Data breaches at major companies

Binance

The FBI attributed the theft of virtual assets from the Binance exchange, on or about October 29, 2026, to North Korea through the activity it calls TraderTraitor. According to the FBI, the attackers are converting the stolen assets mainly into Ether before laundering them.

Affected: More than 6 billion US dollars in virtual assets stolen

Takeaway: Keeping funds on an exchange means trusting its security: after an attack, distrust messages promising to return your money.

Booking.com

Booking.com notified customers that unauthorized third parties may have accessed reservation details, names, email addresses, physical addresses and phone numbers. The company said financial information was not accessed from its systems and changed reservation PIN codes; experts warned of "reservation hijack" scams.

Takeaway: Never pay or share card details by email, phone or chat, even if the message knows your booking: check in the official app.

Scotiabank Colpatria

In September 2025, reporting described a SIC sanction after confirmation that a former employee leaked information on 712,371 customers and sold it to a call center. The information transfers occurred during his employment between 2019 and 2022.

Affected: 712,371 customers

Takeaway: Leaks can come from insiders: if a caller offers products using your details, verify before answering.

Interbank

On October 30, Interbank confirmed that a third party had exposed some data belonging to a group of customers without authorization. The bank announced additional monitoring and said deposits and financial products were safe.

Takeaway: Safe funds do not mean safe data: be wary of calls and messages that use your banking details.

National Public Data

The data broker confirmed a breach after files attributed to its systems circulated with names, Social Security numbers and contact details. The number of affected people remained uncertain; database rows do not equal unique people.

Takeaway: Check your credit reports and consider freezing your credit.

AT&T

Attackers downloaded call and text records from a workspace on a third-party cloud platform. These were communication metadata, not the contents of calls or messages.

Affected: Approximately 109 million accounts

Takeaway: Be wary of callers using knowledge of your contacts to sound legitimate.

Snowflake

A campaign stole data from Snowflake customer environments using compromised credentials, including credentials obtained by malware. Mandiant found no evidence that access resulted from a breach of Snowflake’s corporate environment.

Takeaway: Enable multifactor authentication and remove old cloud credentials.

Dropbox Sign

An attacker accessed the production environment and obtained customer details, hashed passwords and authentication information such as API keys and OAuth tokens. Dropbox found no evidence of access to documents, agreements or payment information.

Takeaway: Beyond changing your password, revoke affected tokens and rotate API keys.

Change Healthcare

A ransomware attack compromised personal and health information processed by this healthcare services provider. The incident also caused widespread disruption to medical claims processing.

Takeaway: Review medical statements for services you did not receive.

23andMe

Unauthorized account access exposed ancestry information about other users connected through the DNA Relatives feature. The exposure extended beyond the accounts accessed directly.

Takeaway: Use unique passwords and review what you share with genetic relatives.

IFX Networks

A ransomware attack encrypted the cloud provider’s systems and disrupted services used by Colombian institutions. Attackers claimed to have stolen customer data; that claim should not be treated as a publicly verified leak.

Takeaway: Keep backups independent of your cloud provider.

Progress MOVEit Transfer

CL0P exploited a SQL injection vulnerability in MOVEit Transfer to steal files from organizations using the product. This was a campaign against multiple customer installations, not a single central database.

Takeaway: Install security updates and minimize sensitive files retained on transfer services.

Keralty / Sanitas

Following the attack that began in November, Keralty confirmed in December that criminals held corporate files containing personal information, financial statements and budgets. At that time, it said its investigation had not identified compromised medical records or third-party financial data.

Takeaway: Verify requests using your health insurer’s details through official channels.

Dropbox

A phishing campaign impersonating CircleCI accessed GitHub repositories containing code, API keys and some names and email addresses. Dropbox said users’ account contents, passwords and payment information were not accessed.

Takeaway: Use phishing-resistant authentication where available.

Twitter

A platform bug compromised account data and was fixed before its public disclosure in 2022. Twitter distinguished this confirmed incident from other large datasets advertised later, which it could not link to a new breach.

Affected: 5.4 million accounts

Takeaway: Do not assume a pseudonymous profile cannot be linked to your identity.

LastPass

An initial theft of code and technical information enabled a later attack on cloud backups. In December, LastPass confirmed theft of customer information and vault backups containing encrypted fields and unencrypted fields such as website URLs.

