Every month brings a fresh list of companies admitting that customer information left the building, and September was no exception. The names ranged from a cloud storage service to a car rental firm, a government personnel database and a magazine publisher, yet the ways in were surprisingly similar.
In this article we will discuss the incidents summarized in a monthly roundup by CM-Alliance, what they share, and the habits that limit the damage when your details end up in someone else’s breach.
What Happened in September, in Brief
A caution first: this article relies on one monthly roundup from CM-Alliance, and some of the incidents rest on claims made by the attackers rather than confirmation by the company. Where that is the case, I will say so. A claim on a criminal forum is a reason to be alert, not proof of what was taken.
With that said, the month included several large cases. According to the roundup, Dropbox had about 5,000 accounts accessed after attackers abused a flaw in an email verification step run by Lenovo. Revolut said customer data was obtained through fraudulent requests that appeared to come from a legitimate government agency email domain. Times Car Rental reported around 6.6 million accounts affected. The US Defense Manpower Data Center exposed information on about 2.76 million living people and 294,000 deceased individuals, including Social Security numbers.
A listing offering a database of about 32.8 million Conde Nast user accounts appeared on a forum for sale. Gyazo lost about 23.62 million user records. AdaptHealth reported that health and insurance details of more than 4.1 million people were stolen, and Mathspace saw information on more than 1 million students, staff and parents taken. BigCommerce merchants were hit through compromised credentials for third-party apps.
The Scale Is Not the Main Lesson
Large numbers grab attention, but most readers are better served by the pattern than by the totals. A breach of 23 million records and a breach of 5,000 accounts can do equal harm to the individual whose data is in them. What decides your risk is which details were exposed, how long they stay useful to a criminal, and whether you reused them elsewhere.
How to Read a Breach Story
Headlines compress a messy process into a number. A sensible reader asks four things: who confirmed it, what exactly was taken, whether passwords or payment cards were involved, and what the company advises. When the company has confirmed and listed the data types, you can act with confidence. When only the attacker has spoken, the right response is light precaution, such as extra attention to phishing, rather than panic or a rush to cancel everything.
It also helps to separate the date of the breach from the date of the announcement. Many incidents are discovered weeks or months after the intrusion, so the data may have circulated before you were told. That gap is one reason to rely on standing habits, such as unique passwords and account alerts, rather than waiting for a notice to prompt action.
Third Parties and the Weak Link in the Chain
The roundup’s own summary is that many incidents came through vendors, partners, stolen credentials, misconfiguration or weak identity checks. That matches a long-running trend: attackers go after the least defended organization connected to a well-defended one.
The Dropbox and Lenovo Case
The Dropbox incident is a clear example. According to the roundup, attackers exploited a flaw in how Lenovo verified email addresses, which let them create fraudulent Lenovo IDs. Those IDs matched existing Dropbox accounts, and the attackers reached them without needing the passwords. About 5,000 accounts were accessed, and some files were viewed and downloaded.
The uncomfortable part is that a user with a strong, unique password would not have been protected. The weakness lay in a sign-in path that trusted another company’s identity check. This is the kind of risk that arises whenever a service lets you sign in through, or link to, another account. Convenience features that connect accounts are useful, but each link is another door.
The BigCommerce Merchant Case
BigCommerce shoppers faced a different version of the same problem. According to the roundup, attackers used compromised credentials belonging to third-party apps that merchants had installed, and through them reached shopper names, emails, phone numbers and addresses. BigCommerce said its own platform had not been breached.
For a shopper, that distinction matters less than it sounds. You gave your details to an online shop, and they leaked from a plug-in the shop owner added. You had no way to see the app, vet it or refuse it. What you can do is limit how much you hand over: use a separate email address for shopping, avoid saving your details with every store, and treat any message that references your recent order with suspicion for a while.
What Small Businesses Can Take From It
If you run a shop or a small service, the lesson is to count your third-party tools. Every app, plug-in and integration that can read customer data is part of your security. Remove ones you no longer use, give each a separate credential with the least access it needs, and review them regularly. A tidy integration list is one of the cheapest defenses you can have.
Identity Checks and the Data They Leave Behind
Several September stories involve identity documents. Revolut reported that fraudulent requests from what looked like a legitimate government agency email domain led to customer data being obtained, including birth dates, contact details, copies of ID documents, possibly selfies, statements and transaction histories, though the company said funds were unaffected. Times Car Rental had about 1.6 million documents accessed, including identity verification images.
Why ID Images Are the Worst Thing to Lose
A password can be changed in a minute. A passport scan, a driving license photo or a selfie taken for verification cannot be changed at all. Anyone holding these has what many fraudsters want for opening accounts, passing weak identity checks or making a convincing impersonation. The risk can last for years, long after you have forgotten the company that collected them.
That is why I would treat every request to upload an ID photo as a decision rather than a formality. Ask whether the service truly needs it, how long it keeps it, and whether it is stored after the check is complete. Regulated services such as banks and car rental firms often must verify identity, and refusing may not be an option. For a forum, a discount club or a hobby app, a request for a photo of your license is a good reason to walk away.
