This report compiles major data breach incidents publicly disclosed between June 1 and June 30, 2026. Incidents are de-duplicated and selected on the basis of disclosure date (the date the incident was publicly reported), not the date the breach actually occurred. All incidents involving more than one million affected individuals are included, along with a selection of secondary incidents that are strategically significant for their attack technique, target profile, or wider implications.

The Attack Vector taxonomy used in this report follows the categorization framework adopted by the IBM Cost of a Data Breach Report. Each Attack Vector is mapped to the corresponding MITRE ATT&CK techniques to provide threat-informed context for defenders.

---

Executive Summary

June 2026 was defined by three structural themes: the industrialization of extortion-driven data theft against enterprise SaaS and ERP platforms, the compounding risk of shared and third-party infrastructure, and the recurring failure to protect developer credentials — hardcoded cloud keys and OAuth tokens — that gate access to entire data estates. South Korea’s Tving suffered the month’s largest disclosed breach (19.53 million individuals) after an AWS access key left hardcoded in a GitHub repository let an attacker query its database directly. A single Oracle PeopleSoft zero-day (CVE-2026-35273) exploited by ShinyHunters cascaded across more than 100 organizations, while a shared email backend at Japan’s KDDI turned one software flaw into a 14-million-account exposure across six ISPs. The insurance sector was hit repeatedly, with Aflac Japan, AssuranceAmerica, and the NAIC all disclosing incidents in the same month. The period also surfaced a new class of AI-specific risk: hackers hijacked roughly 20,000 Instagram accounts simply by instructing Meta’s AI support chatbot to reset passwords.

Top Incidents by Exposure Volume

Rank	Incident	Scale	Sector	Disclosed
1	Tving (CJ ENM)	19.53M	Media / OTT Streaming	Jun 3
2	KDDI (six Japanese ISPs)	14.22M	Telecommunications	Jun 23
3	Aflac Life Insurance Japan	4.38M	Insurance	Jun 30
4	Texas Parks & Wildlife Dept. (TPWD)	3.09M	Government / Public Sector	Jun 12
5	Sysco Corporation	2.69M (61M records claimed)	Food Distribution	Jun 16
6	DentaQuest (Sun Life)	2.6M	Healthcare / Dental Benefits	Jun 2
7	California Water Service (Cal Water)	2M	Utilities / Water	Jun 11
8	Xsolis	1.4M	Healthcare Technology (AI)	Jun 5
9	iFood	1.2M (43.8M claimed)	Food Delivery	Jun 3
10	AssuranceAmerica	1.1M+	Insurance	Jun 17

Note on TikTok: A threat actor claimed 2.4 billion TikTok records on June 11, but security researchers assessed the data as most likely repackaged infostealer logs rather than a direct breach of TikTok. Because the claim is unverified and disputed at the source, it is excluded from the ranking above and discussed in the body as a claim-only event.

Most Frequently Exposed Data Types

The categories below are ordered by the total volume of exposure across the month’s incidents (confirmed figures only). Totals overlap, since a single incident typically exposes several data types at once.

1. Names and contact information — roughly 52 million individuals. Email addresses, phone numbers, and physical/service addresses were present in all ten of the million-plus incidents (Tving 19.53M, KDDI 14.22M, Aflac Japan 4.38M, TPWD 3.09M, Sysco 2.69M, DentaQuest 2.6M, Cal Water 2M, Xsolis 1.4M, AssuranceAmerica 1.1M+, iFood 1.2M).
2. Account credentials — roughly 34 million accounts. Email-password pairs at KDDI (14.22M, protection level undisclosed), one-way-hashed passwords for 19.53M Tving users, and roughly 20K hijacked Instagram accounts. Credentials at this scale feed directly into credential-stuffing and account-takeover campaigns across unrelated services.
3. Non-rotatable identity-verification identifiers — 19.53 million individuals. Korea’s Connecting Information (CI) and Duplication Information (DI), the “digital resident-registration number” derived from the national ID, exposed in the Tving breach. Unlike a password, these cannot be reissued once leaked, making this the most durable harm of the month despite coming from a single incident.
4. Government-issued identifiers — roughly 9.7 million individuals. Driver’s license and passport numbers (TPWD 3.09M), government-issued IDs (DentaQuest 2.6M), Social Security numbers (Xsolis 1.4M; AssuranceAmerica 1.1M+, plus driver’s license and tax ID), and Brazilian CPF taxpayer numbers (iFood 1.2M).
5. Insurance and financial account information — roughly 8.3 million individuals. Policy, claims, and account data at Aflac Japan (4.38M, including premium-transfer bank accounts for 230K), health-insurance and Medicaid IDs at DentaQuest (2.6M), and policy/claims data at AssuranceAmerica (1.1M+). Tving’s refund bank-account numbers (19.53M) were also taken but were stored encrypted.
6. Health and medical information — roughly 4 million individuals. Health-insurance details and medical-treatment records (DentaQuest 2.6M, Xsolis 1.4M) and pseudonymized clinical-trial data for ~11,500 Novo Nordisk trial participants.
7. Enterprise CRM and support-case data — 2.69 million confirmed at Sysco, plus unquantified exposure across the dozen-plus victims of the Klue/Salesforce campaign (LastPass and others) and ServiceNow instance data. Low in headline volume, but support-case history is prime raw material for convincing spear-phishing.
8. Corporate and intellectual property — measured in terabytes rather than people: source code, drug compound libraries, and trained AI models at Novo Nordisk (~1.3 TB) and Apple/Tesla manufacturing documents at Tata Electronics (630 GB).

Leading Attack Vectors

Vectors are ranked by the total confirmed exposure of the incidents in which each vector played a defining role. Because most incidents chain multiple vectors (e.g., a supply-chain foothold followed by credential abuse), an incident can appear under more than one category and the totals overlap.

1. Compromised credentials — roughly 24.8 million confirmed, the largest vector of the month by volume. Tving’s 19.53M is the one large incident with a confirmed credential vector (an AWS access key hardcoded in a GitHub repository). The Sysco (2.69M) and DentaQuest (2.6M) datasets are grouped here because both are attributed to ShinyHunters, whose 2026 campaign characteristically abuses stolen or fraudulently authorized credentials — but neither company disclosed its specific initial-access method, so the attribution rather than a confirmed vector places them in this category. Also credential-driven, though unquantified: FulcrumSec’s stolen GitHub token at Novo Nordisk, the Icarus group’s abuse of a single legacy OAuth credential at Klue to reach a dozen-plus vendors’ Salesforce environments, and the plaintext admin credentials used to pivot inside Cal Water.
2. Third-party vendor and supply chain compromise — roughly 21.4 million exposed through a vendor, shared platform, or SaaS integration rather than the victim’s own perimeter. KDDI’s shared multi-tenant email backend propagated one flaw to six ISPs (14.22M); TPWD’s license vendor (3.09M); Sysco’s Salesforce environment (2.69M); and Xsolis, itself a vendor, cascading to 600+ hospital clients (1.4M). Add the unquantified Klue/Salesforce campaign and the 100+ organizations running the exploited PeopleSoft software, and third-party exposure rivals credentials as the month’s defining structural risk.
3. Vulnerability exploitation — roughly 16.7 million. KDDI’s third-party software flaw (14.22M), Cal Water’s internet-exposed RTKBase instance (2M customer base), the Oracle PeopleSoft zero-day CVE-2026-35273 across 100+ organizations (individual counts mostly undisclosed; ~455K confirmed at the University of Nottingham alone), and ServiceNow’s unauthenticated API endpoint (scale undisclosed).
4. Others / undisclosed initial vector — roughly 6.7 million. Aflac Japan (4.38M), AssuranceAmerica (1.1M+, an employee-targeted intrusion whose specific method was not disclosed), and iFood (1.2M) confirmed breaches without disclosing the entry method, as did London Hydro and Tata Electronics. Roughly a seventh of the month’s confirmed exposure has no publicly attributed root cause — itself a transparency problem for defenders trying to learn from these incidents.
5. Phishing — Xsolis (1.4M) is the one large incident this month with a confirmed phishing initial-access vector. (AssuranceAmerica’s 1.1M+ employee-targeted intrusion is often assumed to be phishing, but its method was not disclosed, so it is not counted here.) Phishing remains the standing entry point for healthcare and insurance intrusions even when it is a small share of headline volume.
6. System error / misconfiguration and denial-of-service — largely unquantified this month: CBSE’s misconfigured cloud storage bucket and the June 2 DoS-plus-data-theft wave (~2M students claimed, disputed), and the authentication misconfiguration at the root of the ServiceNow exposure. AI support-agent abuse (Meta/Instagram, ~20K accounts) contributed the smallest confirmed volume of any vector, but is the fastest-emerging class and scales with AI adoption.

