
Check for breach notices if you are a California public school student
Millions of California students have had sensitive education data stolen by hackers who used compromised credentials to access an ETS file transfer system.
Data Breaches coverage from DarkWeb Dispatch holds 21 articles, 16 of them reference guides. The newest was published on October 20, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include FTC: Data Breach Response, A Guide for Business and Have I Been Pwned.

Millions of California students have had sensitive education data stolen by hackers who used compromised credentials to access an ETS file transfer system.

Federal probes suggest a US consulting firm leader assisted the ransomware group in running a site to pressure victims into paying for stolen data.

A threat actor alleges leaking 375,000 customer records and loan files from State Bank of India, though the bank has not confirmed the breach or its source.

The n0n group claims to have stolen data from 38 global shipping and logistics firms, demanding millions in ransom before publishing sensitive port records.

A misconfigured database exposed millions of previously breached records, including sensitive details from FBI and AT&T users.

Most cloud data leaks stem from default settings that expose storage buckets to the public internet without authentication or encryption controls.

Most credential leaks happen because organisations rely on passwords alone, ignoring the silent damage caused by cached tokens and weak third-party integrations.

Formal certification often costs more than the data it protects, but the internal discipline it forces stops misconfigured cloud storage leaks before they start.

Most organisations lose control of their data not through theft, but because they cannot prove where sensitive information resides during an incident.

Most data leaks stem from human error and misconfigured systems rather than sophisticated hacking, making simple configuration checks more effective than complex security tools.

The boundary between authorized and unauthorized access often fails not at the firewall, but within the permissions granted to legitimate users who misuse their rights.

Assigning permissions to job titles rather than individuals reduces the risk of orphaned accounts and simplifies security audits.

Synthetic identity fraud creates entirely new people using real data fragments, bypassing traditional checks that rely on matching a name to an existing history.

Your vendor questionnaire reveals their security posture but hides the true risk of shared credentials and outdated sub-contractor policies.

The direct technical expense of a breach is often smaller than the long-term costs of lost trust and operational disruption.

Attackers often bypass complex passwords by stealing active session tokens, rendering traditional authentication safeguards completely ineffective.

The true cost of a data breach includes months of hidden labour and legal fees that dwarf the initial ransom or fine, creating a long-tail financial drain.

Hardcoding secrets in code is the most common error, but even encrypted files fail if the decryption key is stored in the same repository.

Your vendors hold keys to your digital doors, and standard contracts rarely cover what happens when their security fails or their data is scraped.

The HIPAA Security Rule forces teams to document risk decisions, turning vague security hopes into auditable engineering choices that survive leadership changes.

PCI DSS forces organisations to treat payment data as a distinct security domain, preventing card details from bleeding into general logging systems.