What to Ask Before You Hand Over an ID
A short checklist in prose: ask why the document is needed, whether a lesser proof such as a bank statement would do, how long the image will be stored, and whether you can request deletion afterward. Legitimate firms answer these questions plainly. If the answer is vague, or the request comes through a message rather than the official site, stop and check by another route.
The Government-Email Trick
The Revolut case shows another point. A request that arrives from a real government domain is believable, and staff trained to respond to such requests may do so quickly. This is why organizations are advised to verify urgent official requests through a second channel, for instance by calling a known number rather than replying to the message. As a customer, you cannot control that, but you can keep your own accounts less exposed by limiting what you store with any one provider and by watching your statements.
A Note on the US Personnel Database
The Defense Manpower Data Center incident, as reported, exposed Social Security numbers for about 2.76 million living people and 294,000 deceased individuals, and officials said there was no evidence of misuse so far. That last phrase deserves a calm reading: no evidence of misuse is not the same as no risk, since stolen numbers can be held and used later. For people in the United States, this is the situation where a credit freeze and regular credit report checks make particular sense, and anyone affected should follow the instructions in any official notice they receive.
Big Databases and What Attackers Do With Them
The remaining incidents in the roundup were mostly about volume: large collections of user records, health details and education data.
Conde Nast and the Unconfirmed Sale
A database of about 32.8 million Conde Nast user accounts went up for sale on a forum for $15,000. According to the roundup, a sample of the data matched authentic account information from 2025, but the company had not confirmed the incident, and no passwords or payment cards were reported. This is a good example of why to read these stories carefully. A sale listing is a claim, a matching sample is evidence that the data is real, and neither tells you how it was obtained or how many people are truly affected.
Even without passwords, the contents of an account database are useful to criminals. Names and email addresses support convincing phishing messages that mention a real subscription. If you hold an account with a publisher or similar service, expect a rise in suspicious emails and be wary of anything that asks you to log in through a link.
Gyazo and the Stolen Image Records
Gyazo, an image-sharing service, lost about 23.62 million user records, according to the roundup, through a flaw in an image-upload server. Upload features are a frequent weak point because they accept files from outsiders, and a poorly configured server can expose more than it should. For users, the practical question is whether you ever uploaded anything sensitive. Screenshots often contain more than intended: names, addresses, tokens, financial details. A simple habit is to assume that anything uploaded to a free sharing service might one day become public.
AdaptHealth and Mathspace
AdaptHealth, a healthcare provider, had personal, health and insurance information of more than 4.1 million people stolen. Mathspace, an education service, lost information on more than 1 million students, staff and parents. These two matter because the data is intimate or concerns children. Health and insurance details can be used for medical identity fraud, and student data can be used to target families with convincing messages.
If you are told that health or insurance information was involved, review the explanation of benefits statements from your insurer for services you did not receive, and ask your provider what protections they are offering. For children’s data, remember that a child has no credit history, so misuse can go unnoticed for years. Where the law in your country allows it, consider placing a freeze on a child’s credit file.
A Quick Comparison of Exposure Types
| Kind of data exposed | How long it stays risky | Best first response |
| Password only | Until changed | Change it everywhere it was used |
| Email and phone number | Years | Expect phishing, filter and ignore |
| Social Security or national ID number | Indefinitely | Freeze credit where available, monitor |
| ID document or selfie | Indefinitely | Watch for new accounts in your name |
| Health or insurance details | Years | Check insurer statements closely |
| Payment card number | Until card is replaced | Ask the bank to reissue the card |
Passwords, Passkeys and Authenticator Apps
Breaches will keep happening, so the useful question is how to make each one matter less. The foundation is simple and has not changed: never use the same password on two sites.
Unique Passwords and a Password Manager
Reuse is the multiplier that turns a small breach into a large one. When an attacker obtains a list of emails and passwords from one site, they try the same pairs on banking, email and shopping sites, an approach known as credential stuffing. A password manager removes the need to remember anything but one strong passphrase, and it generates a different random password for each account. Pick one from a reputable provider, protect it with a long passphrase and a second factor, and import your existing logins slowly, starting with email, banking and any account that can reset others.
Passkeys and Authenticator Apps
Passkeys, where a service supports them, replace the password with a cryptographic key tied to your device and unlocked by your fingerprint, face or PIN. They resist phishing because there is nothing to type into a fake website. Where passkeys are not offered, an authenticator app that generates short-lived codes is a better second factor than a text message, because phone numbers can be hijacked. Use text messages only if nothing else is available.
Email Aliases and Sign-In Hygiene
One underrated habit is to use a different email address, or an alias that forwards to your inbox, for different kinds of sites. Many email providers and some privacy services offer aliases. If a shopping alias begins receiving scam messages, you know where the leak happened, and you can switch it off without touching your main address. Combine that with a rule never to sign in through a link in an email, and most phishing loses its force.
Why This Does Not Solve Everything
Neither passkeys nor strong passwords would have stopped the Dropbox case, in which the weakness was in another company’s verification process. Strong habits protect you against the common attacks, but they cannot fix a flaw in someone else’s system. That is why the next layers matter: knowing what you have stored, watching for signs of misuse, and limiting what you hand over in the first place.