Notable Attack Patterns

Patterns are ordered by the confirmed exposure volume attached to each; the final entries carry the smallest headline numbers but the fastest-growing strategic weight.

• Hardcoded developer credentials as the single point of catastrophic failure (exposure: 19.53M+, the month’s largest). Tving’s breach and a parallel Korean incident (Day1Company) both traced back to cloud credentials left hardcoded in GitHub source code. Once an attacker retrieves an AWS access key from a repository, the database and its encryption are irrelevant — the key opens the front door with legitimate privileges. The recurrence of this decades-old anti-pattern (echoing Toyota’s 2017–2022 T-Connect exposure) shows that secrets management, not perimeter defense, is where these breaches are won or lost.
• Shared-infrastructure blast radius (exposure: 14.22M). KDDI’s breach demonstrated how a single vulnerability in a consolidated, multi-tenant email platform instantly becomes the problem of every downstream ISP — one flaw, six providers, 14 million accounts.
• IT-to-OT pivots in critical infrastructure (exposure: ~2M customers at risk; 5 GB leaked). At Cal Water, an internet-exposed GPS correction tool (RTKBase) with plaintext credentials served as the pivot point into the customer billing environment, underscoring weak segmentation between operational support tools and sensitive data systems in the utility sector — and, given Handala’s history of follow-on wiper attacks, a possible precursor to worse.
• ERP as the new frontier for mass extortion (exposure: 100+ organizations; individual counts largely undisclosed, ~455K confirmed at one university alone). ShinyHunters’ pivot from SaaS social engineering to a server-side zero-day in on-premises Oracle PeopleSoft (CVE-2026-35273) marked a shift toward directly exploiting data-rich enterprise applications at scale, hitting 100+ organizations before Oracle’s advisory.
• OAuth tokens as the master key to SaaS supply chains (exposure: a dozen-plus vendors’ Salesforce datasets, unquantified). The Klue incident showed how a single dormant OAuth credential — created for a 2022 pilot and never revoked — let the Icarus group harvest tokens for Klue’s customers and pivot into the Salesforce environments of LastPass, BeyondTrust, HackerOne, Recorded Future, Tanium, and others at once. This is the direct successor to the Salesloft/Drift and Gainsight campaigns: the target is no longer the enterprise, but the integration that sits between it and its SaaS platform.
• Intellectual property and AI models as extortion targets (exposure: terabyte-scale IP; ~11.5K trial participants). The Novo Nordisk and Tata Electronics incidents show extortion groups increasingly targeting trade secrets, source code, drug compound data, and even trained AI models — assets that, unlike credentials, cannot be rotated or re-secured after theft. Person-counts understate the damage: the stolen asset here is competitive position itself.
• Abuse of AI-powered support tooling (exposure: ~20K accounts — the smallest of the month, but the newest vector class). The Meta/Instagram account takeovers required no malware, no code, and no credentials — attackers simply asked an AI support assistant to add an email address and reset the password. As enterprises hand more high-trust functions to AI agents, this category’s ceiling rises with every deployment.

---

Incident Details

1. Tving (CJ ENM)

Affected organization: Tving, South Korea’s largest homegrown OTT streaming platform, operated by CJ ENM. Tving has roughly 5 million paid subscribers and 8.8 million monthly active users, and holds identity data accumulated through mergers (Seezn, Wavve) and partner integrations (CJ ONE, telecom bundle plans).

Impact and significance: This was the single largest disclosed breach of the month and the fourth-largest personal-data breach in South Korean history (after Coupang, SK Telecom, and Nate/Cyworld). The government’s investigative panel put the final count at 19,530,000 individuals — nearly four times Tving’s paid-subscriber base, prompting a regulatory inquiry into why so much data (including that of withdrawn and dormant accounts, which the Personal Information Protection Act requires be destroyed) was retained. The exposure is especially damaging because it included Connecting Information (CI) and Duplication Information (DI) — Korea’s national-ID-derived identity-verification identifiers, often called the “digital resident-registration number,” which cannot be changed once compromised and can be combined with other data to enable identity theft, account takeover, and financial fraud. The incident also drew scrutiny because Tving’s information-security investment had fallen roughly 20% year over year, and because the intrusion was not detected by its own monitoring but only surfaced through a database CPU-utilization spike.

Threat actor: Not attributed (an unidentified external attacker).

Attack overview: According to Tving’s incident report to Korea’s KISA, the attacker obtained an AWS access key that had been hardcoded into source code in a GitHub repository, then used that key to connect directly to the database server and execute SQL queries (read, modify, delete). The intrusion began at 18:01 on May 30; Tving noticed a DB-server CPU spike to 100% and confirmed unauthorized access and query execution, recognized the incident at 15:09 on May 31, filed with KISA at 15:08 on June 1 (one minute inside the 24-hour statutory deadline), and disclosed to users on June 3. Remediation included revoking the compromised AWS access key, deactivating the attacker’s credentials, removing and rotating the hardcoded GitHub credentials, and changing AWS access-control policies. A parallel Korean incident at education firm Day1Company, disclosed June 11, stemmed from a similar theft of a GitHub master-account key, underscoring a systemic secrets-management problem.

Attack Vectors: – Compromised credentials (T1078 – Valid Accounts; T1552.001 – Unsecured Credentials: Credentials In Files): An AWS access key hardcoded into GitHub-hosted source code was retrieved by the attacker and used to authenticate to the database with legitimate, high-privilege access. This is the confirmed initial-access vector.

How the AWS key was exposed in the GitHub repository (public repository, leaked developer account, or otherwise), and whether the attacker took any further action beyond the database queries, were not disclosed. The full attack chain beyond initial access remains under investigation.

Data exposed: User ID, name, date of birth, gender, CI (Connecting Information) and DI (Duplication Information), mobile phone number (last 4 digits encrypted), email (local-part encrypted), refund bank-account number (encrypted), password (one-way hashed), and service-usage information.

Scale: 19,530,000 individuals (final government tally; initial provisional estimate was 13 million). Investigation ongoing.

---

2. KDDI Corporation (six Japanese ISPs)

Affected organization: KDDI Corporation, one of Japan’s largest telecommunications operators, plus five additional ISPs that rely on its shared email system: NIFTY, BIGLOBE, J:COM (JCOM), STNet (Pikara), Chubu Telecommunications (Commufa), and KDDI Web Communications.

Impact and significance: The breach exposed the email addresses and passwords for up to 14.22 million accounts across six providers — the second-largest disclosed exposure of the month. Its significance lies in the shared-infrastructure architecture: because KDDI operates a centralized email backend used by multiple ISP subsidiaries and partners, a single flaw in one component immediately compromised all six tenants at once. This is the same structural logic that amplified the Kaseya and MOVEit incidents. KDDI has not named the vulnerable third-party software or specified what percentage of passwords were stored in plaintext versus hashed form, leaving the true credential risk uncertain.

Threat actor: Not publicly attributed.

Attack overview: KDDI detected unauthorized access to its shared email system on June 17 and immediately blocked the attacker and modified the system. Investigation determined that attackers exploited a vulnerability in unnamed third-party software integrated into the email platform. KDDI notified Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications and disclosed publicly on June 23.

Attack Vectors: – Vulnerability exploitation (T1190 – Exploit Public-Facing Application): KDDI stated that attackers exploited a flaw in third-party software integrated into its email system. The software was not named, no CVE was cited, and how the exploitation led to exposure of up to 14.22 million credentials was not disclosed. – Third-party vendor & supply chain compromise (T1195 – Supply Chain Compromise; T1199 – Trusted Relationship): The vulnerable component was third-party software embedded in a shared platform, and the shared architecture propagated the compromise across six separate ISP operators simultaneously.

