Breach Breakdown

The email arrives on a Monday and it is an apology. The order you placed — the one for a

Accounts Impacted: 12,233,087 email addresses confirmed by KDDI (initially estimated at up to 14.22 million) Breach Occurrence Date: June 17,

Accounts Impacted: An undisclosed number of LastPass corporate and personal customer records Breach Occurrence Date: June 2026 Added to Breach

Accounts Impacted: Students, alumni, and recruiters at Oxford, Cambridge, and other GTI-partner universities Breach Occurrence Date: Late May 2026 Added

Accounts Impacted: Nearly 6 million (5,995,277 individual travelers) Breach Occurrence Date: April 2026 Publicly Confirmed: Late May 2026 Added to

Accounts Impacted: Roughly 10,000 unique customers across about 30,000 orders Breach Occurrence Date: May 2026 Publicly Confirmed: May 22, 2026

Accounts Impacted: Approximately 197,400 unique customer accounts Breach Occurrence Date: April 2026 Data Published by ShinyHunters: April 22, 2026 Added

Accounts Impacted: Approximately 119,200 unique user accounts Breach Occurrence Date: April 2026 Added to Breach Breakdown: May 2026 The Vimeo

Accounts Impacted: Attacker claim only — ShinyHunters lists 280 million records across 8,809 institutions. Instructure has not confirmed any figure

ShinyHunters breached CarGurus in February 2026. Have I Been Pwned counts 12,461,887 unique email addresses, alongside auto finance data and possible Social Security numbers.

Accounts Impacted: Approximately 38.3 million unique customer accounts; 42 million total records Breach Occurrence Date: October 2, 2025 Added to