AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Personal Data Breaches
Coverage from The Guardian, The Conversation, and others
Personal data breaches include unauthorized access, misuse of legitimate credentials, insecure sharing, and online publication of sensitive information.
The subject spans consumer, corporate, government, and research-held data, with particular attention to health and genetic records whose de-identification may not prevent re-identification when combined with other sources. A prominent example is the exposure of UK Biobank records for hundreds of thousands of volunteers, including listings associated with Alibaba and subsequent access suspensions, takedown efforts, and government scrutiny. The wider issue involves how organizations detect breaches, notify affected parties, limit downstream harm, and improve control over third-party data access.
Looking Back
182 Day Timeline
Feb 16
Mar 16
Apr 13
May 11
Jun 8
Jul 6
Aug 3
All Articles34 articles
Important
UK Biobank data exposure in the United Kingdom during 2024 and 2025 highlights privacy risk and governance gaps.
3/14/2026 • Data Breaches & Exposure Events • General
UK Biobank notified over 500,000 UK participants after data access by legitimate researchers led to attempted online sale via a Chinese website.
4/28/2026 • Data Breaches & Exposure Events • General
Jeremiah Fowler discovered and reported a publicly accessible SISVISA database in Brazil containing 102,215 sensitive identity and health-surveillance files before access was disabled.
8/6/2026 • Data Breaches & Exposure Events • General
Researchers reported a data leak in the UK Visa Portal third-party travel authorization website in the UK, exposing up to 100,000 identity documents in public cloud storage.
5/29/2026 • Data Breaches & Exposure Events • General
TechCrunch reported a third-party UK visa portal exposed at least 100,000 passport scans and GPS-bearing selfies on a public Amazon storage server before bucket security.
5/28/2026 • Data Breaches & Exposure Events • General
UK Biobank temporarily blocked researcher access after anonymised medical data was offered for sale online in China, prompting scrutiny of research data governance.
5/25/2026 • Data Breaches & Exposure Events • General
Eurail reported a December 2025 Interrail customer breach affecting about 300,000 travellers across Europe, with UK officials advising potential passport replacement.
5/1/2026 • Data Breaches & Exposure Events • General
Amtrak faced scrutiny in connection with a suspected cloud CRM data breach potentially exposing more than 2.1 million customers, with data listed on Have I Been Pwned.
4/30/2026 • Cybersecurity (Privacy-Relevant) • General
Eurail notified EU DiscoverEU users starting March 27, 2026 after a December 26, 2025 breach exposed passport, bank, and some health data from AWS S3, Zendesk, and GitLab.
4/29/2026 • Personal Data & Identity • General
UK Biobank volunteer biomedical data appeared on Alibaba in 2025 after authorized academic access, prompting scrutiny of de-identification and data containment.
4/28/2026 • Data Breaches & Exposure Events • General
Eurail disclosed a December cyberattack exposure of over 300,000 customers, with data later sold on the dark web and investigated by European privacy regulators.
4/27/2026 • Data Breaches & Exposure Events • General
Ian Murray reported a breach of UK Biobank de-identified health data for 500,000 citizens after Alibaba listings appeared in China on April 20.
4/26/2026 • Data Breaches & Exposure Events • General
Eurail disclosed March 27, 2026 notifications for a December 26, 2025 incident after dark-web sale of passport and contact data affecting 308,777 people.
4/25/2026 • Personal Data & Identity • General
UK officials confirmed 500,000 UK Biobank participant health records were offered for sale online in China via Alibaba, after China access by research institutions was revoked and listings removed.
4/23/2026 • Data Breaches & Exposure Events • General
UK Biobank notified the UK government on April 20, 2026 after 500,000 health records tied to volunteer data were allegedly listed for sale on Alibaba.
4/23/2026 • Data Breaches & Exposure Events • General
UK officials said UK Biobank member data was listed for sale on Alibaba in China, leading to access revocation and a security investigation.
4/23/2026 • Data Breaches & Exposure Events • General
Rory Collins announced a temporary UK Biobank access pause after de-identified volunteer data was offered for sale online in China in April 2026, leading to a forensic investigation.
4/23/2026 • Data Breaches & Exposure Events • General
Patrick Vallance said further UK Biobank volunteer health-record listings appeared on Alibaba after last week's breach report, with government coordination underway to remove postings.
4/29/2026 • Data Breaches & Exposure Events • General
UK Biobank reported Alibaba listings in China on 20 April that appeared to offer de-identified health data from 500,000 participants, leading to suspended access and tighter export limits.
4/23/2026 • Data Breaches & Exposure Events • General
Ian Murray told MPs in the UK that Alibaba postings in China offered details of 500,000 UK Biobank members, leading to revoked access and security updates.
4/23/2026 • Data Breaches & Exposure Events • General
Ryde reported on Sunday, August 2, that unauthorized access potentially exposed personal and payment information from 4.5 million accounts across Norway, Sweden, Finland, and Germany.
8/6/2026 • Data Breaches & Exposure Events • General
Eurail B.V. disclosed a March 27 response to a December 26, 2025 data breach affecting 308,777 customers, including exposed passport, health, and IBAN data.
4/9/2026 • Data Breaches & Exposure Events • General
Eurail B.V. notified U.S. regulators in 2026 about a December breach exposing identities of 308,777 travelers, with passport data circulated on dark web and Telegram.
4/8/2026 • Data Breaches & Exposure Events • General
Eurail B.V. disclosed a data breach earlier this year in Europe, with stolen customer data offered for sale on the dark web.
2/16/2026 • Data Breaches & Exposure Events • General
Nefos faced privacy and security scrutiny after discovery of an online exposure of about 985,000 passport images, with Ireland's Data Protection Commission notified.
6/26/2026 • Data Breaches & Exposure Events • General
Interesting
ExfilSquad reportedly stole more than 740,000 records from UK education and police systems on July 30, 2026, prompting investigations and Information Commissioners Office notifications.
7/30/2026 • Data Breaches & Exposure Events • General
On April 17, 2026, a dataset attributed to Amtrak appeared on Have I Been Pwned, exposing millions of accounts and customer support records via a cloud-linked incident.
4/29/2026 • Cybersecurity (Privacy-Relevant) • General
UK Biobank reported 18 months of security work after an anonymous tip led to Alibaba e-commerce listings tied to Chinese-linked researchers offering biomedical data.
4/26/2026 • Data Breaches & Exposure Events • General
Eurail disclosed a January-discovered breach impacting about 309,000 Interrail and Eurail pass customers, exposing passport and contact data and prompting notifications.
4/11/2026 • Data Breaches & Exposure Events • General
Eurail disclosed a December 2025 cyberattack discovered in January 2026 that exfiltrated 1.3 terabytes of traveler data, including passport numbers, with extortion threats.
4/10/2026 • Data Breaches & Exposure Events • General
Eurail B.V. disclosed a December 26, 2025 data breach in the Netherlands and Europe, exposing customer and passport-related information later offered for sale online.
4/9/2026 • Data Breaches & Exposure Events • General
Eurail disclosed a December 2025 breach impacting 308,777 travelers, exposing passport, contact, bank, and health information later published for sale on the dark web.
4/17/2026 • Data Breaches & Exposure Events • General
ICO investigates IT glitch exposing customer transactions in Lloyds Banking Group mobile apps in the United Kingdom in 2025
3/12/2026 • Data Breaches & Exposure Events • General
UK Ministry of Justice confirmed May 2025 Legal Aid Agency data breach after online portal intrusion exposed about 2.1 million applicants since 2010.
6/20/2026 • Data Breaches & Exposure Events • General