Data exposed: Email addresses and passwords (some stored in hashed or encrypted form; the proportion in plaintext was not disclosed). The figure includes current, former, and long-inactive accounts.

Scale: Up to 14.22 million email accounts (worst-case estimate; investigation ongoing).

---

3. Aflac Life Insurance Japan

Affected organization: Aflac Life Insurance Japan Ltd., a wholly owned subsidiary of Aflac Incorporated (the largest supplemental insurance provider in the U.S.).

Impact and significance: Attackers exfiltrated personal data for approximately 4.38 million customers and agents from Aflac Japan’s policyholder portal, including premium-transfer bank account information for roughly 230,000 individuals. This is the second major Aflac breach confirmed in roughly a year (following a June 2025 incident at Aflac’s U.S. business affecting more than 22 million individuals) and adds to a wave of attacks against the insurance sector in June. The intrusion persisted for ten days before detection.

Threat actor: Not publicly attributed at time of disclosure.

Attack overview: Aflac Japan said an unauthorized third party accessed certain systems multiple times between June 15 and June 25, 2026. The company discovered the intrusion on June 25 after a surge in access traffic increased system load, then suspended affected systems to contain it. Aflac disclosed the incident in a Form 8-K filed with the U.S. SEC on June 30. The incident was confined to Aflac Japan and did not affect U.S. operations.

Attack Vectors: – Not disclosed. Aflac Japan attributed the breach to repeated unauthorized access to its policyholder portal between June 15 and June 25 but did not disclose the initial-access method or any subsequent steps in the attack.

Data exposed: Names, addresses, phone numbers, dates of birth, gender, security information, and insurance account information; premium-transfer bank account information for approximately 230,000 individuals. No credit card data was accessed.

Scale: Approximately 4.38 million customers and agents.

---

4. Texas Parks & Wildlife Department (TPWD)

Affected organization: The Texas Parks and Wildlife Department, via a third-party vendor that operates its hunting and fishing license sales system. The vendor was not named.

Impact and significance: The breach exposed data for 3,087,721 individuals who purchased hunting and fishing licenses, including highly sensitive government identifiers — driver’s license information and passport numbers. Its significance lies in the government third-party vendor exposure and the nature of the data: driver’s license and passport numbers cannot be changed like a password, creating a long-tail identity theft risk. Threat intelligence reporting linked the same threat actor to a similar breach at Virginia’s Department of Wildlife Resources, suggesting a small number of shared SaaS vendors serving multiple state wildlife agencies represent a systemic exposure.

Threat actor: Not officially confirmed. A dark-web actor using the handle “Wikkid” reportedly advertised a TPWD dataset before official disclosure.

Attack overview: Texas Cyber Command detected the incident and TPWD was notified on May 13, 2026. TPWD published a formal Notification of Data Security Incident on June 12 and made a broader public disclosure on June 18. The investigation did not determine the initial compromise date, the entry method, or the duration of unauthorized access.

Attack Vectors: – Third-party vendor & supply chain compromise (T1195 – Supply Chain Compromise; T1199 – Trusted Relationship): The attacker reached customer profile data through the third-party vendor that processes license sales. How the vendor itself was breached — the initial-access method, the compromise date, and the dwell time — was not determined or disclosed.

Data exposed: Driver’s license information, passport numbers (where provided), email addresses, phone numbers, and residential addresses. TPWD stated that Social Security numbers, dates of birth, and financial/credit card information were not obtained, and that records of individuals under 18 were not involved.

Scale: 3,087,721 individuals.

---

5. Sysco Corporation

Affected organization: Sysco Corporation, the world’s largest food distribution company, operating 340+ distribution facilities and supplying roughly 750,000 customer locations (restaurants, healthcare facilities, schools, and hospitality businesses) across 10 countries.

Impact and significance: The headline figures for this incident measure two different things and carry very different levels of verification. ShinyHunters’ leak-site listing (June 16) claimed “over 61 million Salesforce records across several tables” — a raw row count spanning contacts, cases, tasks, and feedback entries, posted with no proof samples. Have I Been Pwned, after the group published the actual dataset, deduplicated it to 2,691,852 unique email addresses belonging to staff and customers — the only independently verified figure, and the best available proxy for distinct affected individuals. HIBP is the de facto industry standard for breach verification (its data feeds are used by the FBI and the UK NCSC, and services such as Firefox Monitor and 1Password build on it); before loading a dataset, its process checks the data against prior breaches to rule out recycling and verifies samples with affected subscribers before attributing it to a source. The HIBP figure should nonetheless be read as a floor rather than a ceiling: it counts only unique email addresses in the dataset the group chose to publish, so records without an email address — or any stolen data withheld from publication — are not reflected. The two figures are not mathematically contradictory (a CRM serving 750,000 customer locations can plausibly hold 61 million rows tied to ~2.7 million unique contacts), but the 61 million figure exists solely on the attacker’s say-so, and ShinyHunters has a documented pattern of inflated claims: its 42-million-record Charter claim in May deduplicated to 4.9 million on HIBP, and in the NAIC case this same month the group itself revised its claim downward, blaming an AI-generated misinterpretation of the data. Sysco has made no public statement, filed no incident 8-K (its June–July SEC filings concern the Jetro Restaurant Depot merger), and did not respond to media inquiries about either the Qilin or ShinyHunters claims. The proposed class action filed June 24 cites the 61 million figure, but this repeats the attacker’s claim rather than establishing it. The incident is also notable because Sysco was named by two separate threat operations in quick succession — the Qilin ransomware gang claimed a network breach in early May and published samples (customer pricing lists, delivery invoices, tax documents dated 2021–2026), weeks before the ShinyHunters listing — suggesting multiple unresolved access issues across different attack surfaces (on-premises infrastructure vs. SaaS CRM).

Threat actor: ShinyHunters (also tracked as UNC6240). Separately, the Qilin ransomware gang made an earlier, distinct claim in May.

Attack overview: The confirmed facts are limited: ShinyHunters listed Sysco on June 16 with a June 18 contact deadline, then published a dataset after the demand went unmet, which HIBP indexed on June 28. The initial-access method for Sysco was not disclosed and has not been confirmed. As background on the actor (not as a description of the Sysco intrusion), ShinyHunters’ broader 2026 Salesforce campaign has typically used one of two entry methods — voice-phishing employees into authorizing a malicious connected app to mint an OAuth token, or scanning code repositories for committed API keys and tokens — followed by REST API enumeration and looped queries to bulk-exfiltrate CRM records.

Attack Vectors: – Compromised credentials (Others — specific vector not disclosed): Sysco did not disclose how the data was accessed. The incident is grouped under credential abuse because it is attributed to ShinyHunters, whose campaign characteristically abuses OAuth tokens and dormant API credentials against Salesforce — but this is an attribution-based inference, not a confirmed vector for Sysco. – Third-party vendor & supply chain compromise (T1199 – Trusted Relationship): The published data reportedly originated from Salesforce, a trusted third-party SaaS platform; this too rests on the leaked dataset and the group’s known targeting rather than a Sysco disclosure.

Data exposed: Names, email addresses, usernames, phone numbers, physical addresses, employers, internal job titles, internal account IDs, and customer feedback records — a corporate contact directory at scale. Because the affected population is overwhelmingly business contacts, the primary downstream risk is business email compromise, supplier/invoice fraud, and highly credible spear-phishing referencing real Sysco accounts and orders, rather than consumer identity theft.

Scale: 2,691,852 confirmed unique email addresses per HIBP deduplication of the published dataset (the attacker claims 61 million Salesforce records; note the units differ — the claim counts table rows, the confirmed figure counts unique individuals — and the claim remains unverified by Sysco or any third party).

---

6. DentaQuest (Sun Life)

Affected organization: DentaQuest, one of the largest dental and vision benefits administrators in the United States and a subsidiary of Sun Life Financial. It administers Medicaid, CHIP, Medicare Advantage, and commercial plans, serving roughly 32–35 million Americans.

