Quick Summary
- 1.SBI, Capcom and Burger King Japan all confirmed data leaks in October 2026
- 2.Most leaks expose contact details, not passwords or card numbers
- 3.Leaked details are mostly used to make fake calls, messages and emails look real
- 4.Change your email password first, use unique passwords and turn on two-step verification
Recent Data Leaks
Confirmed leaks only, newest first, with what each organisation has said. We add new ones as they're confirmed.
State Bank of India (SBI)
Disclosed October 21, 2026- Scale:
- 3,897 customer records with personal details, found in a set of about 3.75 lakh records
- Exposed:
- Names, gender, mobile numbers, dates of birth, email and home addresses, branch and CIF identifiers, loan-related records
- Not exposed:
- Account numbers, balances, passwords, card details and OTPs aren't among the details SBI listed
- Status:
- Under investigation. SBI says affected customers have been told and their funds are safe.
Capcom (CAPCOM ID accounts)
Disclosed October 22, 2026- Scale:
- 11,774,247 CAPCOM ID records worldwide
- Exposed:
- Mainly email addresses and account identifiers, plus login details such as last login time and IP address
- Not exposed:
- Capcom says credit card and other payment details weren't affected
- Status:
- Confirmed. Capcom reset the passwords of 196 accounts that had been changed without permission and warned users about phishing.
Burger King Japan (app members)
Disclosed October 2026- Scale:
- About 11.18 million app accounts
- Exposed:
- Names, email addresses and phone numbers; some reports also list birth dates
- Not exposed:
- The company says the affected server didn't store card details
- Status:
- Confirmed and reported to Japan's data protection regulator.
What to Do After Any Data Leak
- Change your email password first: whoever controls your email can reset most of your other accounts
- Change the password for the affected service, and anywhere else you used the same one
- Turn on two-step verification for email, banking and social accounts
- Never share an OTP, PIN or password, even with someone who knows your other details
- Don't click links in messages about the leak; go to the company's website or app yourself
- Turn on transaction alerts and check your bank and card statements
- Report fraud in India on the 1930 helpline or at cybercrime.gov.in
Our free password generator creates strong, unique passwords in your browser without sending them anywhere.
Check If Your Email Was in a Leak
Have I Been Pwned is a free service that checks whether your email address appears in known data leaks. If it does, change the password for each listed service and anywhere you reused it. Not every leak is in its database, so a clean result doesn't guarantee your details were never exposed.
How Leaked Details Get Used
Most leaked details aren't used to take money directly. They're used to make the next step believable:
- Calls and messages that read out your real name, address or date of birth to sound official
- Emails that look like they come from the company that had the leak
- Trying leaked email and password pairs on other sites, which only works if you reuse passwords
- Loan or KYC offers aimed at people whose details appear in loan records
Where a VPN Fits (and Where It Doesn't)
A VPN can't prevent a leak at a company you use, because the data sits on that company's systems. What it does is encrypt your own connection: on public Wi-Fi the network can't see which sites and apps you use, and your internet provider sees only an encrypted connection. You can see what your connection reveals right now with our IP address checker, or read how a VPN works.
Data Leaks: Common Questions
Short answers about data leaks and what to do.
Keep your own connection private.
SafePassVPN encrypts your phone's connection on public Wi-Fi and mobile data, so the network you're on can't see what you do online.