Breach Watch
Latest breach by region, mapped to the rules that apply
One recent incident from each of four regions, with the local breach-notification provision and an indicative NIS2 Article 21(2) control. Updated 20 October 2026.
iRhythm Technologies (US)
A breach at the wearable cardiac-monitor maker affects 8.2 million people and may cover every user of the company's technology. The root cause has not been published.
- Applicable article
- HIPAA Breach Notification Rule, 45 CFR §164.404 (notify individuals) and §164.408 (notify HHS).
- NIS2 control (indicative)
- Art. 21(2)(i) access control and asset management; (h) encryption. Cause undisclosed, so the mapping is provisional.
ASOS (UK)
Attackers impersonated a trusted contact to obtain an employee's login credentials, then used them to reach third-party platforms. Customers received an unauthorised "ASOS HACKED" push notification. ASOS reports names and contact details exposed, with no payment-card data or passwords affected. The number of customers affected has not been confirmed.
- Applicable article
- UK GDPR Art. 33 (notify the ICO within 72 hours of awareness) and Art. 32 (security of processing).
- NIS2 control (indicative)
- Art. 21(2)(g) cyber hygiene and training; (j) multi-factor authentication; (d) supply chain security for the third-party platforms.
South Korean financial institutions
The Financial Services Commission disclosed attacks on several institutions. One breach exposed an outsourced developer's personal data and another led to customer data theft; reporting puts the total at about 68,000 people. Recorded Future links the activity to an AI-assisted threat actor, TAG-217, using the ARTEX framework.
- Applicable article
- Personal Information Protection Act (PIPA) Art. 34, breach notification to data subjects and the PIPC/KISA.
- NIS2 control (indicative)
- Art. 21(2)(d) supply chain security; (e) vulnerability handling; (a) risk analysis.
Saudi Arabia patient data
A patient-data breach from Saudi Arabia was posted on the DarkForums cybercrime forum. The victim organisation and scale are not confirmed. A separate, also unverified, claim from 28 September names Prince Sultan Military Medical City.
- Applicable article
- Saudi Personal Data Protection Law (PDPL) Art. 20, notification to SDAIA within 72 hours.
- NIS2 control (indicative)
- Art. 21(2)(i) access control; (a) risk analysis; (f) effectiveness assessment. Provisional, as the cause is unknown.
Is your AI and data estate breach-ready?
Talk to us about governance, assurance and incident readiness.