What happened, who's affected, and what it means for your data.
Exploited overly permissive guest user settings on Experience Cloud. Affected companies include Snowflake, Okta, LastPass, Sony, AMD, and Salesforce itself. Not a zero-day — a default setting.
Originally reported at 10M, now over 25M across multiple states. Texas alone jumped from 4M to 15.4M. Attackers inside for 3 months, 8TB exfiltrated. Conduent processes benefits for 100M+ Americans.
Insurance eligibility records, medical histories, and verification transaction data. A Cognizant subsidiary breach with downstream impact across healthcare providers.
Exploited via unpatched React2Shell vulnerability (CVSS 10.0). Claims only "legacy" data taken. LexisNexis holds credit, court, shopping, and political data on hundreds of millions of people.
Filed with California, Maine, and Texas AGs. A global telecom infrastructure company handling 5G, IoT, and government/military sector communications.
Meanwhile the United States still has no federal privacy law, no mandatory breach notification timeline, and no standardized penalties. Companies continue to write their own rules.
Confidential agreements, emails, passport scans, and internal technical specs. A $12B global paint manufacturer breached through a US subsidiary.
Originally disclosed in October 2025. Have I Been Pwned now reports 42M records including 38M unique email addresses, physical addresses, phone numbers, and gender data.
European DIY retailer. Compromised via a subcontractor's Zendesk instance. 43GB of data including 900K+ support tickets and 13K attachments.