October 2026 saw several significant data breach disclosures involving government databases, financial institutions, gaming platforms, universities and educational services.
The incidents varied in scale and nature. Some involved unauthorized access to centralized identity databases, while others exposed customer information through online membership services and institutional IT systems.
This monthly roundup covers the incidents disclosed during October, with emphasis on the affected organizations, reported exposure, information involved and confirmed numerical details.
1. Capcom – 11,774,247 records exposed
Capcom disclosed unauthorized access to its CAPCOM ID membership service on October 22, 2026.
The company confirmed that 11,774,247 email address records and associated system-specific information were affected globally.
The exposed system information included account creation timestamps, last login timestamps, login counts and client IP addresses associated with the last login.
The company also reported:
- 43 records containing date of birth, gender, country or region and nickname information.
- 196 accounts where login passwords were changed without authorization.
- 19 Japanese e-Capcom accounts subsequently accessed by an unauthorized party.
Capcom clarified that customer-set login passwords were not confirmed compromised and credit card information was not included in the affected data.
The company implemented emergency response measures and reported the incident to the relevant Japanese authorities.
2. Denmark – Central Person Register (CPR) exposure
Denmark’s Central Person Register disclosed unauthorized access to personal information associated with approximately 8.8 million registered individuals on October 5, 2026.
The exposed information included names, residential addresses and CPR numbers, which are Denmark’s national personal identification numbers.
The incident involved misuse of a Danish private company’s legitimate access to the CPR database. Unauthorized parties used that access to retrieve information from the government system.
The authorities confirmed that the exposure involved approximately 8.8 million registered individuals, including living residents, deceased individuals and people who had moved abroad.
The authorities stopped the company’s access and initiated an investigation.
The incident demonstrates the potential consequences of misuse of authorized access to centralized government databases.
3. Florida Department of Education – 4.9 million potentially affected individuals
The Florida Department of Education disclosed unauthorized criminal access to information associated with its Florida Student Financial Aid website on October 29, 2026.
The department stated that approximately 4.9 million individuals may have been affected.
The information potentially exposed included:
- Social Security numbers.
- First and last names.
- Dates of birth.
- Residential addresses.
- Telephone numbers.
- Email addresses.
- Gender identification codes.
The department activated its cybersecurity response procedures and engaged the Florida Digital Service and Florida Department of Law Enforcement.
The investigation remained ongoing, and the department clarified that not all potentially affected individuals necessarily had the same information exposed.
4. Technical University of Denmark (DTU) – Up to 200,000 users potentially affected
The Technical University of Denmark disclosed a cyberattack involving its identity and access management system, DTUBasen, on October 2, 2026.
Unauthorized individuals gained access to the system and downloaded a large volume of information.
DTU stated that information relating to up to 200,000 current and former users may have been affected.
The database contained information relating to approximately 40,000 active users and 160,000 former users.
Potentially exposed information included:
- Full names and CPR numbers.
- Residential addresses.
- Profile pictures.
- Work email addresses and job titles.
- Office locations.
- Registered next-of-kin information.
DTU clarified that it could not determine precisely how many individuals were affected or exactly which information had been downloaded.
The university reported the incident to the Danish Data Protection Agency and involved law enforcement in the investigation.
5. University of Copenhagen – 525,000 individuals affected
The University of Copenhagen disclosed a cyberattack on October 23, 2026, following the discovery of unauthorized access to one of its IT environments.
The university confirmed that information relating to approximately 525,000 current and former members of its community had been accessed.
The compromised information included:
- Full names.
- National identification numbers.
- Work and personal telephone numbers.
- Personal email addresses.
- University usernames and email addresses.
- Citizenship and nationality information.
- Gender and university affiliation information.
- Encrypted CPR numbers and university access-card PIN codes.
The university stated that information required to decrypt the encrypted CPR numbers had also been compromised, creating a risk that the identification numbers could be recovered.
The affected systems were blocked, and the university initiated an investigation and notified the relevant authorities.
6. State Bank of India – 3,897 customer PII records identified
State Bank of India disclosed a suspected customer data exposure incident on October 21, 2026.
The bank received alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In regarding suspected customer information appearing on the dark web.
A preliminary examination of approximately 375,000 records identified 3,897 customer records containing personally identifiable information.
The information reportedly included:
- Customer names.
- Mobile numbers.
- Dates of birth.
- Email addresses.
- Residential addresses.
- Customer and branch identifiers.
- Loan-related information.
SBI initiated an investigation and appointed an independent CERT-In-empanelled cybersecurity agency to assess the incident and establish the source and extent of the exposure.
The bank stated that the incident had no material impact on its core banking operations, financial performance or business continuity.
Importantly, the 3,897 figure represents customer records identified with PII during the preliminary examination, not the total number of records in the larger dataset.
October 2026 – Numerical summary
The following figures retain their original measurement categories and qualifications.
- Capcom: 11,774,247 email address and associated system-information records.
- Denmark CPR: Approximately 8.8 million registered individuals.
- Florida Department of Education: Approximately 4.9 million potentially affected individuals.
- Technical University of Denmark: Up to 200,000 current and former users potentially affected.
- University of Copenhagen: Approximately 525,000 individuals.
- State Bank of India: 3,897 customer PII records identified in a preliminary examination of approximately 375,000 records.