Impact and significance: The breach exposed personal and health information for approximately 2.6 million individuals. Its significance is heightened by the population affected: DentaQuest’s membership base includes a large proportion of Medicaid enrollees — low-income individuals and families who often have limited access to credit-monitoring tools and fewer resources to respond to identity theft. If confirmed at scale, the incident ranks among the largest U.S. health-data breaches of the year, and it drew scrutiny over the delay between the underlying compromise and public notification.

Threat actor: ShinyHunters.

Attack overview: ShinyHunters listed DentaQuest on its dark-web leak site in May 2026, claiming to have stolen more than 234 GB of data. After negotiations reportedly failed, the group published the full 234 GB archive. DentaQuest confirmed the breach on June 2, acknowledging unauthorized access to a limited portion of its network. The specific initial-access method and the exfiltration technique were not disclosed by DentaQuest.

Attack Vectors: – Third-party vendor & supply chain compromise / Compromised credentials (Others — specific vector not disclosed): DentaQuest did not disclose how the attacker gained access. ShinyHunters campaigns have historically relied on stolen or fraudulently authorized credentials and OAuth tokens to reach cloud/SaaS data, but this pattern has not been confirmed for the DentaQuest incident specifically, so it is not asserted here as the established vector.

Data exposed: Names, email addresses, physical/mailing addresses, phone numbers, dates of birth, gender, government-issued IDs, health insurance information, and Medicaid IDs. Much of the data appeared in healthcare enrollment files (ASC X12 transaction sets).

Scale: Approximately 2.6 million individuals (2.6 million unique email addresses per HIBP).

---

7. California Water Service (Cal Water)

Affected organization: California Water Service (Cal Water), one of the largest investor-owned water utilities in the United States, serving approximately two million customers across roughly 100 California communities.

Impact and significance: The Iran-linked group Handala published a 5 GB proof-of-concept data dump exposing customer billing PII and, critically, plaintext administrative credentials for an internal RTKBase GPS-correction network. The incident is significant less for its raw record count than for what it reveals about critical-infrastructure security: an internet-exposed, low-criticality operational support tool became the pivot point into the customer billing environment, exposing a dangerous lack of segmentation between operational and customer-data systems. Handala’s history of following data theft with destructive wiper attacks (as at Stryker in March 2026) means analysts treat the disclosure as a possible precursor to further action.

Threat actor: Handala (also tracked as Void Manticore / Storm-0842), assessed with high confidence as affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

Attack overview: On June 11, 2026, Handala posted a claim of compromising Cal Water and published a 5 GB dump as proof, describing it as retaliation for U.S. actions against Iran. Analysis by Dataminr identified access to two separate systems: a customer billing database and an internal RTKBase NTRIP GPS-correction network. The RTKBase instance, running on a lightweight server with its admin panel exposed on HTTP port 10000, had been operational for roughly 783 hours; its plaintext admin credentials appear to have served as the initial access or lateral-pivot point into the billing environment.

Attack Vectors: – Vulnerability exploitation / Exploit Public-Facing Application (T1190): The internet-exposed RTKBase admin panel on HTTP port 10000, deployed on minimally hardened hardware, provided the reachable entry point. – Compromised credentials (T1078 – Valid Accounts): Plaintext administrative credentials and a mountpoint-level NTRIP source password for the RTKBase platform were exposed and used as the pivot toward the customer billing database. – Lateral movement (T1021 – Remote Services): Dataminr’s analysis identifies access to two separate systems (the RTKBase network and the billing database), indicating lateral movement between them; the exact protocol and path used for the pivot were not disclosed.

Data exposed: Customer names, service addresses, phone numbers, account numbers, and payment histories from the billing database; plaintext RTKBase administrative credentials; and full enumeration of the NTRIP network IP block across seven districts. No SCADA, treatment-process, or chemical-dosing systems were confirmed affected.

Scale: Approximately 2 million customers served (Chico District confirmed affected; full scope of exposed records not independently confirmed); 5 GB dumped.

---

8. Xsolis

Affected organization: Xsolis, Inc., a Tennessee/Kentucky-based healthcare technology company that provides AI-powered utilization-management and revenue-cycle solutions (its flagship Dragonfly platform) to more than 600 hospitals, health systems, and payers.

Impact and significance: A targeted phishing attack led to the exposure of protected health information for 1,396,519 patients across multiple health systems, including Mayo Clinic, UW Medicine, Legacy Health, VHC Health, Rochester Regional Health, Carle Health, and Augusta Health. The incident highlights the AI-vendor and third-party risk model in healthcare: a single successful phishing email at a vendor cascaded into a breach affecting 1.4 million patients at multiple institutions simultaneously. The five-month gap between the January intrusion and the June disclosure drew regulatory scrutiny under HIPAA’s 60-day breach-notification requirement, and the incident is under investigation by HHS’s Office for Civil Rights.

Threat actor: Not publicly attributed. No known ransomware or extortion group has claimed the incident.

Attack overview: On January 20, 2026, an attacker gained access to a limited portion of the Xsolis environment via a targeted phishing attack. Xsolis detected the unauthorized activity on January 22 and contained it. The company filed its breach report with HHS on June 5 and disclosed publicly in early June; HHS posted the affected-individual count on June 22.

Attack Vectors: – Phishing (T1566 – Phishing): A targeted phishing attack on an Xsolis employee provided the confirmed initial access. What the attacker executed after gaining access, and how the files were exfiltrated, were not disclosed.

Data exposed: Names, addresses, dates of birth, Social Security numbers, health insurance information, and medical treatment information (varying by individual).

Scale: 1,396,519 individuals.

---

9. iFood

Affected organization: iFood, the dominant food-delivery platform in Brazil and Latin America, handling roughly 120 million orders per month for tens of millions of customers.

Impact and significance: iFood confirmed a breach affecting approximately 1.2 million users (about 2% of its customer base), exposing names and CPF numbers — Brazil’s primary personal taxpayer identifier, comparable in sensitivity to a U.S. Social Security number. The incident is significant for the dispute over its true scale: a dark-web actor claimed a far larger trove of 43.8 million records, which iFood denies, and for the disclosure timing — the company disclosed six months after the December 2025 incident, citing a Brazilian data-law exemption for breaches it judged low-risk. It is an early test of how aggressively Brazil’s ANPD will enforce disclosure obligations under the LGPD.

Threat actor: A threat actor using the alias “bacen” claimed the larger 43.8 million-record dataset on BreachForums; iFood attributes the confirmed 1.2 million exposure to an isolated December 2025 incident.

Attack overview: iFood confirmed on June 3 that a December 2025 incident exposed registration data for about 1.2 million users. The company stated the exposure was limited to registration details and found no evidence supporting the 43.8 million-record claim. Brazil’s ANPD requested explanations and is assessing the incident’s severity.

Attack Vectors: – Others (unauthorized access to a support system): iFood and Brazilian reporting (TecMundo) indicated possible unauthorized access to a support system related to iFood. The specific initial access technique was not disclosed, so this is categorized as Others pending further detail.

Data exposed: Names, phone numbers, addresses, and CPF (taxpayer ID) numbers. iFood stated that passwords, bank details, and credit card records were not compromised.

Scale: Approximately 1.2 million users confirmed (43.8 million records claimed by the threat actor, disputed by iFood).

---

10. AssuranceAmerica

Affected organization: AssuranceAmerica Managing General Agency, LLC, an Atlanta-based non-standard auto insurance managing general agency (MGA) serving higher-risk drivers through a network of roughly 9,500 agents across 14 states.