Takeaway: Use a strong master password and rotate affected secrets, not just the master password.

Logbank

An incident on January 24 and 25, 2022 exposed registration data linked to 2,112 Logbank Pix keys. The data included names, CPF identifiers, financial institutions and account numbers.

Affected: Data linked to 2,112 Pix keys

Takeaway: Be wary of requests that cite your Pix key and CPF to look official.

Acesso Soluções de Pagamentos

Brazil’s Justice Ministry investigated a leak of Pix keys held by Acesso that could expose phone numbers and email addresses. Its notice sought clarification on the origin and duration of exposure rather than establishing a definitive attack mechanism.

Affected: More than 160,100 Pix keys

Takeaway: Confirm the recipient’s identity before authorizing a Pix payment.

Banese

The August 24, 2021 incident, disclosed in September, exposed data linked to 414,526 Banese Pix keys. The information included names, CPF identifiers, financial institutions, and branch and account numbers.

Affected: Data linked to 414,526 Pix keys

Takeaway: Knowing your account number does not prove someone works for the bank: always verify in the official app.

T-Mobile

An intrusion exposed names, birth dates, Social Security numbers and driver’s license information belonging to current, former and prospective customers. The cited initial report did not identify compromised financial information.

Takeaway: Protect your mobile account with a PIN and watch for identity theft.

Facebook

Phone numbers and other profile details appeared in a public database in 2021. Facebook attributed their collection to misuse of a feature before September 2019, not a new intrusion in 2021.

Takeaway: Limit who can find you through your phone number or email address.

Brasil — CPF

Brazil’s ANPD opened an investigation into a mass leak of personal data associated with CPF identifiers. Its statement treated the scale as reported by researchers and did not confirm an originating company or extraction method.

Takeaway: Distrust messages that present your CPF as proof of legitimacy.

Facebook / Instagram

Facebook confirmed that some passwords were stored in readable form in its internal systems; in April it expanded the scope to millions of Instagram users. The company said the passwords were not visible outside Facebook and that it had found no evidence of abuse or improper internal access.

Takeaway: Even large companies do not always store passwords well: use a different one for each service.

Marriott / Starwood

Attackers compromised Starwood systems in 2014 and retained access after Marriott acquired the company. The intrusion, detected in 2018, affected guests’ personal information and cardholder data.

Takeaway: Review card transactions after hotel security notices.

Facebook

Attackers exploited a combination of three bugs involving "View As" to steal access tokens. Facebook updated the scope in October: about 30 million accounts had tokens stolen, and data from 29 million was accessed.

Affected: About 30 million accounts with stolen tokens; data accessed from 29 million

Takeaway: Review your active social media sessions from time to time and close any you do not recognize.

Netshoes

The MPDFT reported exposure of data from 1,999,704 Netshoes accounts, including names, CPF identifiers, email addresses, birth dates and purchase histories. According to the authority, passwords and credit card information were not disclosed.

Affected: 1,999,704 accounts

Takeaway: A leaked purchase history makes fake delivery or refund messages more believable.

Equifax

Equifax announced a breach exposing personal information held for credit reporting. The FTC linked the incident to failures in the company’s security practices.

Affected: 147 million people

Takeaway: Review your credit reports and consider a credit freeze.

Yahoo

Yahoo suffered separate incidents in 2013 and 2014: the 2014 breach was disclosed in September 2016 and the 2013 breach in December. Account data was exposed; the 2013 incident’s scope was revised in 2017 to all existing accounts, without clear-text passwords.

Takeaway: Change reused passwords and avoid factual answers to security questions.

Dropbox

Dropbox confirmed in 2016 that a list of email addresses and salted password hashes was genuine and likely obtained in 2012. It reset old passwords and said it had no indication of improper access to user accounts.

Affected: 68 million credentials

Takeaway: Also change any password reused on other services.

Adobe

An attack stole usernames and encrypted passwords, along with source code for Adobe products. Payment information belonging to a subset of customers was also affected.

Affected: Approximately 38 million active users

Takeaway: Use unique passwords so one breach does not compromise other accounts.

LinkedIn

A 2012 intrusion exposed credentials protected by weak password hashing. In May 2016, a much larger collection attributed to the same incident surfaced, rather than a new intrusion.

Takeaway: Enable two-step verification and do not reuse work-related passwords.