September brought another wave of major data breaches, with millions of people affected across healthcare, transportation, government, identity verification and developer platforms. This past month’s incidents show just how varied the attack surface has become, from exposed cloud databases and compromised third-party accounts to leaked credentials sitting in public repositories for years. The common thread is the same: sensitive data is moving across more systems, vendors and environments than ever before, and attackers are finding the gaps between them. 

Here are some of the biggest data breaches disclosed in September 2026.

3 Million Exposed in Major U.S. Military Data Breach

A data breach involving the U.S. Defense Manpower Data Center exposed the personal information of more than 3 million people connected to the military. Unauthorized users reportedly had access to the system for nearly a year, from October 2025 until a vulnerability in its file-sharing system was discovered and patched in July 2026. The exposed records included names, contact information, dates of birth, Social Security numbers, military job details and other sensitive information belonging to nearly 2.8 million living individuals and 294,000 deceased individuals. The Pentagon said there is currently no evidence that the stolen information has been misused, though it has not disclosed who accessed the data or why some of the information was stored unencrypted. Those affected are being offered 12 months of credit monitoring and identity recovery services.

220 Million Travel Records Exposed in Massive Vietnam-Linked Database

An exposed database linked to Vietnam was found containing roughly 220.8 million passenger and crew travel records dating from 2017 to 2026. The data included passport numbers, names, dates of birth, nationalities, flight details, seat numbers, baggage references and other sensitive travel information. Researchers at Kinryū Labs traced the system to infrastructure in Hanoi and said the exposure appeared to result from multiple security misconfigurations, although they could not confirm which organization operated the database. The records covered travelers from numerous international airlines, meaning people from many countries may have been affected, though the total reflects travel records rather than unique individuals. The database was secured in June 2026, but without access logs, researchers could not determine whether the information had been copied before it was taken offline.

More Than 543,000 Valid Credentials Found Exposed on GitHub

Security researchers found more than 543,000 still-valid credentials exposed across public GitHub repositories, including API keys, access tokens and cloud service credentials. Truffle Security said many of the secrets had remained publicly accessible for years, with a median exposure time of 784 days and some dating back to 2009. Nearly 200,000 of the credentials were exposed after GitHub made Push Protection available by default, although more than half fell into secret categories the feature does not currently block. The findings included tens of thousands of active Google Cloud service account credentials, highlighting how long-lived secrets can remain usable even after being committed to public code. Researchers recommended rotating exposed credentials immediately, reviewing repository history and applying automatic expiration wherever possible.

Times Car Breach Exposes Personal Data of 6.6 Million Users

Japanese car-sharing provider Times Car confirmed that a cyberattack exposed information belonging to around 6.6 million current and former users. The compromised data included names, addresses, contact details, dates of birth, driver’s license information, identity verification documents and account credentials. The company said passwords were stored in a non-recoverable form and that credit card information was not affected. So far, there is no evidence that the stolen data has been publicly leaked, but Times Car has warned customers to be alert for phishing emails, texts and calls. The company is continuing its forensic investigation and plans to notify affected users in stages.

IDScan Breach Puts 153 Million Driver’s License Scans Up for Sale

Identity verification provider IDScan confirmed a breach after hackers began offering access to more than 153 million driver’s license scans tied to people in the U.S. and Canada. The exposed data reportedly also included more than 10 million ID cards, over 3 million travel or international documents, and hundreds of thousands of medical cards. IDScan said an unauthorized party may have accessed or copied customer information stored in its cloud platform, including names and government-issued ID numbers. The scale and sensitivity of the breach make it especially significant because government-issued IDs can be used for identity verification, account opening and other high-trust processes, and unlike passwords, these documents cannot be easily replaced or rotated. The FBI has opened an investigation, while IDScan has begun notifying affected individuals and offering credit monitoring and identity protection services.

AdaptHealth Breach Exposes Sensitive Health Data of 4.1 Million People

Healthcare provider AdaptHealth confirmed that a cyberattack exposed data belonging to more than 4.1 million people after attackers gained access to cloud-based business applications and patient systems. The compromised information may include names, contact details, demographic data, health insurance information and medical information. According to the company, the breach began after a third-party contractor’s privileged account was compromised through social engineering, giving attackers access to sensitive internal systems. The incident is particularly significant because healthcare data can be difficult to replace and may be used for identity theft, insurance fraud or highly targeted phishing. AdaptHealth said it has found no evidence so far that the stolen data has been misused and is offering affected individuals 12 months of credit monitoring and identity protection.

What These Breaches Tell Us About Third-Party Risk

The breaches in this month’s roundup highlight a growing challenge for third-party risk teams: questionnaires and external security signals can only tell you so much. Platforms such as SecurityScorecard and BitSight have helped move TPRM toward continuous external monitoring, while solutions like Whistic and Panorays have made vendor assessments, security documentation and risk workflows easier to manage. But as vendor environments become more dependent on cloud infrastructure, code and AI tools, organizations increasingly need visibility into what is happening inside those environments too. Findings combines automated assessments with inside-out telemetry across vendor cloud, code and AI environments, helping security teams validate controls with direct evidence rather than relying solely on self-reported answers or externally observable risk signals. That gives teams a more complete view of third-party risk and helps them identify changes before the next annual review.