September's biggest confirmed theft came from a tool millions of people use without a second thought. Gyazo, the screenshot and screen-recording service run by Japan's Helpfeel, confirmed that attackers took approximately 23.62 million user records after exploiting a server vulnerability on September 11, 2026.
That number needs context. Helpfeel says about 76% of those records belong to anonymous users with no registered email address, so far fewer identifiable people are affected. The gap between records and people runs through this whole report, because several of September's biggest figures turned out to be attacker claims, travel records or maximum estimates.
GRC Solutions counted 40 publicly disclosed incidents in September and at least 252.8 million confirmed records, about 87% of them from a single exposed travel database. Below: what happened, which figures are confirmed, and what each incident means for a small business website.
⚠️ Important: 🚨 SEPTEMBER BREACH ALERT: If you or your staff use Gyazo, change the password now, and change it anywhere else the same password is reused. The exposed data included password hashes, login session IDs and X (formerly Twitter) integration tokens. Weak passwords can be cracked from their hashes, so the safe assumption is that a reused password is exposed.
Gyazo: 23.62 Million User Records From One Server Flaw
📸 The largest confirmed theft of the month
Incident overview:
• Victim: Gyazo, a screenshot and screen-recording tool operated by Helpfeel
• User records taken: approximately 23.62 million, made up of about 18.01 million anonymous users and 5.62 million users with a registered email
• Image metadata: about 490 million records, mostly for images uploaded before January 2019, plus about 174 million records for deleted images confirmed in a September 25 update
• Entry point: Helpfeel said the attacker exploited a vulnerability in an upload server to execute arbitrary commands, CyberInsider reports
• Timeline: unauthorized access on September 11; access blocked and the flaw fixed in the early hours of September 12; reported to Japan's Personal Information Protection Commission on September 15; first public notice on September 16
• Victim: Gyazo, a screenshot and screen-recording tool operated by Helpfeel
• User records taken: approximately 23.62 million, made up of about 18.01 million anonymous users and 5.62 million users with a registered email
• Image metadata: about 490 million records, mostly for images uploaded before January 2019, plus about 174 million records for deleted images confirmed in a September 25 update
• Entry point: Helpfeel said the attacker exploited a vulnerability in an upload server to execute arbitrary commands, CyberInsider reports
• Timeline: unauthorized access on September 11; access blocked and the flaw fixed in the early hours of September 12; reported to Japan's Personal Information Protection Commission on September 15; first public notice on September 16
The exposed user data varied by account but, per BleepingComputer, included names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google sign-in email addresses and billing status. The image metadata included upload IP addresses, EXIF location data and text pulled out of images by OCR (optical character recognition). Helpfeel says no payment card data was disclosed and that the image figures are metadata records, not image files, although BleepingComputer reports the company cannot rule out that some private images were viewed.
Why it matters for your business: screenshots are where staff capture invoices, customer records and admin dashboards, and OCR text extracted from them can contain exactly the data you never meant to share. If your team uses any screenshot-sharing service, treat it as a place where customer data lives and add it to your vendor inventory.
September 2026 Breaches at a Glance
📋 The eight incidents that defined the month
| Organization | Scale | What was exposed | Status of the number |
|---|---|---|---|
| Vietnam-linked APIS database | 220.78M travel records (not unique people) | Names, dates of birth, nationalities, passport numbers, flight details | Verified by researchers; unknown if copied |
| Gyazo (Helpfeel) | 23.62M user records | Emails, password hashes, session IDs, X tokens | Company-confirmed |
| IDScan.net | Not disclosed (153M is a seller's claim) | Names, driver's license, passport and other ID numbers | Disputed |
| CenterPoint Energy | "A portion" of customers (7.49M is an attacker claim) | Personal information (types not specified in filing) | Disputed |
| Times Car (Park24) | Up to about 6.6M accounts; ID documents for about 1.6M | Names, addresses, driver's license images | Company-confirmed |
| US DoD (DMDC) | About 3.05M people | Unencrypted SSNs, names, dates of birth | Officially confirmed |
| Arizona courts | 1.3M+ people; 150,000+ foster care reports | Names, SSNs, case numbers | Court-confirmed |
| Mathspace | 1,079,819 people | Names, emails, usernames | Company-confirmed |
Times Car, the car-sharing service run by Park24 Group's Times Mobility, detected unauthorized access at 9:07 a.m. on September 25 and blocked it the next day. The company says data linked to up to about 6.6 million current and former accounts was exposed, and that identity-verification documents such as driver's license images were accessed for about 1.6 million of them. Card data was not affected.
