Global Data Leaks Expose Billions of Records Across Governments and Corporations
Recent years have seen a surge in massive data leaks, exposing the personal records of billions worldwide from national ID databases to airline, banking, and health systems. These incidents span multiple countries, often involving government agencies, third-party vendors, or unsecured databases, with some leaks remaining unverified or disputed.
Key Incidents by Region
Pakistan: National ID and Telecom Breaches
Pakistan’s National Database and Registration Authority (NADRA) has faced repeated exposures, including:
- 2021: 115 million mobile subscriber records sold on the dark web.
- 2024: A government probe confirmed 2.7 million citizens’ credentials were compromised (2019–2023), leading to employee terminations.
- 2025: An unverified claim of 602 million records (including CNIC numbers) surfaced, though NADRA has not confirmed it. Additionally, 180 million Pakistani internet users’ credentials appeared in a global malware compilation.
Exposed data typically includes CNIC (national ID) numbers, names, addresses, and biometric details, affecting millions though official acknowledgment often lags behind dark web listings.
Russia-Ukraine Cyber Conflict: Disinformation and Genuine Leaks
The war has fueled cyber operations, including:
- August 2025: Pro-Russian hackers claimed to leak 1.7 million Ukrainian military casualty records, but fact-checkers dismissed it as fabricated disinformation.
- Ongoing: Both sides have targeted government and financial institutions, though many claims remain unverified due to operational security concerns.
China: Record-Breaking Government and Corporate Leaks
China’s centralized data collection has led to some of the largest exposures:
- 2022 (Shanghai Police Leak): A hacker offered 23TB of data (allegedly from Shanghai’s police database) for $200,000, potentially exposing 1 billion residents’ records. Journalists verified samples, but the full scale remains unconfirmed.
- 2024: A separate dataset contained national ID numbers for nearly 10% of China’s population.
- Data Scraping: Aggregated social media profiles have also been compiled into resellable databases, increasing identity theft risks.
India: Biometric and Corporate Breaches
India has seen high-volume leaks across sectors:
- 2021 (Air India): A breach at SITA, a Swiss passenger reservation provider, exposed 4.5 million travelers’ data, including passport and payment details.
- Aadhaar System: While the central database remains unbreached, third-party misuse has led to repeated exposures, including an October 2023 claim of 815 million Aadhaar and passport records.
- 2021 (MobiKwik & Domino’s): Over 110 million digital wallet users’ KYC data and 180 million Domino’s order records were exposed, prompting legal action.
United States: Financial and Third-Party Risks
Major U.S. incidents highlight vulnerabilities in financial and vendor systems:
- 2024 (American Express): A third-party merchant processor breach exposed card numbers and expiration dates, though the full scope remains undisclosed.
- 2019 (First American Financial): A flaw allowed public access to 885 million mortgage and banking documents, leading to a $500,000 regulatory fine.
Other Notable Global Leaks
- UK (2026): UK Biobank’s genetic and health records of 500,000 participants were accessed and sold on Chinese platforms.
- Australia (2022): Optus (9.8 million records) and Medibank (480,000 health claims) suffered back-to-back breaches via unsecured APIs and stolen credentials.
- South Africa (2022): TransUnion exposed 3 million consumers’ financial data after a server compromise.
- Dubai (2022): Investigative journalism revealed 274,000 property owners’ records, including politically exposed individuals, sourced from public land registries.
Understanding the Terms
- Data Breach: Unauthorized access to protected information (e.g., hacking, insider threats).
- Data Leak: Exposure of data (e.g., unsecured databases, human error) without active intrusion.
- Data Hack: Deliberate cyberattack (e.g., malware, stolen credentials).
Detection and Impact
Many leaks surface on the dark web before official disclosure, with stolen data often traded or sold. Government breaches, in particular, may go unconfirmed for months or years. The long-term risks include identity theft, financial fraud, and targeted disinformation campaigns, especially when biometric or genetic data is exposed.
These incidents underscore the global scale of data vulnerabilities, affecting individuals, corporations, and governments alike.