Impact and significance: State regulatory filings indicate the breach affected more than 1.1 million people across at least seven states, exposing Social Security numbers and other sensitive identifiers. The confirmed state-level figures reported in public filings are 611,046 South Carolina residents, 500,987 Texas residents, 8,950 Washington residents, 3,569 Massachusetts residents, and 272 Vermont residents (breaches were also filed with California and Nebraska without a public count), which sum to roughly 1.12 million — and because two states’ counts are not public, the true total is somewhat higher, hence the “1.1 million+” widely cited by state officials. (Note: no single nationwide total has been confirmed by AssuranceAmerica; one law firm assessed that the South Carolina figure alone may approximate the full scope, and a lone legal-tracker figure of ~6.99 million circulated but conflicts with all other reporting and is treated here as unverified.) The incident illustrates the amplified exposure of the MGA model: a breach at the platform level triggers notification and remediation obligations across the entire retail agent network feeding it, a far wider blast radius than a single-carrier breach. The attack pattern — an employee-targeted intrusion — is consistent with the leading cause of insurance-sector cyber losses in 2026. It was disclosed days after the NAIC confirmed its own Oracle PeopleSoft breach, underscoring how heavily the insurance sector was targeted in June.

Threat actor: Not publicly attributed.

Attack overview: On March 16, 2026, a cyberattack targeted a single AssuranceAmerica employee; the company detected suspicious activity the following day, March 17, and determined that an unauthorized third party had accessed its IT systems and copied data files. A review of the affected files was completed on June 15, and the company began notifying affected individuals and state regulators from June 17 onward.

Attack Vectors: – Compromised credentials (T1078 – Valid Accounts): The confirmed facts are that a targeted attack on a single employee on March 16 resulted in an unauthorized third party accessing the company’s IT systems and copying data files. Whether the employee-targeting was phishing, social engineering, or another technique was not disclosed, so the specific initial-access method is not asserted here.

Data exposed: Names, contact information, automobile insurance policy/account information, driver or vehicle information, claims information, driver’s license numbers, tax identification information, and Social Security numbers.

Scale: More than 1.1 million people across at least seven states (California, Massachusetts, Nebraska, South Carolina, Texas, Vermont, and Washington); the five publicly disclosed state counts sum to ~1,124,824, with California and Nebraska counts not public. (A lone legal-tracker figure of ~6.99 million circulated but conflicts with all other reporting and is treated here as unverified.)

---

Secondary and Strategically Significant Incidents

11. Oracle PeopleSoft Zero-Day Campaign (CVE-2026-35273) — Multiple Victims

Affected organizations: More than 100 organizations, predominantly in higher education (68% of notified organizations were universities). Confirmed or widely reported victims include the University of Nottingham (roughly 455,000 unique email addresses per HIBP), the National Association of Insurance Commissioners (NAIC), and Nissan (current and former employees in the U.S., Canada, Mexico, and Brazil).

Impact and significance: This was one of the largest multi-victim campaigns of the year and marked a strategic shift for ShinyHunters — from SaaS-focused social engineering to exploiting a server-side zero-day in on-premises and cloud Oracle PeopleSoft ERP systems. Because ERP platforms concentrate HR, payroll, finance, and personnel data, the campaign gave attackers access to unusually rich data across dozens of institutions at once. NAIC — the U.S. insurance regulators’ body — initially faced a claim of 3.1 TB stolen, which the group later revised down, blaming an AI-generated misinterpretation of the data.

Threat actor: ShinyHunters (UNC6240), per Google’s Mandiant.

Attack overview: Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273 — a critical (CVSS 9.8) unauthenticated remote-code-execution flaw in PeopleSoft Enterprise PeopleTools’ Environment Management component — as a zero-day, before Oracle published its advisory on June 10. Attackers targeted internet-exposed PSEMHUB endpoints, deployed MeshCentral agents masquerading as legitimate cloud services, ran a custom lateral-movement/defacement script, and posted stolen data to the ShinyHunters leak site starting June 9.

Attack Vectors: – Vulnerability exploitation (T1190 – Exploit Public-Facing Application): CVE-2026-35273, an unauthenticated RCE (rooted in a server-side request forgery) in the PeopleSoft Environment Management Hub, was exploited to gain server access without credentials. – Remote access software (T1219 – Remote Access Software; T1036 – Masquerading): Attackers deployed MeshCentral agents disguised as legitimate cloud services to maintain access and run commands. – Compromised credentials (T1078 – Valid Accounts): Post-exploitation, attackers used default PeopleSoft administrative accounts and fell back to SSH key-based authentication for lateral movement.

Data exposed: Varies by victim — personnel and payroll records, Social Security and other government IDs, banking and financial/tax information (Nissan); student records including passport numbers, ethnicity, disability, and fee-payment data (University of Nottingham); regulatory filing data (NAIC).

Scale: 100+ organizations; individual victim counts vary (e.g., ~455,000 email addresses at University of Nottingham).

---

12. Novo Nordisk

Affected organization: Novo Nordisk A/S, the Danish pharmaceutical giant best known for its GLP-1 weight-loss and diabetes drugs (Ozempic, Wegovy).

Impact and significance: While the number of affected individuals is comparatively small, the incident is strategically significant for the nature of the assets stolen: source code, proprietary drug-compound libraries, and — notably — trained internal AI models. These are assets that, unlike credentials, cannot be rotated or re-secured after theft. The breach illustrates the growing targeting of intellectual property and AI models as extortion leverage, a data-risk profile that most enterprise security frameworks were not designed to handle.

Threat actor: FulcrumSec (a cyber-extortion group active since October 2025). A second actor, “TheUSERS007,” separately claimed a June 5–7 intrusion.

Attack overview: FulcrumSec claims it accessed Novo Nordisk’s network in March 2026 via a stolen GitHub access token, which enabled it to clone repositories and harvest additional credentials, then spent more than two months exfiltrating roughly 1.3 TB of data (700,000+ files). Novo Nordisk disclosed the incident on June 11–12, confirming unauthorized access and exposure of pseudonymized clinical-trial data, and refused a $25 million ransom demand; FulcrumSec began leaking samples on June 15.

Attack Vectors: – Compromised credentials (T1078 – Valid Accounts; T1552 – Unsecured Credentials): Per FulcrumSec’s own account, a stolen GitHub access token provided initial access and was used to clone repositories. Novo Nordisk confirmed unauthorized access to internal IT systems but did not independently confirm the entry method; the details beyond the actor’s claim are not established.

Data exposed: Source code (4,750 repositories claimed), 41,000+ proprietary drug compound structures, 30+ trained AI models, 73 research datasets, ~163,000 employee records, and pseudonymized data for ~11,500 clinical trial patients (sex, year of birth, biomarkers, BMI, smoking/alcohol status; no direct patient identifiers).

Scale: ~11,500 pseudonymized clinical-trial patients plus large-scale IP theft (~1.3 TB).

---

13. Tata Electronics

Affected organization: Tata Electronics, the electronics and semiconductor manufacturing arm of India’s Tata Group, and a major contract manufacturer assembling roughly a third of Apple’s iPhones in India and supplying Tesla and others.

Impact and significance: The World Leaks group published over 630 GB of data (204,300+ files), reportedly including Apple supplier specifications, iPhone circuit-board quality-inspection documents, and Tesla manufacturing documents marked “TRADE SECRET,” as well as employee passport scans. This is a supply-chain intellectual-property breach rather than a mass-consumer-PII event, but it is strategically significant: it exposes how deeply a contract manufacturer holds its customers’ most sensitive design and manufacturing IP, extending the breach’s impact to Apple and Tesla. Apple’s security team is reportedly working with Tata on remediation.

Threat actor: World Leaks (an extortion-focused group that rebranded from Hunters International in 2025 and shifted from ransomware to pure data-theft extortion).

Attack overview: World Leaks posted the 630 GB archive on its dark-web leak site around June 10–12, 2026, and issued a ransom demand. Tata Electronics confirmed the incident on June 22, stating operations were unaffected, and subsequently restricted internal access to sensitive systems and engaged a global consultant for a forensic audit. The exfiltration is believed to have predated the June posting by weeks, consistent with World Leaks’ silent-accumulation model.

Attack Vectors: – Not disclosed. The compromise stemmed from unauthorized access rather than a disclosed software CVE, but Tata did not disclose the initial-access vector or the attack path, and World Leaks did not publish one.

Data exposed: Apple and Tesla manufacturing specifications and design documents, iPhone circuit-board quality-inspection standards, internal emails, event logs spanning several years, SAP-related information, and employee passport copies.

Scale: 630 GB / 204,300+ files (intellectual property; individual-count not applicable).

