The Estonian Data Protection Inspectorate (AKI) has reported on data breach notifications received during the second quarter of 2026, presenting a summary of trends and notable cases.

In total, 66 breaches were notified, distributed between April (21), May (24), and June (21), representing a 27% increase compared to the same period in 2025. Among these notifications, 25 concerned entities in the public sector, including state bodies, local authorities, or companies under their management.

Employees of a higher education institute installed additional surveillance cameras without authorization, including one in a break room.

The failure to update the security of the Magento web platform allowed malicious third parties to access the information systems of two online stores.

The lack of update of the WordPress platform led to unauthorized access to the information system of an educational institution's online store.

A vulnerability in the online service of a public body allowed consultation of other persons' documents by modifying the identifier in the URL.

An employee of a fuel distributor was the victim of a phishing email, allowing an attacker to access his email account to send further fraudulent emails on behalf of the company.

A public body did not revoke access rights of several former employees to various national registers.

The personal device of a developer working for a travel booking company was infected by malware, compromising his professional account and exposing the company's customer data.

A secret API key of a payment solutions platform was visible in the source code of a digital marketing company's website, allowing attackers to access its clients' data.