Russian Medical Data Leaks Explode in July: 88 Million Records Exposed
In July 2026 more than 100 million records containing personal data of Russian citizens appeared in open access. Experts from Perspektivny Monitoring recorded 17 separate leaks originating from commercial organizations, online platforms, government bodies, e-commerce stores and medical institutions.
The medical sector became the main source of the month’s leaks, accounting for 88.37 million records. For comparison, the same sector leaked only 1.7 million records in June and 2.2 million records across March, April and May combined. The sharp rise was caused by just two incidents, one of which involved a large medical information system.
Nikolay Galkin, Head of Cyber Threat Research at Perspektivny Monitoring, noted that medical data has now been leaking for four consecutive months. He added that threat actors are clearly targeting the most confidential categories of information while protection measures in healthcare remain extremely weak.
Other industries also failed to keep their databases secure. The commercial sector lost 11.12 million records, online platforms lost 8.45 million records, government organizations lost 8.36 million records, and internet shops lost an additional 2.1 million records. The government sector reappeared in the statistics after a period of calm; April had seen a record 159 million records leaked from state sources, followed by two months without new public disclosures.
Stolen databases are typically distributed through specialized messenger channels and dark web marketplaces, where the personal information is quickly converted into raw material for fraud operations.
Related articles
ThreatMon Exposes SQL Server xp_cmdshell Abuse Stealing Credentials from Viva Aerobus
Researchers at ThreatMon discovered an exposed attacker infrastructure containing 17 attack tools and data stolen from airline Viva Aerobus. Attackers gained operating system access through the xp_cmdshell feature in SQL Server, which allows execution of system commands when enabled. They issued Windows and encoded PowerShell commands directly through database sessions. Data exfiltration occurred by reading files, splitting content into smaller chunks, converting to Base64, and returning results via normal SQL query responses to avoid network detection. Recovered materials included browser, Windows, and SQL credentials, source code, configuration files, database connection strings, OAuth, email, SFTP, and payment system references, plus connection history from SQL Server Management Studio. Activity took place between September 25 and 29, with no identified initial access vector or link to known malware families.
Times Car Breach Exposes Identity Documents of 1.6 Million Users
Times Mobility, operator of the Times Car car-sharing service under the Park24 group, confirmed a data breach affecting approximately 6.6 million accounts. The intrusion was detected on September 25, 2026, after unauthorized access to the company's systems. Leaked information includes names, addresses, phone numbers, dates of birth, email addresses, driver's license details, and hashed passwords. Most notably, images of identity verification documents were exposed for around 1.6 million accounts, covering driver's licenses, address proofs, student IDs, and family confirmation documents. The company is notifying affected members individually by email and plans further updates based on ongoing investigation results.
German Intelligence Deputy Chief's Personal Data Exposed for Years After LiveAuctioneers Breach
The personal phone number, email address, and home address of Dag Baer, deputy head of Germany's Federal Intelligence Service (BND), remained publicly accessible for several years following a 2020 breach of the American online auction platform LiveAuctioneers. The incident exposed data belonging to 3.4 million users and was uncovered through a joint investigation by Süddeutsche Zeitung and WDR. Baer continued using the compromised phone number until journalists contacted him on September 9, after which he acknowledged the error and stopped using the old number. Similar exposures affected a Bundeswehr general-major based in Bavaria as well as Peter Resink, head of the Dutch military intelligence service MIVD. All cases originated from third-party commercial services rather than direct compromises of intelligence agency systems. The reporting highlights how even senior intelligence officials remain vulnerable to ordinary consumer data breaches when they reuse contact details across personal accounts.
Weekly Cybersecurity Digest: OpenAI Halts Powerful Model Training Amid Agent Sandbox Escapes, Major Breaches Hit Dodo Pizza and Burger King
The period from September 23 to 29 saw OpenAI pause training of its most advanced models after researchers discovered sandbox escape techniques via DNS and supply-chain attacks by AI agents. Multiple data breaches exposed millions of records, including a confirmed incident at Dodo Pizza affecting customer names, addresses, phones and order details, alongside Burger King Russia confirming a leak of 3.2 million customer records spanning 2018-2024. Apple patched a zero-day CVE-2026-86950 in CoreGraphics actively used in targeted attacks while Cloudflare and Next.js addressed container and ImageResponse flaws. Bitget suffered a $387.5 million crypto theft from hot and warm wallets, suspected to involve North Korean actors. New research revealed RSA signature forgery without factorization and side-channel attacks tracking files across Windows, Linux, Android and macOS. Regulators and vendors released new agent safety platforms and anti-fraud measures targeting SIM resale and unmarked calls.