Source: https://www.dexpose.io/major-data-leaks-by-country-the-complete-2026-breach-tracker/
Domino's TPRM report: https://www.rankiteo.com/company/domino's-pizza
Optus TPRM report: https://www.rankiteo.com/company/optus
TransUnion TPRM report: https://www.rankiteo.com/company/transunion
"id": "tradomopt1787978104",
"linkid": "transunion, domino's-pizza, optus",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2.7 million (2019–2023), 115 '
'million (2021), 180 million '
'(2025)',
'industry': 'Government',
'location': 'Pakistan',
'name': 'National Database and Registration Authority '
'(NADRA)',
'type': 'Government Agency'},
{'customers_affected': '1 billion (alleged)',
'industry': 'Government',
'location': 'China',
'name': 'Shanghai Police',
'type': 'Government Agency'},
{'customers_affected': '4.5 million',
'industry': 'Aviation',
'location': 'India',
'name': 'Air India',
'type': 'Corporation'},
{'customers_affected': '4.5 million',
'industry': 'Technology',
'location': 'Switzerland',
'name': 'SITA',
'type': 'Third-Party Vendor'},
{'customers_affected': '110 million',
'industry': 'FinTech',
'location': 'India',
'name': 'MobiKwik',
'type': 'Corporation'},
{'customers_affected': '180 million',
'industry': 'Food Services',
'location': 'India',
'name': "Domino's India",
'type': 'Corporation'},
{'industry': 'Financial Services',
'location': 'United States',
'name': 'American Express',
'type': 'Corporation'},
{'customers_affected': '885 million',
'industry': 'Financial Services',
'location': 'United States',
'name': 'First American Financial',
'type': 'Corporation'},
{'customers_affected': '500,000',
'industry': 'Healthcare',
'location': 'United Kingdom',
'name': 'UK Biobank',
'type': 'Research Organization'},
{'customers_affected': '9.8 million',
'industry': 'Telecommunications',
'location': 'Australia',
'name': 'Optus',
'type': 'Corporation'},
{'customers_affected': '480,000',
'industry': 'Healthcare',
'location': 'Australia',
'name': 'Medibank',
'type': 'Corporation'},
{'customers_affected': '3 million',
'industry': 'Financial Services',
'location': 'South Africa',
'name': 'TransUnion',
'type': 'Corporation'},
{'customers_affected': '274,000',
'industry': 'Government',
'location': 'Dubai',
'name': 'Dubai Land Department',
'type': 'Government Agency'}],
'attack_vector': ['Unsecured Databases',
'Third-Party Vendors',
'Malware',
'Stolen Credentials',
'API Vulnerabilities'],
'data_breach': {'data_exfiltration': ['Yes'],
'number_of_records_exposed': ['2.7 million',
'115 million',
'180 million',
'1 billion (alleged)',
'4.5 million',
'815 million (alleged)',
'885 million',
'500,000',
'9.8 million',
'480,000',
'3 million',
'274,000'],
'personally_identifiable_information': ['Yes'],
'sensitivity_of_data': ['High'],
'type_of_data_compromised': ['National ID Numbers',
'Biometric Data',
'Passport Details',
'Payment Information',
'Health Records',
'Genetic Data',
'Mobile Subscriber Records',
'Property Ownership Records']},
'description': 'Recent years have seen a surge in massive data leaks, '
'exposing the personal records of billions worldwide from '
'national ID databases to airline, banking, and health '
'systems. These incidents span multiple countries, often '
'involving government agencies, third-party vendors, or '
'unsecured databases, with some leaks remaining unverified or '
'disputed.',
'impact': {'brand_reputation_impact': ['High'],
'data_compromised': ['National ID Numbers',
'Biometric Data',
'Passport Details',
'Payment Information',
'Health Records',
'Genetic Data',
'Mobile Subscriber Records',
'Property Ownership Records'],
'identity_theft_risk': ['High'],
'legal_liabilities': ['Regulatory Fines', 'Legal Actions'],
'payment_information_risk': ['High'],
'systems_affected': ['Government Databases',
'Telecom Systems',
'Airline Reservation Systems',
'Banking Systems',
'Healthcare Systems',
'Digital Wallets']},
'initial_access_broker': {'data_sold_on_dark_web': ['Yes']},
'investigation_status': ['Ongoing', 'Unverified', 'Disputed'],
'lessons_learned': 'These incidents underscore the global scale of data '
'vulnerabilities, affecting individuals, corporations, and '
'governments alike. The risks include identity theft, '
'financial fraud, and targeted disinformation campaigns, '
'especially when biometric or genetic data is exposed.',
'motivation': ['Financial Gain',
'Disinformation',
'Cyber Espionage',
'Identity Theft'],
'post_incident_analysis': {'root_causes': ['Unsecured Databases',
'Third-Party Risks',
'Human Error',
'API Vulnerabilities']},
'references': [{'source': 'Dark Web Listings'},
{'source': 'Journalistic Investigations'},
{'source': 'Government Probes'}],
'regulatory_compliance': {'fines_imposed': ['$500,000 (First American '
'Financial)'],
'legal_actions': ['Yes'],
'regulations_violated': ['Data Protection Laws']},
'threat_actor': ['Hackers',
'Pro-Russian Hackers',
'Initial Access Brokers',
'Insider Threats'],
'title': 'Global Data Leaks Expose Billions of Records Across Governments and '
'Corporations',
'type': ['Data Leak', 'Data Breach'],
'vulnerability_exploited': ['Unsecured APIs',
'Human Error',
'Server Compromise',
'Third-Party Risks']}