Guide
Recent data breaches: should you change your password?
Summary. Each entry is a breach or password event made public in recent months, with what it exposed in the words of its own source. If a breach included your password, change it, and change it on every other site where you used it. A password manager makes one password per site possible. Compare password managers
October 2026
22 October 2026: Capcom: CAPCOM ID email addresses
Capcom says 11,774,247 records of email addresses and system IDs were exposed, with more detail for 43 of them, and that passwords were changed without permission on 196 accounts. Capcom says it has not confirmed that passwords set by customers were compromised.
"Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves."
What to do. If you have a CAPCOM ID, check that you can still sign in, and change the password. Expect emails that pretend to be from Capcom, because the leak was mostly email addresses.
20 October 2026: UK regulator: a test account with the password 'Password1'
The UK Information Commissioner's Office reprimanded two Welsh organisations after a ransomware attack in 2024. The ICO says a 12-year-old test account was protected by 'Password1', and that data on 3,300 people, most of them children, was taken.
"the 'Test2' account was protected by the password 'Password1'"
What to do. Look for old accounts you no longer use, and close them or give them a long, unique password. A weak password on a forgotten account is still a way in.
September 2026
16 September 2026: Gyazo: about 23.6 million user records, including password hashes
Helpfeel, the company behind the screenshot service Gyazo, says about 23.62 million records of user data were disclosed, and lists password hashes, email addresses and login session IDs among them. Helpfeel told all users to change their passwords.
"approximately 23.62 million records containing data related to Gyazo users were disclosed without authorization"
What to do. If you use Gyazo, change its password. If you used the same password anywhere else, change it there too, starting with your email.
13 September 2026: Chess.com: millions of records said to come from it
Have I Been Pwned added millions of records that were posted online in August 2026 and said to come from Chess.com. Have I Been Pwned lists names, email addresses, usernames and locations, and no passwords.
"In August 2026, millions of records allegedly sourced from Chess.com were posted online"
What to do. Passwords are not listed, so the main risk is emails that use your name and username to look real. You can search your email address on Have I Been Pwned.
5 September 2026: Mathspace: about 1.08 million student, parent and staff accounts
Mathspace, a maths learning platform, says only users in Australia and New Zealand were affected, and that names, email addresses and account details of 1,079,819 users were exposed. Mathspace says passwords and other login credentials were not exposed.
"The exposed information included names and email addresses, along with account details described below."
What to do. Mathspace says it is not requiring a password reset. Watch for emails that pretend to be from a school or from Mathspace.
About this log
We add entries each month. Each comes from the organisation's own notice, a regulator, or the breach record at Have I Been Pwned, and each quote was read on that page on the date shown. An entry here does not mean your own account was affected. What to do if your password is in a breach