Seven breaches this week put emails, keys and IDs at risk

This week in email privacy covers seven breaches disclosed between 19 and 26 October 2026. Capcom confirmed 11.77 million CAPCOM ID email addresses leaked, and stolen UpdraftCentral keys were used to install backdoor plugins on WordPress sites.

Capcom email exposure

Capcom confirmed 11.77 million CAPCOM ID email addresses leaked, with login metadata also in the exposed set, as reported in the Capcom article. Capcom warned customers to expect phishing messages impersonating the company.

TeamUpdraft connection keys

TeamUpdraft announced on 19 October that attackers reached teamupdraft.com over the weekend of 17 and 18 October, and the company believes its customer database was accessed, including names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and UpdraftCentral, UpdraftVault and UpdraftClone connection keys, as reported in the TeamUpdraft article. Stolen UpdraftCentral keys were then used on 18 and 19 October to install backdoor plugins on connected WordPress sites. Updating the plugin does not stop the attack because no plugin flaw is involved, and the fix stated in the published article is deletion of the key stored on the site.

Furusato Choice donor records

TrustBank confirmed attackers exfiltrated 4,454,097 Furusato Choice member records, as reported in the Furusato Choice article. The set includes names, email addresses and hashed passwords.

and ST HD customer records

and ST HD disclosed on 23 October that unauthorised access to its servers may have exposed 2.5 million customer records and 10,000 business-partner records, as reported in the and ST article. Email addresses are included in both affected data sets, while credit card and other settlement information and passwords set by customers are explicitly excluded.

Okinawa Tourist customer data

Okinawa Tourist Service confirmed on 23 October that personal data on up to about 730,000 customers leaked, as reported in the Okinawa Tourist article. Japanese driver's licence numbers are included in the leaked data.

Treasure Factory email addresses

Treasure Factory disclosed on 23 October that unauthorised access to its home-visit purchasing and moving service systems exposed 746,277 customer email addresses, as reported in the Treasure Factory article. The intruder also obtained 750 vendor and employee name-and-email records and 1,000 records of vendor and employee terminal information. No credit card numbers or other payment data were included.

SBI customer records

SBI stated in a Regulation 30 filing on 21 October that 3,897 customer records containing personal data had been found on the dark web, as reported in the SBI article. The listed fields include names, mobile numbers, dates of birth, email addresses, home addresses, branch and Customer Information File identifiers, and loan metadata. Passwords, PINs and one-time passwords were not listed among the exposed data, and no stolen funds were reported. SBI said on 23 October that it had individually informed every customer whose data was identified as involved, through email and/or WhatsApp, and reiterated that account balances and funds are safe.

Published guidance

Capcom warned customers to expect phishing messages impersonating the company, and TeamUpdraft stated that it will never ask customers for passwords or keys. The banking guide states that a bank receives a permanent real dedicated address used only for financial accounts, never a masked or relay alias, because recovery, statements and fraud alerts depend on it, as set out in the banking guide. The breach-response guide states that an address can be checked on Have I Been Pwned, which lists every known breach containing it.

AliasFleet coverage

AliasFleet published a full article on each breach above, linked in each section. The full articles carry the company notices, the data fields in each set, and the published guidance for each incident.