In August 2026, 11 breaches were added to the public catalogue, covering 30.2 million accounts in total. Six of those entries expose data that matters to a small business, including payment details, health records, employer and job title information, and passwords. Of the 11 breaches overall, four happened in August 2026, six happened earlier in 2026 between May and July, and one dates to July 2025.
The relevant breaches
Exact Sciences, 10,869,543 accounts, breach dated July 15, 2026. Exposes dates of birth, email addresses, gender, names, personal health data, phone numbers, and physical addresses. Health data attached to full identity details gives criminals material for health insurance fraud, requests for prescription services in someone else’s name, or very specific phishing messages that look medical.
SplitVPN, 865,336 accounts, breach dated July 21, 2026. Exposes device information, email addresses, geographic locations, IP addresses, and partial credit card data. Pairing device and IP details with even partial card data lets criminals correlate a person’s network profile with their payment footprint, which is useful for account takeover on other services and for targeted fraud.
Brinks Home, 732,162 accounts, breach dated July 13, 2026. Exposes dates of birth, email addresses, names, partial credit card data, phone numbers, physical addresses, and purchases. Identity basics, partial card data, and a purchase history let a criminal build convincing calls or messages about a real recent order, or attempt to pass identity verification at other businesses.
Inter-Con Security, 276,114 accounts, breach dated June 18, 2026. Exposes email addresses, employers, job titles, names, phone numbers, and physical addresses. This is the most directly business-relevant dataset of the month: knowing where a person works and what they do is exactly what a criminal needs for spear phishing and business email compromise against that employer.
Fanlore, 144,520 accounts, breach dated August 6, 2026. Exposes email addresses, names, passwords, and usernames. Anyone reusing those credentials on other sites is now exposed to credential stuffing, where attackers try the same email and password on banking, payroll, or admin tools.
NIUS, 6,090 accounts, breach dated July 13, 2025. Exposes bank account numbers, email addresses, names, partial credit card data, physical addresses, and purchases. The account count is small, but the mix of bank and card detail with identity data is direct fuel for financial fraud and unauthorized transfers.
The other five entries, Carhartt (12,933,413 accounts, August 13, 2026), RingCentral (1,596,490 accounts, July 27, 2026), Oz Hair and Beauty (1,988,331 accounts, August 15, 2026), Alcon (218,395 accounts, August 1, 2026), and Golf Canada (568,972 accounts, May 14, 2026), all expose email addresses and names. Beyond that, the group is mixed: phone numbers and physical addresses appear in some entries, while dates of birth, genders, geographic locations, usernames, and purchases appear in others.
What the data types say this month
Email addresses appear in all 11 of the new entries, names in 10, and phone numbers and physical addresses in 7 each. That combination, with a date of birth in three of the breaches, gives criminals a working identity kit for impersonation, even without passwords. Partial credit card data shows up in three entries, and a purchase history in three, which lets a scam message reference a real recent order. Personal health data appears in only one entry this month, but it is the largest of the relevant breaches by accounts, and health information carries its own long-tail value on criminal markets.
Actions for this month
- Reset any password you or your staff used on Fanlore, and any other service where the same email and password combination was reused.
- Treat any call or email that quotes a recent order, a delivery, or a refund as a potential scam, since purchase history is now circulating from Brinks Home and Oz Hair and Beauty.
- Brief your staff on spear phishing that uses their name, employer, and job title, which is the exact mix exposed in Inter-Con Security.
- Watch your bank and card statements for unusual activity, and be ready to dispute transactions tied to the card fragments in the Brinks Home, SplitVPN, and NIUS datasets.
- Be cautious with any inbound contact that references a medical test or health record, given the size of the Exact Sciences dataset.
To see whether your own address is in any of these, check it on Am I Breached? It is free, and you can ask to be emailed the next time it appears in a new breach.
Data from Have I Been Pwned as of September 25, 2026 | Report generated with AI assistance and checked against the source data