SecureFact – October 26, 2026

Quest Diagnostics confirms data breach exposed patient records

American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system on October 21, 2026. The company serves one in three U.S. adults each year and operates 7,700 points across North America with 65,000 employees. The breach exposed patient records through the Quanum LSM platform, which physicians, hospital personnel, and medical office staff use to manage laboratory services and access test results. The types of data affected have yet to be determined by the company. Quest Diagnostics deployed its incident response protocol to contain the activity, assess the scope of the incident, and implement remedial measures. External experts are aiding the ongoing investigation, and the company has informed applicable law enforcement authorities. The Quanum LSM system has been stopped, and customers are recommended to use paper requisitions or Quanum eLabs to place orders and receive results. As a cautionary measure, Quest Diagnostics has temporarily paused access to other systems including Essential Insights and LabHQ.

(Source: Read full report)

Capcom confirms data breach affecting 11.7 million accounts

Japanese gaming giant Capcom confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. The breach was detected on October 19 after suspicious activity was identified, with unauthorized access confirmed by October 20. Exposed data includes account creation dates, last login timestamps, number of logins, and IP addresses used at last login for all affected accounts. For a small subset of 43 accounts, additional data was exposed including dates of birth, gender, nicknames, and countries. For another subset of 196 accounts, hackers attempted to change login passwords to lock owners out, but Capcom took action and reset them. Passwords for all other registered members were not exposed, and credit card information remained unaffected. The company reported the incident to Japanese police and the Personal Information Protection Commission on October 21. Capcom identified the intrusion method and implemented security measures to prevent similar incidents. The gaming firm is notifying affected customers in stages through region-specific communication channels.

(Source: Read full report)

Nikkei discloses third data breach in a month, 1.8M records exposed

Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese business news and financial information giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying information. Approximately 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records. The remaining 1.68 million records contain no identifiers, and no credit card information was exposed. Hackers used stolen credentials to access a development system within Nikkei’s network during early morning hours of October 7, exposing personal information stored in the cloud. Nikkei revoked the abused credentials and notified the Personal Information Protection Commission on October 11. The company is examining the scope of the breach and as of October 16 had no evidence that accessed information was misused or leaked online. Nikkei has found no signs of system compromise, data tampering, or service outages resulting from this incident. The firm stated it is working urgently to establish the extent of damage and determine the cause, and will implement necessary measures to strengthen security. Affected individuals will receive individual notifications.

(Source: Read full report)

SBI confirms data leak involving 3,897 customer records in preliminary analysis

SBI confirmed a potential data leak involving 3,897 customer records identified during a preliminary analysis of 3.75 lakh records circulating on the dark web. The exposed information reportedly includes names, contact details, dates of birth, addresses, and customer identifiers. SBI has launched an independent investigation to determine the source and extent of the exposure. The bank stated that customer funds and core operations remain safe, although the leaked personal information could increase the risk of phishing and targeted fraud.

(Source: Read full report)

Singapore insurance customers among 110,000 hit by Alliance Medinet data breach

Singapore-based healthcare services provider Alliance Medinet suffered a cyber incident involving unauthorised access to its membership database, compromising personal data belonging to approximately 110,000 members. The exposed information includes names, identification numbers and contact details. Bank account information of seven members and one member’s medical diagnosis may also have been compromised. Customers of HSBC Life, Income Insurance, Singlife and Great Eastern were among those potentially affected. The insurers stated that there was no evidence their own systems had been compromised. Alliance Medinet has engaged cybersecurity specialists, implemented 24/7 network and dark web monitoring, and is working with authorities as investigations continue.

(Source: Read full report)