one account.
• Ask partners how they protect the credentials you issued them. Their weakest login becomes yours.

Read the units carefully. GRC's 67.6 million total adds up accounts, records, people and email addresses as reported, so it overstates the number of unique people. Sourcenext's 22.5 million is the company's ceiling, not a count of confirmed victims, and Skyticket's figure includes duplicates.

Educational Testing Service (ETS), which runs California's statewide assessments under contract with the state, says hackers copied student information through an ETS-operated secure file transfer (SFTP) site from May 22 to September 18, 2026. ETS discovered the breach on September 25 and disabled the account used to steal the data, The Record reports.

The affected group includes current and former students enrolled in California public schools from 2023 through the current school year, plus students who left a California school since 2006 without a confirmed transfer. The state has not published a total; for scale, its K-12 public schools enrolled more than 5.7 million students in the 2025 school year. The department says exposed data may include names, statewide student IDs, dates of birth, addresses, demographic, disability and program information, and test data, but not Social Security numbers, financial information or passwords.

🏫 Florida Department of Education
• System: the Florida Student Financial Aid website, which was taken offline
• People affected: nearly 5 million people who have applied for financial aid, according to The Record
• Data: names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth
• Timeline: the department became aware on October 19 and disclosed the breach on October 29; it has not described the attack

🧪 Quest Diagnostics
• System: Quanum LSM, which clients use to place lab test orders and look up results (Form 8-K)
• What Quest confirmed: it learned of unauthorized access to the system on October 21, 2026, and says "an unauthorized party accessed certain patient records"; the full scope is under investigation
• Not disclosed: how many patients are affected. TechCrunch notes this is Quest's second major breach in a decade, after 11.9 million patient records were exposed in 2019 through a third-party billing company

The common thread is the data-sharing portal. An SFTP site, a financial aid website and a lab-ordering platform all exist to move sensitive data between organizations, and each became the leak.

Japan accounted for 17 of the 49 incidents GRC tracked in October, and BleepingComputer cites Macnica researcher Yutaka Sejiyama's count of 119 incidents in Japan in 2026 involving personal information theft or exposure, as of mid-October. The victims are household consumer brands, and the target is almost always the same: the member database behind an app or loyalty program.

• Capcom: attackers accessed CAPCOM ID, the game publisher's shared account system, obtaining 11,774,247 records containing email addresses and account data such as last-login IP addresses (Help Net Security). Capcom detected the activity on October 19 and reset passwords for 196 accounts the attackers had changed; it says other passwords and card data were not exposed
• Burger King Japan: unauthorized access between October 2 and 7 to the server that manages members of its official app exposed about 11.18 million records, including names, dates of birth, gender, email addresses, phone numbers and order history
• Yakiniku King: operator Monogatari Corporation reported 10,788,963 member records leaked from its app's member system, almost its entire registered user base (GRC Solutions, Qatar Tribune)
• Skyticket: travel booking site operator Adventure, Inc. announced on October 9 that about 14.64 million customer records may have leaked, about 4.13 million of them with hashed login passwords (@IT)
• Sourcenext: the software company said on October 15 that up to 22,519,960 records, a maximum estimate, may have leaked from its member information system, including email addresses and passwords (ASCII.jp)

For any business with a loyalty app or customer accounts, the lesson is data minimization. A fast-food app held order histories and dates of birth in more than 11 million member records. Every field you don't collect is a field you can't lose.

✈️ Japan Airlines via Amadeus: a three-year window
• Access window: airline IT provider Amadeus told JAL on October 23 that unauthorized access to its systems occurred between August 10, 2023 and September 23, 2026
• Affected: about 92,000 JAL customers; reservation codes, names and itineraries for about 90,000, plus email addresses, phone numbers, passport numbers and frequent flyer numbers for about 2,000 more (BleepingComputer)
• Wider impact: ANA, Asiana Airlines and Korean Air have also confirmed impact

🛍️ ASOS: scale not disclosed
• Confirmed: in a stock exchange filing, ASOS said hackers broke into a third-party platform hosting data it uses to communicate with customers, taking names and contact information. It also confirmed an "unauthorised customer notification" sent through its app. The hackers call themselves Xuanye Group
• Reported, not confirmed by ASOS: TechCrunch reports the data sat in a Snowflake instance (Snowflake says its own systems were not breached) and that the login was obtained by impersonating a trusted contact
• Unknown: how many customers are affected

🎓 University of Copenhagen: real data in a test environment
• Hackers accessed one of the university's test environments holding personal data on 525,000 people; names, CPR numbers, phone numbers and email addresses may have been exposed (BleepingComputer)
• A later update added about 20,000 staff and students whose PIN codes were exposed, and the university restricted physical access to some campus locations while issuing new codes

🔑 Zeabur: credentials that never expired
• Developer hosting platform Zeabur is shutting down after its second breach in two months
• In the October 14–15 intrusion, an attacker used leaked internal credentials that Zeabur had stored in plaintext; the company said its admin tokens "had no expiry, had not been rotated since they were created in January 2024" (BleepingComputer)
• The attacker read data on 321,810 accounts and more than 3.2 million environment-variable records, where developers keep API keys and passwords

Know your vendor map before you need it. When a provider like Amadeus or ETS announces a breach, the first question your customers ask is whether their data was there. A current list of which vendors hold which customer data turns a week of digging into a same-day answer.