---

14. Meta / Instagram (AI Support Chatbot Abuse)

Affected organization: Meta Platforms — specifically Instagram accounts, including high-profile handles such as the Obama-era White House account, Sephora, and a U.S. Space Force chief master sergeant.

Impact and significance: Meta reported roughly 20,225 potentially compromised accounts (of approximately 34,000 accounts that were targeted or exposed through the flawed workflow). The incident is strategically significant as an emerging class of AI-specific risk: attackers took over accounts with no malware, no code, and no credentials — they simply instructed Meta’s AI-powered support assistant to add an attacker-controlled email to a target account, received the verification code, and reset the password. It demonstrates how automating high-trust support functions (like password resets) without human verification can remove a critical security checkpoint — the AI support agent effectively acted as a privileged system that attackers induced to perform account recovery.

Threat actor: Multiple opportunistic actors; some publicly shared step-by-step videos of the technique. Compromised accounts were reportedly sold on the dark web.

Attack overview: Attackers used a VPN to spoof the target’s location (avoiding automated protections), opened a chat with the Meta AI Support Assistant, and asked it to link a new email address to the target account without being logged in. The chatbot sent a verification code to the attacker’s email; the attacker returned the code, prompting the bot to offer a password reset. Meta resolved the flaw and disclosed the affected-account count to the Maine Attorney General’s Office; reporting emerged June 1–8.

Attack Vectors: – Others (AI support-tool abuse / logic abuse): Attackers abused the legitimate functionality of an AI-powered account-recovery chatbot to reset credentials without authorization. This is not a traditional software-exploitation or phishing vector; it is manipulation of an over-permissioned automated support agent, categorized here as Others. The closest ATT&CK approximations for the resulting actions are T1098 (Account Manipulation — adding an attacker-controlled email) and T1556 (Modify Authentication Process — driving the password reset), producing T1078 (Valid Accounts) access to the hijacked account.

Data exposed: Account access (enabling takeover); associated email addresses, phone numbers, birth dates, and other profile data tied to the hijacked accounts.

Scale: Approximately 20,225 accounts compromised (of ~34,000 targeted/exposed).

---

15. London Hydro

Affected organization: London Hydro, a Canadian electricity distribution utility serving more than 160,000 customers in and around London, Ontario.

Impact and significance: London Hydro disclosed a data security incident that may have exposed customer personal and account information. While the number of affected customers and the attack method were not disclosed, the incident is notable as part of a broader June pattern of utility-sector breaches and for the phishing risk it creates — the exposed account and billing details are sufficient to make fraudulent utility bills, payment demands, or support calls appear credible.

Threat actor: Not disclosed.

Attack overview: London Hydro notified impacted customers on June 19–20 and posted updates to its website. The company disclosed little about the systems compromised, how the incident occurred, or whether data was exfiltrated versus merely accessed, and stated there was no indication that operational technology or grid systems were affected.

Attack Vectors: – Others (undisclosed): London Hydro did not disclose the initial access vector, the systems compromised, or whether data was stolen, so the vector is categorized as Others pending further information.

Data exposed: Names, addresses, email addresses, phone numbers, account and billing numbers, service addresses, pricing plans, contract start dates, and meter information. Banking information, payment card details, dates of birth, and government-issued IDs were not involved.

Scale: Not disclosed.

---

16. TikTok (Claim-Only)

Affected organization: TikTok (claimed). The claim is disputed and unverified.

Impact and significance: A threat actor claimed 2.4 billion TikTok user records on a data-leak forum on June 11, including email addresses, phone numbers, dates of birth, usernames, and in some cases full names and location data. This is included for completeness and as a claim-only event because security researchers (Cybernews) assessed the data as most likely repackaged infostealer logs harvested from infected devices rather than the product of a direct TikTok breach, finding no markers tying the samples exclusively to TikTok. TikTok has faced repeated similar unverified “billions of records” claims dating back to 2022.

Threat actor: An unnamed forum actor; a second actor concurrently posted a smaller alleged TikTok dataset, also likely of infostealer origin.

Attack overview: The records were posted on a hacker forum. Researchers found the dataset’s characteristics (and the presence of empty/generic fields) consistent with aggregated infostealer logs rather than a single-source breach. If any portion is legitimate, the primary risks are phishing, vishing, credential stuffing, and account takeover.

Attack Vectors: – Compromised credentials (T1078 – Valid Accounts): To the extent any data is legitimate, the likely origin is infostealer malware harvesting credentials and personal data from infected user devices, not a direct compromise of TikTok’s systems.

Data exposed (claimed): Email addresses, phone numbers, dates of birth, usernames, and in some cases full names and location data.

Scale: 2.4 billion records claimed (unverified; likely repackaged infostealer data).

---

17. CBSE (Central Board of Secondary Education, India)

Affected organization: The Central Board of Secondary Education (CBSE), India’s apex national education board, and its On-Screen Marking (OSM) vendor Coempt Edu Teck Pvt Ltd.

Impact and significance: A 19-year-old security researcher demonstrated critical vulnerabilities in CBSE’s OSM portal, including a misconfigured AWS storage bucket that exposed scanned Class 12 answer booklets, examiner records, and student PII. Separately, on June 2, the newly launched verification/re-evaluation portal was hit by a coordinated two-pronged attack combining a denial-of-service flood (roughly 1.5 million requests in two minutes, ~12,500 requests/second) with over 100,000 unauthorized file-access attempts. The incident is significant for the concentration of minors’ PII in under-invested education infrastructure and the risk of grade tampering. CBSE acknowledged the vulnerabilities on June 1 but later disputed that a data breach occurred.

Threat actor: For the disclosed vulnerabilities, an independent ethical hacker (Nisarga Adhikary). The June 2 DoS/file-access attack was attributed to unidentified “malicious actors.”

Attack overview: The researcher reported flaws to CERT-In in February 2026 and, after inaction, demonstrated write access to CBSE production servers and access to an improperly configured cloud storage bucket. On June 2, attackers used automation scripts and botnet traffic to flood the OSM verification portal while simultaneously attempting mass unauthorized file access.

Attack Vectors: – System error (misconfiguration) (T1562 – Impair Defenses; misconfiguration exploitation): An improperly configured AWS storage bucket allowed public/unauthorized access to sensitive examination files. – Denial-of-Service (T1498 – Network Denial of Service; T1499 – Endpoint Denial of Service): The June 2 attack flooded the portal with ~1.5 million requests in two minutes to saturate the servers, paired with data-theft attempts. – Vulnerability exploitation (T1190 – Exploit Public-Facing Application): Weaknesses in the OSM portal reportedly allowed examiner-account takeover and modification of marks.

Data exposed: Scanned Class 12 answer booklets and question papers, students’ marks and PII, and examiner/evaluator personal records (per the researcher’s claims; CBSE disputed a confirmed breach).

Scale: Potentially millions of students at risk (exact count not confirmed; CBSE disputes a breach occurred).

---

18. Klue / Salesforce OAuth Token Campaign (Icarus) — Multiple Victims

Affected organizations: A dozen-plus enterprise technology and cybersecurity vendors that used Klue, a competitive-intelligence SaaS platform, and connected it to their Salesforce environments. Confirmed victims include LastPass, BeyondTrust, HackerOne, Recorded Future, Tanium, Jamf, Snyk, OneTrust, Sprout Social, Huntress, 8×8, Pendo, and Insurity, among others.

Impact and significance: This is one of the most consequential campaigns of the month and the direct successor to the 2025 Salesloft/Drift and Gainsight Salesforce-integration attacks. A single dormant OAuth credential — created for a limited pilot project in 2022 and never revoked — allowed the Icarus extortion group to compromise Klue’s backend, harvest the OAuth tokens Klue held on behalf of many customers, and use them to query and exfiltrate data directly from each victim’s Salesforce environment. The significance is the blast radius from a single third-party integration credential and the target profile: many of the victims are security vendors whose customer contact and support-case data is unusually valuable for crafting credible spear-phishing. For LastPass specifically — a password manager with a history of breaches — the exposure of customer support-case history (which can include device details and partial recovery discussions) is a potent phishing enabler even though no password vaults were touched.