Mathspace is the clearest lesson in patch timing. The education platform says attackers exploited its self-hosted copy of Metabase, an analytics dashboard tool, exposing 1,079,819 students, staff and parents in Australia and New Zealand. Metabase published a critical advisory and patch on August 6, the first unauthorized access came on August 10, and Mathspace updated on August 29. In its own words, its vulnerability-notification process "did not identify and escalate that advisory for action."
Government Records: 3 Million Military Files and 1.3 Million Court SSNs
🏛️ US Department of Defense: Defense Manpower Data Center (DMDC)
• People affected: about 2.76 million living and 294,000 deceased people, roughly 3.05 million in total, according to a Pentagon official cited by SecurityWeek
• Entry point: a vulnerability in a DMDC file-sharing system, which DMDC says it has patched; the system has not been named
• Exposure window: October 2025 until discovery on July 16, 2026, about nine months
• Data exposed: the notification letter says the server held "unencrypted PII" (personally identifiable information), including Social Security numbers, names, dates of birth and contact details (TechCrunch)
• People affected: about 2.76 million living and 294,000 deceased people, roughly 3.05 million in total, according to a Pentagon official cited by SecurityWeek
• Entry point: a vulnerability in a DMDC file-sharing system, which DMDC says it has patched; the system has not been named
• Exposure window: October 2025 until discovery on July 16, 2026, about nine months
• Data exposed: the notification letter says the server held "unencrypted PII" (personally identifiable information), including Social Security numbers, names, dates of birth and contact details (TechCrunch)
Nine months of access to unencrypted Social Security numbers is the worst combination of slow detection and unprotected data. Encryption at rest would not have stopped the intrusion, but it can make the stolen copy far less useful.
⚖️ Arizona Supreme Court
Arizona's court system says a court employee clicked a malicious link in a phishing email, and the attack began on September 24. According to The Record, the attackers copied names, Social Security numbers and case numbers for more than 1.3 million people in the state's FARE (Fines/Fees and Restitution Enforcement) program, with records going back about 30 years. They also accessed more than 150,000 Foster Care Review Board reports dating back to 2010, including reports on 8,000 children currently in foster care, plus protective order records.
KJZZ reports the data was copied from a backup server. Backups are often the least-watched copy of your most sensitive data, so give them the same access controls and retention limits as your live systems.
Disputed Numbers: IDScan.net, CenterPoint and a 220-Million-Record Database
Three of September's headline figures came with caveats that much of the coverage dropped. Here is what each organization has actually confirmed.
