Ceva Logistics: One Processor, Ten Controllers, and a Notification Chain That Took Five Days
A cyberattack on eight European warehouses run by Ceva Logistics has produced breach reports to the Dutch data protection authority from at least ten ...
breach-notification
27 articles on breach-notification — privacy laws, security frameworks, and regulatory compliance.
CareCloud's Four-Month Notification Gap: 345,000 Patients, 45,000 Providers, and the Business Associate Clock
CareCloud, a revenue cycle management vendor serving more than 45,000 U.S. healthcare providers, began notifying at least 345,000 individuals in late ...
Nine Months to Notice: MCBS, 1.26 Million Patients, and the HIPAA Clock That Runs on the Business Associate's Calendar
Attackers were inside Medical Computer Business Services of Augusta, Georgia between 22 and 26 September 2025. The investigation concluded on 28 May 2...
Origin Energy: 900,000 Confirmed, 2 Million Claimed, and the Australian Compliance Cost of Believing the Attacker
Origin Energy began investigating on 22 July 2026 after an attacker claimed to hold records on two million customers. By 28 July the company confirmed...
From 2.6 Million to 23 Million: The DentaQuest Breach Scope Expansion and What HIPAA Requires When the Number Moves
When we covered the DentaQuest breach in June, the working figure was 2.6 million people. Notification letters that began rolling out on 17 July 2026 ...
Nichirei, RansomHouse, and the Cold Chain: When a Logistics Outage Becomes a Personal-Data Incident
A 13 July 2026 ransomware attack on Nichirei disrupted roughly 140 distribution centres across Japan, affecting food manufacturers, supermarkets, and ...
Nine Months to Identification: Pinnacle Financial, Mercadien CPAs, and the Fourth-Party Problem in Banking
An intruder was inside the network of Mercadien, P.C., CPAs between 17 September and 9 October 2025. Pinnacle Financial Partners did not determine tha...
EY's Support-Ticket Breach: Three Months From Detection to Notification, and the Data Was Client Tax Records
Ernst & Young LLP is notifying clients that an unauthorized third party accessed a third-party IT service management platform between 28 March and 12 ...
Lidl's Third-Party Breach: When a Retailer's Own Platform Is Clean but the Processor Is Not
Lidl notified online shop customers in Germany, Belgium, and the Netherlands that attackers stole personal data from an external IT service provider —...
Nintendo, TinyPulse, and the $2M Ransom: How a Third-Party HR Survey Vendor Became a 2026 Extortion-as-a-Service Case Study
An extortion group calling itself Shadowbyt3$ stole roughly 859 MB of Nintendo of America employee data — including W-9 tax forms and bank statement P...
Conduent's 62 Million-Person Breach Becomes 2026's Cautionary Tale in HIPAA Business-Associate Liability
Conduent Business Solutions told federal regulators on June 4, 2026 that 62,224,658 people had data exposed in a SafePay ransomware intrusion — the th...
Detected in One Day, Disclosed in 115: The AssuranceAmerica Breach and the Anatomy of a 6.9 Million-Person Notification Timeline
AssuranceAmerica detected intruders in its network on March 17, 2026 — roughly 24 hours after a credential attack on an employee. Notification letters...
One Zero-Day, One Hundred Victims: The Oracle PeopleSoft Wave Breaks on Nissan, Kubota, Aflac, and the July 3 Disclosure Cluster
Between May 27 and June 10, 2026, attackers linked to ShinyHunters exploited CVE-2026-35273, a critical Oracle PeopleSoft zero-day, against more than ...
Medtronic's 9 Million-Record Breach: ShinyHunters, an 80-Day Notification Gap, and the Questions HIPAA Will Ask (2026)
Medtronic has begun notifying individuals that attackers accessed its corporate IT systems between April 13 and 19, 2026, stealing names, dates of bir...
One Day, Three Continents of Obligation: The June 26, 2026 Breach Cluster and the Fragmented Map of Data-Breach Law
On June 26, 2026, breach disclosures surfaced for MagMutual Insurance, 911 Driving School, and Germany's Atlas Elektronik on the same day. The three i...
iRhythm's Zio Breach: When a Help-Desk Phone Call Exposes Cardiac Patient Data Under HIPAA (2026)
In June 2026, attackers used social engineering to break into third-party-hosted business applications at iRhythm Holdings, maker of the Zio cardiac p...
DentaQuest's 2.6 Million-Record Breach: ShinyHunters, Sun Life, and the HIPAA Questions Every Benefits Administrator Should Be Asking
The extortion group ShinyHunters leaked roughly 234 GB of data tied to DentaQuest, the Sun Life-owned dental benefits administrator, exposing names, d...
Risk Analysis in the Crosshairs: What OCR's Four Ransomware Settlements Tell You About the Coming HIPAA Security Rule Amendments
OCR's four ransomware settlements announced in April 2026 — totaling $1.165 million across breaches affecting 427,000 individuals — share one root cau...
The Q2 2026 Ransomware Wave: Qilin, ShinyHunters, and the Compliance Failures Behind the Salesforce Extortion Campaign
May 2026 saw 95 publicly disclosed ransomware attacks across 17 countries, with Qilin and ShinyHunters leading a campaign that increasingly skips encr...
15 Million Records, a $10,000 Fine: The MMG Fusion Settlement and What It Means When Your Business Associate Disappears
HHS OCR settled with MMG Fusion, LLC for $10,000 following a breach that exposed the protected health information of 15 million patients — one of the ...
Oncology Institute Vendor Breach: How One Unauthorized Access Event Triggers HIPAA, SEC Disclosure, and Third-Party Risk Obligations Simultaneously
The Oncology Institute disclosed on May 20, 2026 via SEC Form 8-K that a vendor had detected unauthorized access to information systems handling patie...
Canvas Breach: The FERPA, COPPA, and State Notification Matrix Schools Are Now Operating Under
The May 2026 Instructure Canvas breach exposed names, institutional email addresses, student ID numbers, and private messages across an estimated 275 ...
CNIL's €42 Million Fine Against Free Mobile: Three GDPR Violations Every Security Team Must Study
In January 2026, France's data protection authority fined Free Mobile €27 million and its parent Free €15 million — a combined €42 million — for three...
Citizens Bank and Frost Bank: Everest Ransomware's Third-Party Breach and the GLBA Vendor Accountability Gap
On April 20, 2026, the Everest ransomware gang listed both Citizens Financial Group and Frost Bank on its dark web leak site, claiming to hold 3.4 mil...
Rituals Cosmetics Confirms Membership Database Breach: GDPR Notification, Dutch AP, and the Loyalty Program Risk Pattern
On April 22, 2026, Netherlands-based luxury cosmetics chain Rituals confirmed that attackers had accessed its customer membership database, exposing n...
The OAuth Governance Gap: What the Vercel and Lovable Incidents Mean for Your Compliance Program
Two high-profile security incidents broke within hours of each other on April 19–20, 2026. Both involved AI platforms. Both exposed real customer data...
The High Stakes of Data Privacy: Understanding Fines, Compliance, and the Evolving Regulatory Landscape
Data breach fines can reach up to 4% of global revenue under regulations like GDPR, LGPD, and PIPL. This analysis examines fine determination factors,...