The week in breach news Sep 9, 2026

The FBI announced on September 2 that it is investigating a possible data breach that may have exposed more than 153 million driver's licenses belonging to people in the U.S. and Canada.

A dark web site called Nexus claims to be selling millions of digital scans of identity documents belonging to more than 170 million people across North America. The stolen data allegedly includes more than 153 million driver's licenses, over 10 million identification cards and more than three million travel documents and international IDs. The FBI confirmed it is looking into the incident but declined to comment further given the ongoing nature of the investigation.

If the claims are accurate, this could rank among the largest exposures of government-issued identity documents ever recorded in North America, putting tens of millions of people at risk of identity theft and fraud.

In another massive breach of user data, a database said to contain 32.8 million Condé Nast user records is reportedly being offered for $15,000 on a Russian-language cybercrime forum.

Condé Nast is an American mass media company with a widely popular publishing portfolio that includes Vogue, The New Yorker, GQ, Glamour, WIRED and Vanity Fair. The database, which reportedly went on sale on September 7, 2026, is claimed to contain 32,815,767 user records, including email addresses, names, postal addresses, gender, dates of birth and phone numbers. The listing does not include passwords, password hashes, usernames or payment card data.

Condé Nast has not publicly confirmed the breach or commented on the sale listing at this time.

The ANZ region also found itself caught up in this wave of massive breaches of user data, with learning provider Mathspace confirming that more than a million people, including students, school staff and parents, have been affected by a recent data breach.

Mathspace confirmed that unauthorised parties accessed an internal reporting system between August 10 and August 27 by exploiting a security vulnerability in its self-hosted software installation. A security patch that could have prevented the breach had not been installed during the affected period. The exported data includes user IDs, usernames, first and last names, email addresses, countries, time zones, user types, email verification status, last-active dates, last-login dates and dates joined.

The company said it has not yet identified who was responsible for the breach and has found no evidence so far that the stolen data has been published, shared or sold. Mathspace confirmed a total of 1,079,819 people were affected across Australia and New Zealand.

A June cyberattack at the Texas-based clinical genomics company Baylor Genetics resulted in the exposure of electronic protected health information (ePHI) belonging to nearly 2.8 million people.

Baylor Genetics, a clinical diagnostic genomics company that provides genetic testing services to hospitals, identified suspicious activity within its computer network on or around June 15, 2026. A subsequent investigation determined that an unauthorized third party accessed a portion of its IT network between June 11 and June 17, 2026. The breach has since been added to the HHS Office for Civil Rights website, confirming that the ePHI of 2,810,878 individuals was exposed or stolen in the incident.

The exposed information includes names, dates of birth, medical testing information, lab test results and health insurance information. A limited subset of patients also had their Social Security numbers compromised.

Two prominent U.S. law firms, Quinn Emanuel and McDermott, both confirmed data breaches on September 3.

Quinn Emanuel said it identified unauthorized access to stored files through a single temporarily compromised user account within one software application, with a limited number of client documents affected and relevant parties already notified. McDermott separately confirmed an isolated social engineering incident involving a single user and a limited number of documents. It is not clear whether the two breaches were related or who was responsible for either incident.

The two incidents are the latest in a growing pattern of attacks targeting U.S. law firms. Major firms, including Herbert Smith Freehills Kramer, Goodwin Procter and WilmerHale, have all reported data breaches in recent months.