🪪 IDScan.net: identity verification
• Confirmed: an unauthorized third party accessed part of IDScan.net's cloud environment between April 4 and September 2, 2026, limited to its VeriScan platform (company notice)
• Data: possibly full names, contact information, dates of birth, driver's license numbers, passport numbers and other government ID numbers
• Not confirmed: the 153 million figure, which comes from a dark-web seller, not the company. Brian Krebs reported, without confirmation from IDScan.net, that the database held about 10 million ID card scans and more than 3 million travel documents
• Regulators: Canada's Privacy Commissioner opened an investigation on September 21; The Record reports an FBI inquiry and several lawsuits
• Confirmed: an unauthorized third party accessed part of IDScan.net's cloud environment between April 4 and September 2, 2026, limited to its VeriScan platform (company notice)
• Data: possibly full names, contact information, dates of birth, driver's license numbers, passport numbers and other government ID numbers
• Not confirmed: the 153 million figure, which comes from a dark-web seller, not the company. Brian Krebs reported, without confirmation from IDScan.net, that the database held about 10 million ID card scans and more than 3 million travel documents
• Regulators: Canada's Privacy Commissioner opened an investigation on September 21; The Record reports an FBI inquiry and several lawsuits
⚡ CenterPoint Energy: Texas utility
• Confirmed: in a September 14 SEC filing, CenterPoint said an unauthorized third party obtained personal information relating to "a portion" of its customers through one of its external-facing systems. Electricity and gas delivery were not affected
• Not confirmed: an attacker's claim of 7.49 million records pulled from an API that, in the attacker’s words, had no web application firewall, no rate limiting and no authentication token
• Confirmed: in a September 14 SEC filing, CenterPoint said an unauthorized third party obtained personal information relating to "a portion" of its customers through one of its external-facing systems. Electricity and gas delivery were not affected
• Not confirmed: an attacker's claim of 7.49 million records pulled from an API that, in the attacker’s words, had no web application firewall, no rate limiting and no authentication token
✈️ The Vietnam-linked APIS database
• What it was: an Elasticsearch database holding 220,783,700 APIS (advance passenger information) entries, the passenger details airlines share with border authorities: 210.3 million passenger and 10.5 million crew records from January 2017 to April 2026. Kinryū Labs found it on June 3; it was secured on June 8 and reported publicly on September 8
• Why it was reachable: direct internet access returned an "Unauthorized" error, but a cloud-based path reached the database, which then accepted default credentials
• Not confirmed: who operated it, and whether anyone downloaded the data. These are travel records, not unique people; frequent travelers appear many times
• What it was: an Elasticsearch database holding 220,783,700 APIS (advance passenger information) entries, the passenger details airlines share with border authorities: 210.3 million passenger and 10.5 million crew records from January 2017 to April 2026. Kinryū Labs found it on June 3; it was secured on June 8 and reported publicly on September 8
• Why it was reachable: direct internet access returned an "Unauthorized" error, but a cloud-based path reached the database, which then accepted default credentials
• Not confirmed: who operated it, and whether anyone downloaded the data. These are travel records, not unique people; frequent travelers appear many times
The APIS lesson applies to most small businesses: a login prompt on the front door means little if a side entrance accepts the default password.
Three Patterns Behind September's Attacks
1. A firewall rule is not a patch
• What happened: the ShinyHunters group, which Google tracks as UNC6240, returned to Oracle PeopleSoft systems using CVE-2026-35273, an unauthenticated remote code execution flaw that Oracle fixed in June
• The trick: per BleepingComputer, attackers requested
• The fix: Google's Mandiant team told organizations to install the update rather than rely on the WAF
• What happened: the ShinyHunters group, which Google tracks as UNC6240, returned to Oracle PeopleSoft systems using CVE-2026-35273, an unauthenticated remote code execution flaw that Oracle fixed in June
• The trick: per BleepingComputer, attackers requested
/%50SEMHUB/ instead of /PSEMHUB/ (%50 is the URL-encoded letter P), slipping past web application firewall (WAF) rules that only matched the literal path• The fix: Google's Mandiant team told organizations to install the update rather than rely on the WAF
2. Your email provider can phish your customers in your name
• What happened: Brevo, a marketing email platform, says an attacker abused a flaw in its SAML single sign-on to reach 138 customer accounts, used 6 of them to send phishing and exported contacts from 43
• The impact: hardware-wallet maker Trezor says the lure reached about 347,000 newsletter subscribers, and about 2,500 clicked before Trezor took the malicious domain down within 20 minutes