After a Breach Notice Arrives
Breach notices have become so common that people ignore them, and criminals know it. Some fake notices exist to steal your details, so verify before you act.
Check That the Notice Is Real
Do not click links in a message announcing a breach. Instead, go to the company’s website by typing the address yourself, or use its official app, and look for the announcement there. A real notice will usually name the company, describe what was taken and offer a contact route. A fake one tends to create urgency and ask you to log in or provide extra details.
Change, Freeze and Watch
Change the password for the affected account and for any other account where you reused it. Turn on a second factor if the account offers one. If the notice mentions Social Security numbers, national identity numbers or ID documents, consider a credit freeze where your country offers one, which blocks most new credit applications until you lift it. Set up alerts on bank and card accounts, so you hear about unusual activity quickly.
Report What You Receive
If you get a scam message that cites details from a breach, report it as phishing in your email app and, where your country has one, to the national body that collects scam reports. Reports help providers block the sender for everyone else, and they take seconds. Do not reply, even to say no, since a response confirms that the address is live.
Use Breach Notification Services Sensibly
There are well-known free services that let you enter an email address and see which public breaches included it. They are a handy way to discover forgotten accounts. Use only those from established, reputable operators, never enter a password into a checker, and be wary of lookalike sites. A positive result does not mean you were hacked today, only that your address appeared in a past leak.
Expect Phishing for Months
After a breach, scam messages that quote real details tend to follow. A message that knows your name and a recent order is not proof of legitimacy. A simple test is to ignore the contact details in the message and reach the company through a number or address you already trust.
Rules That Differ by Country
What you can demand after a breach depends heavily on where you live. In the United States, there is no single national rule; breach notification laws differ by state, and the protections available, such as credit freezes, are specific to the US credit system. In the European Union and the United Kingdom, data protection law generally requires organizations to notify the regulator and, where there is a high risk, the affected people, and individuals have rights to ask what data is held. Other countries have their own regimes, and some have very little.
What That Means for You
Do not assume that a company will tell you quickly or at all. Timelines vary, and some organizations disclose only when legally forced to. Look up your national or regional data protection authority, which usually has guidance on how to complain. If you are in a country with no credit freeze, extra vigilance on bank statements and identity checks matters even more.
Keeping Your Own Record
Whatever the rules, keep a simple record when a breach touches you: save the notice, note the date you received it, and write down what you changed in response. If fraud appears later, a dated trail helps your bank, your insurer or a regulator see what happened and when. It also stops you from repeating work, since many people receive several notices in a year and lose track of which accounts they have already secured.
When to Ask for Professional Help
If your identity has clearly been misused, for example if accounts or loans appear that you did not open, contact your bank, your national consumer protection or police reporting service, and a qualified advisor. This article offers general information, not legal or financial advice.
A Short Plan for This Weekend
You do not need to fix everything at once. An hour of focused work will make you noticeably safer.
Take Stock First
Spend ten minutes listing the services that hold your money, your identity documents and your main email. Those are the accounts where a breach would hurt most, and they set the order of work for the rest of the plan. Keep the list somewhere safe, ideally inside your password manager rather than a loose document.
Start With Your Email
Your main email address can reset almost everything else, so protect it first. Give it a unique, strong password, turn on an authenticator-based second factor or a passkey, and check which devices are signed in. Remove any you do not recognize.
Then the Money and Identity Accounts
Move on to banking, payment services, and any account that holds identity documents. Review the saved cards and stored documents. If a service holds a scan of your passport that it no longer needs, ask it to delete it.
Clear Out What You No Longer Use
This step is tedious and also one of the most effective. Old accounts are a quiet risk because nobody watches them, and the companies behind them may have stopped investing in security long ago. List the services you have not used in years and delete the accounts, rather than just abandoning them. A breached service you forgot about is a source of leaked details you cannot even track.
Conclusion
Security is mostly a matter of small routines done repeatedly, not a single heroic afternoon. Put a reminder in your calendar for a quarterly check, because security that depends on remembering rarely survives a busy season. Review your accounts every few months, keep software updated, be selective about uploading ID photos, and keep a separate email address for shopping and sign-ups. None of this is dramatic, but together it means the next monthly roundup will describe incidents that cost you very little.
Frequently Asked Questions
How do I know if my data was in a breach?
Use an established breach notification service to check your email address, and read any notice sent by the company. Always go to the official website yourself rather than clicking a link.
Should I freeze my credit after a data breach?
If Social Security or national ID numbers were exposed, a freeze is a sensible step where your country offers one. It is usually free in the US, but rules differ elsewhere.
Are passkeys safer than passwords?
For most people, yes, because they cannot be typed into a fake site or reused. Use them wherever a service supports them.
Do I need a password manager?
It is the easiest way to keep a different strong password on every account. Choose a reputable one and protect it with a long passphrase.
Is it safe to upload a photo of my ID?
Only when a regulated service truly requires it, such as a bank. Ask how long it keeps the image, and decline for casual services.
Should I delete old accounts?
Yes, if you no longer use them. Fewer accounts means fewer places your details can leak from.
