Old Data, New Breaches: Why Retention Is Now a Privacy Risk

Old Data, New Breaches: Why Retention Is Now a Privacy Risk

Week of 19 October 2026 | Compiled by Team Paringa

This week's incidents share one theme: personal data kept in the clear for years becomes the largest single liability when an attacker gets in.

What Happened This Week

🔴 Burger King Japan: 11.18 million app user records accessed

BleepingComputer reported on 16 October that Burger King Japan suffered unauthorised third-party access between 2 and 7 October 2026. The company confirmed the intrusion on 13 October and disclosed it in a press release on 15 October. The affected system manages member information for the official smartphone app.

Exposed data covers 11.18 million customer records: names, dates of birth, gender, email addresses, phone numbers and order history. The company says the server did not hold credit card numbers and it has found no evidence that credentials were accessed. It blocked access from the source, reported the breach to Japan's Personal Information Protection Commission, and warned customers about phishing emails, SMS messages and calls impersonating the brand.

How the attackers got in has not been disclosed, and investigations with external security experts continue. The notable detail is scale relative to footprint: Burger King has around 350 sites in Japan, yet the app database held more than 11 million profiles. Loyalty and order data accumulates quietly, and it is exactly the material that makes follow-on phishing convincing.

Sources: BleepingComputer

A customer-facing app should not hold names, birth dates and phone numbers in readable form in the system the app talks to. Holding identifiers in a vault and giving the application tokens means a compromised app back end yields tokens rather than a marketing-ready list of people. Ask your teams this week which databases behind customer apps contain raw PII, and whether the order-history or profile tables really need it. Where they do not, tokenise before the next quarter's roadmap fills up.

🔴 UK Legal Aid Agency: stolen records go back to 1978

BleepingComputer reported on 15 October that the Legal Aid Agency, an executive agency of the Ministry of Justice, published an update on its April 2025 breach, first disclosed in early May 2025. Analysis shows the earliest verified stolen record dates from 1978. Around 250,000 records predate 2007, mostly from the 1990s and 2000s, though most of the data covers January 2007 to 16 May 2025.

The categories are sensitive. Applicant and recipient data from 2010 onward includes contact details, dates of birth, national ID numbers, criminal history, employment status and financial details such as debts and payments. Provider data includes contracts, office locations, financial information and LAA Online Portal credentials. The agency says around 1,250 staff and about 2,000 providers are in scope, and that pre-2007 records do not mean everyone who dealt with the system before then was affected.

The Ministry of Justice says it had already committed £20 million to upgrade the agency's digital systems before the attack and now plans more than £200 million on modernising digital services and strengthening cybersecurity. It reports no evidence that the stolen data has been published. The article does not mention any regulator investigation.

Sources: BleepingComputer

Five months of impact analysis and a £200 million remediation plan is the cost of keeping decades of records live. Retention schedules are a security control, not just a records-management task. If you hold data that no longer serves a purpose, delete it; if you must keep it, move it into a vault where criminal history and national ID numbers are tokenised and access is logged by field. Use this case with your board: the question is not whether you can be breached, but how far back the damage reaches when you are.

🟡 Daiichi Kosho contractor breach exposes around 8.6 million records

Privacy Guides' breach roundup for 9 to 15 October lists a malware infection at Nippon Columbia, a contractor for Daiichi Kosho, affecting about 8.6 million customer and employee records (the linked BleepingComputer summary says more than 8.7 million). Data taken includes full names, genders, dates of birth, email addresses and phone numbers. Daiichi Kosho disclosed the incident during the reporting week. No regulator action was mentioned, and the exact breach date was not given.

The pattern is a supplier holding a client's data in full. Third-party processors remain one of the least visible parts of the personal data estate.

Sources: Privacy Guides

Contractors rarely need raw identifiers to do their job. Review what each processor receives and whether tokenised or masked data would do. It shrinks your breach notification surface and simplifies contract terms.

What Data and Privacy Leaders Are Dealing With

Three breaches reported in one week, in Japan, the UK and through a supplier, cover roughly 20 million records before counting the Legal Aid Agency. The common failures are retention, supplier exposure and unprotected identifiers rather than exotic attack methods.

At the same time the regulatory conversation is moving to AI. IAPP headlines on 14 October included analysis comparing the ICO's expectations for AI model developers with those of the EDPB, and a piece on GDPR accuracy duties when AI generates false claims about people. Privacy teams are being asked to govern both legacy data stores and new AI pipelines with the same headcount.

Three Things Worth Watching Next Week

1. Burger King Japan investigation findings — Watch for the root cause and any action from Japan's Personal Information Protection Commission.

2. Legal Aid Agency fallout — Watch for any ICO statement or parliamentary scrutiny given the £200 million plan.

3. Supplier breach disclosures — Expect further downstream notices from the Daiichi Kosho incident.

Questions? hello@paringa.ai

Paringa helps organisations turn privacy regulation into a build-ready architecture, with Skyflow data privacy vault capabilities at the core. We focus on practical controls that satisfy regulators and keep AI projects moving. | 19 October 2026 | © Paringa Ltd