• Why nothing flagged it: Brevo says the messages went through legitimate infrastructure and passed the usual email authentication checks. SPF, DKIM and DMARC, the standards that prove an email came from an authorized sender, offered no warning because the sender really was authorized
• What happened: Brevo, a marketing email platform, says an attacker abused a flaw in its SAML single sign-on to reach 138 customer accounts, used 6 of them to send phishing and exported contacts from 43
• The impact: hardware-wallet maker Trezor says the lure reached about 347,000 newsletter subscribers, and about 2,500 clicked before Trezor took the malicious domain down within 20 minutes
• Why nothing flagged it: Brevo says the messages went through legitimate infrastructure and passed the usual email authentication checks. SPF, DKIM and DMARC, the standards that prove an email came from an authorized sender, offered no warning because the sender really was authorized
3. Store apps hold the keys to your customer list
• What happened: attackers compromised a BigCommerce application key held by Ribon, a storefront optimization app, and used it to pull customer data from merchant stores between September 13 and 17, SecurityWeek reports
• The impact: affected merchant Master of Malt said names, email addresses, phone numbers and addresses were taken
• The platform held: BigCommerce stressed this was "not a breach of Commerce systems or the BigCommerce platform." The data left anyway, through an app's credentials
• What happened: attackers compromised a BigCommerce application key held by Ribon, a storefront optimization app, and used it to pull customer data from merchant stores between September 13 and 17, SecurityWeek reports
• The impact: affected merchant Master of Malt said names, email addresses, phone numbers and addresses were taken
• The platform held: BigCommerce stressed this was "not a breach of Commerce systems or the BigCommerce platform." The data left anyway, through an app's credentials
See What Attackers See on Your Website
Several of September's breaches started with something publicly reachable that should not have been. Run a free security scan to check your SSL/TLS setup, eight key security headers, and whether common admin panels or sensitive files such as .env or .git/config are exposed.
Lessons for Small Business Websites
🛡️ Seven actions mapped to this month's incidents
| Lesson | What to do this month | Does the free ScanComply scan help? |
|---|---|---|
| Patch self-hosted tools in days, not weeks (Mathspace) | Subscribe to advisories for every self-hosted app, plugin and dashboard; set a deadline for critical fixes | No. The scan does not check software versions |
| A firewall rule is not a fix (PeopleSoft) | Install the vendor patch even when a WAF rule is in place | No |
| Close the side doors (APIS, CenterPoint claim) | Change default passwords; require authentication and rate limits on every API and database | Partly. It flags exposed admin panels and files such as .env, .git/config and database backups |
| Encrypt and minimize ID data (DMDC, IDScan, Times Car) | Encrypt identity numbers at rest; delete ID scans once verification is complete | No |
| Lock down marketing tools (Brevo) | Enforce MFA or SSO, limit user seats, tell customers what you will never ask for by email | No |
| Audit store apps (Ribon) | Uninstall unused apps and revoke their API keys | No |
| Get the basics right (all) | Valid HTTPS with modern TLS, plus headers such as HSTS and Content-Security-Policy | Yes. It checks SSL/TLS and 8 security headers |
Be clear about what a scanner can and cannot do. An external scan sees what anyone on the internet sees: your certificate, your headers, and login pages or files that answer on public URLs. It cannot see your patch levels, your vendors' keys or your email platform settings. Those need an owner and a calendar reminder.
Arizona's breach started with one employee clicking one link. Phishing awareness and multi-factor authentication on email and admin accounts reduce how much a single mistake can unlock.
September's headline numbers were huge, but the confirmed incidents tell a narrower and more useful story: a vulnerable upload server at Gyazo, an analytics tool patched 23 days late at Mathspace, a flawed file-sharing system holding unencrypted data at the DMDC, and one phishing click in Arizona. Each was a routine failure, not an exotic one.
The disputed numbers carry a lesson too. When a breach hits the news, the first figure is often the attacker's sales pitch. Wait for the company's notice before deciding what to tell your own customers, and keep your own records good enough that you could answer the question yourself.
Related reading: October 2026 breach report • August 2026 breach report • Fall 2026 website security checklist
Sources: Helpfeel notice • BleepingComputer: Gyazo • SecurityWeek: DMDC • IDScan.net notice • CenterPoint 8-K • The Record: Arizona courts • BleepingComputer: APIS database • Mathspace incident report • Brevo incident write-up • SecurityWeek: Ribon apps
Disclaimer: Breach details summarize publicly reported information as of November 6, 2026 and may be revised as investigations continue. This article is general information, not legal advice.