Threat actor: Icarus, an extortion group active since late April 2026. Researchers noted the tactics resemble prior Salesforce-ecosystem campaigns attributed to ShinyHunters/UNC6395, but the activity was claimed by Icarus. The group began posting stolen data on its leak site around June 22 and issued ransom demands.

Attack overview: Klue disclosed the incident on June 12, when its CEO confirmed attackers had obtained OAuth tokens the company held for its customers. Icarus used a compromised legacy credential to access Klue’s systems, generated/harvested OAuth tokens, then used automated scripts to bulk-exfiltrate data from the connected Salesforce instances. Salesforce and Gong disabled the Klue integration in response. Affected companies disclosed their individual exposure over June 18-24 (LastPass on June 23), and several began receiving extortion emails.

Attack Vectors: – Compromised credentials (T1078 – Valid Accounts; T1550 – Use Alternate Authentication Material): A dormant OAuth credential from a 2022 pilot provided the initial foothold at Klue, and harvested OAuth tokens were then used as valid authentication material to reach each victim’s Salesforce data. – Third-party vendor & supply chain compromise (T1195 – Supply Chain Compromise; T1199 – Trusted Relationship): The attack propagated through a shared SaaS integration (Klue) rather than compromising each victim directly, exposing data across a dozen-plus organizations through a single trusted vendor relationship.

Data exposed: Standard business contact and CRM data — customer names, email addresses, phone numbers, and physical addresses — plus customer support-case data and sales-related records. Password vaults, master passwords, and core product infrastructure were not affected (LastPass and others confirmed).

Scale: Not individually quantified across most victims; the campaign spans a dozen-plus organizations’ Salesforce datasets.

---

19. ServiceNow (Unauthenticated API Exposure)

Affected organization: ServiceNow customers running the Australia platform release, or on older releases with certain configuration changes.

Impact and significance: ServiceNow disclosed that an unauthenticated-access flaw in a REST API endpoint allowed queries against customer instance data without any credentials. The incident is significant because ServiceNow instances concentrate high-value operational data — IT support tickets, employee records, asset inventories, and security-incident reports — and support tickets in particular frequently contain embedded credentials, API tokens, and authentication secrets. The exposure also drew scrutiny over disclosure timing: ServiceNow reportedly received a confidential bug-bounty submission describing a similar issue on April 22, but did not apply the fix until June 5, days after activity targeting instances reportedly began, and disclosed publicly on June 9.

Threat actor: Not attributed. ServiceNow later stated it believed the observed activity was likely tied to security researchers or customer-led bug-bounty research rather than malicious actors, though this was not conclusively established.

Attack overview: The vulnerable endpoint (reported by administrators as /api/now/related_list_edit/create) was configured with requires_authentication=false, allowing unauthenticated HTTP requests to query instance tables. Anomalous activity was observed around June 2-3. ServiceNow silently applied a security update on June 5 that enforced authentication on the endpoint, then notified affected customers via a gated support bulletin and direct support cases, with public disclosure on June 9. No CVE had been assigned as of reporting.

Attack Vectors: – Vulnerability exploitation (T1190 – Exploit Public-Facing Application): An internet-reachable REST API endpoint with missing authentication (a broken-authentication / CWE-306 class flaw) allowed unauthenticated queries against customer instance data. – System error (misconfiguration) (T1562 – Impair Defenses; misconfiguration exploitation): The root cause was a Scripted REST Resource shipped/configured with authentication disabled, an access-control design error rather than a memory-safety exploit.

Data exposed: Not fully itemized. Potentially exposed instance data includes IT support tickets, employee records, internal documentation, asset inventories, security-incident reports, and any credentials or secrets embedded in accessible tickets.

Scale: Not disclosed (limited to a subset of customers on the affected release/configuration).

---

Regulatory Developments of Note

South Korea — Coupang record fine. On June 10–11, 2026, South Korea’s Personal Information Protection Commission (PIPC) fined Coupang approximately 624.7 billion won (~$409 million), the largest data-protection penalty in the country’s history, over a breach disclosed in late 2025 that exposed the personal data of roughly 33.7 million members (and, per the PIPC, 4.34 million non-members). The regulator attributed the breach to “negligent management” — including failures in authentication-key management, access control, and breach notification, plus deletion of five months of web access logs despite a preservation order — rather than sophisticated hacking. The perpetrator was a former employee (a foreign national) who retained access to systems he had helped build. Although the underlying breach falls outside the June disclosure window, the fine is included here as a significant June regulatory action signaling the increasing use of revenue-linked penalties for data-protection failures. Coupang has said it will challenge the fine while separately committing ~1.685 trillion won (~$1.17 billion) in customer compensation.

United States — Texas AG investigation into Carnival. On June 22, 2026, Texas Attorney General Ken Paxton announced an investigation into Carnival Corporation over a data breach affecting nearly 6 million people, including more than 800,000 Texans. The underlying breach — a social-engineering attack that compromised a single employee account in April 2026, exposing names, dates of birth, passport and other government-ID data, and in some cases payment and health information — was disclosed to affected individuals beginning around June 1, with breach notices and state-regulator filings continuing through the month. The incident is noted here for its June disclosure and enforcement activity; the underlying compromise was first reported in the prior period.

---

References

YTN — Tving personal data breach reaches 19.53 million; secondary-damage fears

Insight — Tving breach final scale confirmed at 19.53 million, exceeding paid membership

News1 (via Daum) — Tving attacker directly accessed DB and executed queries; KISA incident report

News1 (via Daum) — GitHub credential mismanagement emerges as breach vector for Tving and Day1Company

Edaily — Tving breach spreads into cloud account-management controversy (hardcoded GitHub/AWS credentials)

IT Daily — GitHub as the attack path: caution on storing credentials in source code

BleepingComputer — Data breach exposes up to 14.2 million email logins at six ISPs (KDDI)

Security Affairs — KDDI Data Breach Impacts up to 14.2 Million Email Accounts at Six ISPs

Infosecurity Magazine — KDDI Breach Affects Six Japanese ISPs

SecurityWeek — Aflac Japan Data Breach Impacts 4.38 Million

BleepingComputer — Insurance giant Aflac discloses data breach after subsidiary hack

The Japan Times — Aflac Japan reports data breach affecting over 4 million customers

SecurityWeek — Texas Parks & Wildlife Data Breach Affects 3 Million Individuals

Texas Parks & Wildlife Department — Notification of Data Security Incident

Fox News — Texas Parks and Wildlife data breach exposes 3 million customers’ data

Cybernews — ShinyHunters claims 61M Sysco records weeks after Qilin ransomware threat

BreachNews — Sysco Allegedly Breached as ShinyHunters Claims 61 Million Salesforce Records

Have I Been Pwned — Sysco Data Breach

TechNadu — ShinyHunters Leaks 2.7 Million Sysco Emails in June 2026 Campaign

BleepingComputer — DentaQuest data breach exposed info of 2.6 million accounts

Security Affairs — DentaQuest Breach: ShinyHunters Publish Data Impacting 2.6M People

BankInfoSecurity — ShinyHunters Leaks 234GB DentaQuest Data Trove

Security Affairs — Iran-Linked Handala Breached a California Water Utility

Dataminr — Cyber Intel Brief: Handala Claims Breach of California Water Service

SecurityWeek — Iranian Cyber Group Handala Claims Cal Water Hack

SecurityWeek — Xsolis Data Breach Affects 1.4 Million Individuals

The HIPAA Journal — Xsolis Data Breach Affects 1.4M Individuals

Help Net Security — Phishing attack on healthcare firm Xsolis impacts 1.4 million people

Hackread — iFood Confirms Data Breach Affecting 1.2 Million Users in Brazil

Rio Times — iFood Says Hacker Exposed 1.2 Million Brazilians’ Names and Tax IDs

SC Media — iFood confirms data breach affecting 1.2 million users

DataBreaches.Net — AssuranceAmerica breach may have affected more than 1.1 million people in seven states

Insurance Business — AssuranceAmerica MGA breach exposes policyholder data in employee-targeted attack

