Monthly Breach News — November 2026
Last updated: 5 November 2026 · Updated monthly
Real, publicly reported data breaches and security incidents — with what happened, who is affected, and what to do. Every item below was reported by the company involved or by a reputable news outlet. Claims that are not confirmed are labelled as claims, not facts. Next update: December 2026.
What to do if you are affected by any breach
- Change the password of the affected account — and of any other account that reused the same password.
- Turn on two-factor authentication (authenticator app) — see our 2FA guide.
- Expect phishing: attackers use leaked names, emails and phone numbers to send convincing scam messages. Check every link with our link safety checker.
- Check whether your email appeared in a breach at haveibeenpwned.com.
- If financial data was involved, contact your bank and watch your statements.
Amadeus booking system — airlines affected (Singapore Airlines, Cathay Pacific, Japan Airlines and others)
A vulnerability in travel technology provider Amadeus exposed airline booking records. Singapore Airlines said about 46,000 booking records may have been affected; Cathay Pacific reported about 53,000 bookings and Japan Airlines about 92,000 customers. Other airlines including Asiana and Malaysia Airlines also reported customer data may have been affected.
- Data exposed: names, booking reference numbers, travel itineraries and booking classes. For about 620 Singapore Airlines records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed.
- Not leaked: Amadeus confirmed bank account and credit card information was not leaked, and bookings were not modified. Singapore Airlines confirmed its own IT systems were not breached.
- What to do: expect phishing emails or calls that quote your real booking details — verify any message through the airline's official app or website, never through a link in the message.
Arara (Japan email provider) — about 77 million email addresses potentially exposed
Japanese email-delivery provider Arara disclosed that attackers reached client-company environments through 97 servers, expanding an incident first disclosed on 29 October. The company estimates approximately 77 million email addresses were taken or potentially exposed across as many as 380 client companies. The figure is still being refined and does not represent 77 million confirmed unique individuals; the shared-environment estimate is about 3.39 million unique email addresses.
- Also abused: attackers used Arara's own email-delivery infrastructure to send up to about 7.13 million phishing messages impersonating credit-card companies.
- Not held: Arara says it does not hold payment-card numbers.
- What to do: be extra suspicious of emails claiming to be from your credit-card company — check through the bank's official app, never through an email link.
Source: Undercode News, 2 November 2026
DreamHost — File Manager hack exposed FTP and webmail logins
Web host DreamHost said an unauthorized party exploited a vulnerability in third-party software behind its web File Manager (files.dreamhost.com). The company found the problem on the afternoon of Friday 23 October, took the File Manager servers offline and fixed the vulnerability. The attack reportedly began in August 2026.
- Data exposed: FTP and SFTP usernames and passwords for users who logged in to File Manager before 23 October, and login credentials for a limited number of webmail users. DreamHost says "well under approximately 10%" of its about 400,000 paying customers were affected.
- Not accessed (so far): DreamHost says it has no evidence that control panel logins or billing details were accessed.
- What to do: if you use DreamHost, change your FTP/SFTP and webmail passwords and turn on two-factor authentication.
Source: RR TechPulse (reporting TechCrunch), 5 November 2026
NSW Health Oral Health Fee For Service Scheme (Australia) — provider data stolen
NSW Police declared a "major" data breach after an attack on the NSW Health Oral Health Fee For Service Scheme website. Police estimate about 4 GB of data was stolen. A hacker claims the haul is closer to 70 GB and roughly 100,000 documents — that claim is unverified and was rejected by NSW Police.
- Data involved: officials say no patient data was involved. What may have leaked is a small number of third-party provider details, mostly tied to private dentists, including significant personal-identification information.
- What to do: affected providers should watch for identity-theft attempts and report suspicious contact to police.
Source: Tech Insider, 4 November 2026
Star Media Group (Malaysia) — StarSearch and ESG Awards databases breached
Star Media Group confirmed a breach of its StarSearch (classifieds) and ESG Awards databases — the only databases affected. The company confirmed the exfiltration of personal data on 27 October 2026 and notified the Personal Data Protection Commissioner on 30 October, and filed a police report.
- Data exfiltrated: first name, last name, address, state, country, phone, email, and NRIC (national identity card number).
- What to do: affected people should watch for identity theft and phishing using their real details, and never share one-time codes with callers claiming to be from the company.
Chainstack — production systems breached, customer data and password hashes exposed
Blockchain infrastructure provider Chainstack disclosed a cyber attack in which an unauthorized party gained access to a development environment on 26 October 2026 and then escalated into parts of its production environment. The intrusion was detected on 31 October and the attacker's access was cut off the same day.
- Data accessed: a database containing customer account information — organization names, account holder names, email addresses of organization members, and password hashes. The attacker also had access to systems holding node credentials.
- Context: the incident is assessed to be part of a large-scale, AI-powered attack campaign (ARTEX) that also targeted other firms, including API platform WorkOS (limited to its sales/marketing systems — no production or customer platform data) and the Dutch Institute for Vulnerability Disclosure.
- What to do: Chainstack customers should change passwords, rotate credentials and API keys, and turn on two-factor authentication.
Source: The Hacker News, 3 November 2026
CSX (US transportation) — employee information exposed, including Social Security numbers
CSX, one of the largest transportation companies in the United States, suffered a data breach that exposed employee information including Social Security numbers. The company has not disclosed how many employees were affected or the full scope of the stolen data.
- What to do: affected employees should place fraud alerts with credit bureaus, watch for identity theft, and be alert to phishing that uses their real employment details.
Source: Acid Peak (reporting DataBreaches.net), 3 November 2026
How we choose what to list
We list only incidents reported by the company involved or by a reputable news outlet, with a named source and a date. Rumours, unverified hacker claims and incidents we cannot confirm are not listed — or are clearly labelled as unconfirmed claims. If a detail on this page is corrected by the source later, we update it.
Back to the homepage → · Password Security Guide → · Phishing Protection Guide →