In September 2026, 7 breaches were added to the public catalogue, covering 42.6 million accounts in total. Four of them expose data that matters to a small business: who works where, in what role, how to reach them, and in two cases the support tickets they wrote. None of the seven includes passwords. Only one breach actually happened in September; four date from August 2026, one from August 2024 and one from August 2019.
The relevant breaches
LimeLeads, 17,838,396 accounts, breach dated August 1, 2019. Exposes email addresses, employers, geographic locations, job titles, and phone numbers. LimeLeads was a B2B sales leads database, so this is corporate contact data by design: a directory of who works where, in what role, and on which direct line. Some entries will be out of date after seven years, but many people keep the same employer and title for a long time, and a list like this is exactly what a criminal needs to call or email the person who approves payments, by name.
McKesson, 6,404,340 accounts, breach dated August 21, 2026. Exposes dates of birth, email addresses, employers, genders, names, personal health data, phone numbers, and physical addresses. The records cover patients, staff, healthcare provider contacts and marketing recipients. Health data attached to a full identity gives criminals material for convincing messages that look like they come from a pharmacy, an insurer or a clinic, and for identity fraud that relies on a date of birth and a home address.
Questel, 1,226,209 accounts, breach dated August 1, 2026. Exposes email addresses, employers, job titles, names, phone numbers, physical addresses, and support tickets. The data is largely corporate contact information from sales leads, support cases and marketing. A support ticket tells a criminal what a person asked for, when, and how the vendor answered, which is everything needed to write a follow-up that looks like the real vendor picking up an old case.
Medela, 423,947 accounts, breach dated September 7, 2026. Exposes email addresses, employers, job titles, names, phone numbers, physical addresses, salutations, and support tickets. The addresses belong mostly to healthcare professionals, Medela staff and sales leads. The mix is the same as Questel’s, so the risk is the same: messages that quote a real support case and a real job title, sent to people who have every reason to expect mail from that vendor.
The other three entries are consumer services. Manchester Airports Group (8,849,657 accounts, August 27, 2026) exposed names, phone numbers, IP addresses, purchases and vehicle registration plates from parking and lounge bookings. Chess.com (4,653,212 accounts, August 3, 2026) is a scrape of usernames, names and countries, and 99% of its email addresses were already in earlier breaches. Burger King Russia (3,155,792 accounts, August 25, 2024) exposed names, dates of birth, genders and phone numbers, but no payment details.
What the data types say this month
Email addresses appear in all 7 entries, and names and phone numbers in 6 each. Employers appear in 4 and job titles in 3, which is high for a single month: most of the volume this time is about people at work, not shoppers. Three of the four relevant breaches, McKesson, Questel and Medela, were “pay or leak” extortion by the same group, ShinyHunters, and in each case the data that came out was the company’s contacts: customers, leads, partners and the people who opened support cases.
That is the lesson for a small business. You do not have to be breached to be in a breach. If you are a customer or a lead of a vendor whose sales or support system is copied, your name, title, direct line and the questions you sent them are now in someone else’s hands. The absence of passwords this month does not make it quiet; it moves the risk from logins to conversations.
Actions for this month
- Agree with your staff that any request to change bank details, pay an invoice early or share internal information is confirmed through a number or channel you already have, never by replying to the message that asked.
- Treat a message that revives an old support case, or quotes a real ticket with a vendor, as a possible scam until you confirm it through the vendor’s usual portal or phone line.
- Tell the people who answer your phones that a caller who knows their name, title and direct line has not proven anything. LimeLeads alone tied employer, title and phone number to 17.8 million email addresses.
- If your business relies on a date of birth or a home address to confirm who someone is when they call, add a step that is not in a breach, such as a call back to the number on file.
To see whether your own address is in any of these, check it on Am I Breached? It is free, and you can ask to be emailed the next time it appears in a new breach.
Data from Have I Been Pwned as of October 1, 2026 | Report generated with AI assistance and checked against the source data
Related
- Am I Breached? Check an address and get alerts
- Data breach directory
- September 2026 Ransomware Report