Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 5 items in Breaches. Show all 52 items

October 2026

1 item

  • Breaches

    Denmark's CPR register: data on about 8.8 million people accessed via a company account

    Denmark's Ministry of Research, Education and Digitalisation said on 5 October 2026 that names, addresses and CPR numbers of about 8.8 million registered people in the Central Population Register (CPR) had been accessed without authorisation. Someone misused a private Danish company's lawful access to search the register, and the ministry said the irregular activity took place during September 2026. The CPR administration noticed it on the evening of 2 October, blocked the company's access and reported the case to the Danish Data Protection Agency (Datatilsynet), and police are investigating.

    • Application security audit
    • Web application testing
    • Database security audit

May 2026

3 items

  • Breaches

    Carnival says social engineering led to breach; Maine filing lists 5,995,277 people

    Carnival announced on 27 May 2026 that an unauthorised actor gained access to a limited portion of its IT system after deceiving an employee in what it described as a social engineering operation. According to NBC 6 South Florida, its IT team discovered the breach on 14 April and determined on 22 April that passenger information was affected, including government-issued ID numbers such as driver's licence and passport numbers. Carnival did not give a figure, but NBC 6 and TMC Insight reported that a notice filed with the Maine attorney general's office lists 5,995,277 people affected.

    • Social engineering assessment
    • Database security audit
    • Incident response
  • Breaches

    DentaQuest notifies 15 million people after a May 2026 network intrusion

    DentaQuest, which BankInfoSecurity describes as one of the largest dental and vision benefits administrators in the United States, discovered on 20 May 2026 that unauthorised individuals had accessed certain data on its computer network in an incident that began on 17 May. Its notice says the affected data, which varies by individual, includes names, addresses, Social Security numbers, member ID numbers, Medicaid and Medicare numbers and dental or vision health information. DentaQuest's report to the Oregon Department of Justice lists 15,000,000 people affected. BankInfoSecurity reported that the ShinyHunters group claimed on its leak site to have published DentaQuest data.

    • Database security audit
    • Incident response
    • Red team & purple team
  • Breaches

    Instructure confirms Canvas breach via a Free-for-Teacher account and a second intrusion

    Instructure, the developer of the Canvas learning management system, said it detected unauthorised activity in Canvas on 29 April 2026 and later confirmed the actor had used one of its Free-for-Teacher accounts. According to Help Net Security, ShinyHunters claimed to have stolen 3.65 TB of data tied to approximately 275 million records across 8,809 educational institutions. On 7 May the same actor used a second Canvas vulnerability to change pages shown to some logged-in students and teachers. On 11 May Instructure said it had reached an agreement with the actor, that the data had been returned and that it had received digital confirmation of its destruction.

    • Web application testing
    • Application security audit
    • Cloud configuration review

November 2025

1 item

  • Breaches

    Coupang breach of 33.7 million accounts traced to a former engineer's stolen signing key

    South Korean e-commerce company Coupang first disclosed on 29 November 2025 that personal data of about 33.7 million users had been leaked. A joint public-private investigation, whose tentative results the Ministry of Science and ICT announced in February 2026, found that a former backend engineer used a stolen signing key to forge electronic access passes, beginning on 14 April 2025. Coupang said names, emails, addresses and phone numbers were accessed but not payment or log-in data. According to Coupang's 8-K, on 10 June 2026 the Personal Information Protection Commission announced a fine of approximately $278 million relating to the incident.

    • Application security audit
    • Web application testing
    • Cloud configuration review

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works