SecureFact – October 19, 2026

Oracle Health data breach exposes nearly 20 million patients

The Oracle Health data breach reportedly affected approximately 19.9 million people, according to state breach filings. The compromised information included patients’ names, Social Security numbers, medical record numbers, details identifying doctors involved in their care, diagnoses, prescription medications, medical test results, medical images, and treatment information. Oracle reportedly became aware of the incident around February 20, 2025, after an attacker allegedly used stolen customer credentials to access a legacy server and copy data to a remote server. Oracle began notifying affected healthcare customers in March 2025, while subsequent regulatory filings revealed the reported scale of the incident, including nearly three million affected Texas residents. The attacker reportedly attempted to extort affected hospitals by demanding cryptocurrency payments in exchange for not leaking or selling the stolen information. The available reporting documents customer notifications and regulatory disclosures but does not confirm whether Oracle shut down the affected systems, provided credit monitoring to impacted individuals, or involved law enforcement. Oracle had not independently confirmed the reported nationwide total at the time of publication.

(Source: Read full report)

Burger King Japan Data Breach Exposes 11 Million Customer Records

Burger King Japan disclosed a major data breach affecting 11.18 million customer records stored on servers managing the company’s official smartphone application. Unauthorized access occurred between October 2-7, 2026, with the breach discovered and confirmed on October 13, 2026. The compromised data includes names, dates of birth, gender, email addresses, phone numbers, and order history for app users. The company confirmed that credit card numbers were not stored on the breached server and found no evidence that attackers accessed user credentials. Burger King Japan immediately blocked access from the unauthorized source upon discovery and reported the incident to Japan’s Personal Information Protection Commission (PPC). The organization engaged external cybersecurity experts to investigate how attackers gained initial access to the compromised server. As of the disclosure date, no secondary damage such as fraudulent use of the stolen information had been confirmed. The company issued warnings to affected customers to remain alert for phishing and social engineering attacks impersonating Burger King Japan.

(Source: Read full report)

Hackers Breach Microsoft 365 Tenants via ConnectWise Supply-Chain Attack

ConnectWise shut down customer access to its Cloud Backup service after hackers accessed application identities and compromised at least 162 Microsoft 365 tenants. Malicious activity began on October 15, 2026, originating from a single IP address (144.172.64.128) using automated scripts to authenticate directly to Microsoft 365 as the backup application service principal. The attacker leveraged previously granted permissions to read and write mail, attachments, OneDrive files, SharePoint files, and Teams chats across compromised tenants. Huntress researchers identified that on nearly 50 monitored tenants, service principals assigned themselves directory roles, primarily Exchange Administrator, with one tenant showing evidence of persistence establishment within five minutes. Microsoft Threat Intelligence characterized the incident as an active supply-chain attack where the attacker abused existing permissions including Directory.ReadWrite.All. ConnectWise announced the backup service interruption at 05:01 UTC on October 17 but did not provide a restoration timeline. The company stated it had no indicators that stored cloud backup data was compromised, though existing archives would remain inaccessible until services were restored. At the time of disclosure, the victim count and full extent of data theft remained unclear, as did the method used to obtain vendor credentials.

(Source: Read full report)

Hackers steal personal data of millions of California students in massive breach

The California student data breach involving Educational Testing Service (ETS) affected millions of current and former public school students, although the exact number has not been disclosed. The compromised information included names, dates of birth, residential addresses, school details, student identification numbers, and demographic information. Other potentially exposed data included disability records, testing accommodations, English learner status, education assistance eligibility, and standardized test results. The unauthorized activity reportedly occurred between May 22 and September 18, 2026, and was discovered on September 25. ETS disabled the compromised account and took the affected file-transfer site offline. The organization engaged cybersecurity experts and worked with law enforcement to investigate the incident. Affected students are being notified and offered two years of free identity-protection services and identity-restoration assistance. Officials reported no evidence that the stolen information had been publicly disclosed; Social Security numbers, financial details, passwords, and parent or guardian information were not affected.

(Source: Read full report)

Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach

The Save-On-Foods cybersecurity breach in Canada involved unauthorized access to personal information belonging to members of its More Rewards loyalty program. The exact number of affected customers has not been disclosed. The information accessed included customers’ names and, where provided, residential addresses, phone numbers, email addresses, and dates of birth. The company reported that passwords, credit card details, purchase histories, and other transaction information were not accessed, and that loyalty accounts remained secure. The incident was discovered on October 13, 2026, when the company detected unauthorized activity on one of its servers. Save-On-Foods shut down the affected server that day and engaged an external cybersecurity expert to investigate the incident. The company confirmed the data access and began notifying affected loyalty program members by email on October 16, 2026. It also notified the relevant authorities and privacy regulators. The company advised customers to remain alert to suspicious emails, text messages, and phone calls that might attempt to obtain sensitive information. Save-On-Foods has also indicated that it is working to make credit-monitoring services available to affected customers.

(Source: Read full report)