Insurance Journal — AssuranceAmerica Suffers Third-Party Data Breach, Customer Data Exposed

The Hacker News — ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities

Google Cloud (Mandiant) — ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

BleepingComputer — Nissan discloses employee data breach linked to Oracle zero-day attacks

GovInfoSecurity — Nissan Traces Data Breach to PeopleSoft Zero-Day Exploit (NAIC)

SecurityWeek — Cybercrime Group Claims Novo Nordisk Hack

Cybersecurity Insiders — FulcrumSec Spent Two Months in Novo Nordisk Networks Before 1.3TB Theft

The HIPAA Journal — Hackers Claim Responsibility for Novo Nordisk Cyberattack

Security Affairs — Tata Electronics Confirms Data Breach After 630GB Leak Claim Targets Apple and Tesla

TechCrunch — Tata Electronics, a major tech supplier to Apple and Tesla, confirms data breach

9to5Mac — Apple working with supplier Tata after sensitive files leak online

SecurityWeek — Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse

TechCrunch — Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access

SecurityWeek — Canadian Electricity Provider London Hydro Discloses Data Breach

CBC News — London Hydro investigating data breach affecting some customer accounts

Cybernews — 2.4B record TikTok data leak claim may be repackaged infostealer logs

MatchToCollege — CBSE Portal Security Breach: Ethical Hacker Exposes Flaws

CyberPeace — Inside the CBSE OSM Cyberattack: A Technical Breakdown of the June 2026 Incident

BleepingComputer — South Korea hits Coupang with record $409 million fine over data breach

The Record — South Korea hits Coupang with record $409 million fine over data breach

LastPass — Klue Supply Chain Incident & LastPass Response

TechCrunch — LastPass says hackers stole customer support case data during Klue breach

SecurityWeek — BeyondTrust, LastPass Impacted by Klue-Salesforce Incident

Help Net Security — LastPass customer data exposed through Klue supply chain attack

BleepingComputer — ServiceNow discloses security incident exposing customer data

Triskele Labs — ServiceNow Security Incident: Unauthenticated API Access Exposing Customer Data

Office of the Texas Attorney General — Investigation into Carnival Corporation data breach (June 22, 2026)

Fox News — Carnival breach may put your travel data at risk

This report compiles the major data breach incidents publicly disclosed between May 1 and May 31, 2026. Incidents are de-duplicated and selected based on disclosure date (not the date of the underlying intrusion). The primary inclusion threshold is one million affected individuals or records. Additional notable disclosures with smaller user-record counts but strategic significance (e.g., source code theft, sovereign IT infrastructure, software supply-chain campaigns) are covered in the Incident Details section as secondary entries.

The Attack Vector taxonomy used in this report is based on the categorization framework adopted by the IBM Cost of a Data Breach Report. Each Attack Vector is mapped to the corresponding MITRE ATT&CK techniques to provide threat-informed context for defenders.

---

Executive Summary

Top Incidents by Exposure Scale

Only incidents at or above the one-million-record threshold are summarized in the ranking table. Other notable disclosures with smaller user-record counts or undisclosed scale are covered in the Incident Details section below.

Rank	Incident	Scale	Sector	Disclosed
1	Instructure (Canvas LMS)	275M users / 3.65 TB / 8,809 institutions (ShinyHunters claim; Instructure has not officially confirmed the figures)	Education	May 1 (initial); May 7 (re-breach); May 11–12 (ransom paid)
2	Carnival Corporation (ShinyHunters)	5,995,277 individuals confirmed (~6M); 8.7M total records leaked	Travel / Cruise	May 27, 2026
3	Charter Communications / Spectrum (ShinyHunters)	4.9M unique accounts confirmed by HIBP; 13M+ per Cybernews analysis; 42M claimed by attacker	Telecommunications	May 27–29, 2026
4	Alberta voter list (Centurion Project)	2.9M Albertans	Government / Electoral	May 1–13, 2026 (continuing disclosure)
5	NYC Health + Hospitals	1.8M individuals	Healthcare / Government	May 19, 2026
6	Tabiq (Reqrea) hotel check-in platform	1M+ passports, driver’s licenses, and selfie verification photos	Hospitality Technology	May 15, 2026

Note on the Alberta voter list incident: The Court of King’s Bench injunction was issued on April 30, 2026 and the initial Privacy Commissioner statement quoting the 2.9M figure was made that same day. We classify this as a May incident in this report because the substantive scope, chain-of-custody investigation, and major operational disclosures (cease-and-desist letters to 568 individuals, identification of full-list recipients, third investigation launch, US 10XVotes link, and UCP caucus staff involvement) all unfolded between May 1 and May 13. Readers tracking this case strictly by first-disclosure date should treat April 30 as the boundary.

Most Frequently Exposed Data Types

The month was dominated by Personally Identifiable Information (PII) — names, email addresses, phone numbers, dates of birth, postal addresses, and customer/voter identifiers — followed by government identity documents (passport numbers, driver’s license numbers, Social Security numbers) and protected health information (medical records, diagnoses, insurance data). Carnival exposed passport numbers and driver’s license numbers for nearly 6 million individuals; Tabiq exposed more than 1 million scanned passports, driver’s licenses, and facial verification selfies; the Alberta voter list exposed the full home address, phone number, and elector ID of nearly 3 million Canadian voters — a particularly sensitive disclosure given that domestic violence survivors, law enforcement officers, and other at-risk individuals were among the affected.

The NYC Health + Hospitals disclosure introduced a particularly consequential category: biometric data (fingerprint and palm-print scans) and precise geolocation data extracted from photographed identity documents, neither of which can be rotated like a password.

Developer credentials and code-signing material emerged as the second major target category through the TeamPCP campaigns. OpenAI lost code-signing certificates for ChatGPT Desktop, Codex, and Atlas across macOS, Windows, iOS, and Android, forcing certificate rotation and a June 12 deadline for macOS users to update. GitHub lost approximately 3,800 internal repositories.

Top Attack Vectors

1. Phishing and social engineering — the dominant vector this month. Charter Communications was breached via a voice phishing (vishing) attack against an employee that compromised a Microsoft Entra account, which the attackers then pivoted into Salesforce; Carnival’s intrusion began with social engineering of an employee account; the GitHub VS Code extension intrusion tricked a developer into installing a poisoned marketplace extension.
2. Third-party vendor and supply chain compromise — observed in NYC Health + Hospitals (unnamed vendor), Mini Shai-Hulud (TanStack / npm), Vimeo and Zara (Anodot analytics platform), and the broader cascading impact of Canvas across 8,809 institutions.
3. Vulnerability exploitation — central to the Instructure intrusion (Free-For-Teacher product-tier vulnerability), the suspected Salt Typhoon edge-device exploitation, and Finland Valtori (Ivanti EPMM zero-day).
4. Compromised credentials — central to Lithuania Centre of Registers (abuse of authorized Migration Department logins), Mini Shai-Hulud (OIDC tokens extracted from CI/CD memory), and the post-vishing access in both Charter and Carnival.
5. System error / IT failure / misconfiguration — defining vector for Tabiq (publicly readable Amazon S3 bucket exposed more than 1 million identity documents).
6. Insider misuse and onward sharing — defining vector for the Alberta voter list incident, where a List of Electors legitimately issued to a political party was passed to a third-party separatist group and made publicly searchable.

Notable Attack Patterns

The month is defined by the Instructure / Canvas compromise — by exposure scale, sectoral disruption, and operational pattern, it is the dominant incident of the period and arguably the largest single education-sector breach in history. ShinyHunters’ “pay or leak” campaign reached its operational climax with the Instructure ransom payment on May 11–12, with shred logs returned as ransom-payment proof. The Instructure case is the second ShinyHunters compromise of the same vendor within eight months, indicating that ShinyHunters now treats certain victims as repeat-target portfolios.

The month also reveals the maturation of the broader ShinyHunters Salesforce / Microsoft Entra vishing campaign. Two of the largest individual disclosures of the month — Carnival (~6M individuals, May 27) and Charter Communications / Spectrum (4.9M HIBP-confirmed, May 27–29) — share the same operational pattern: vishing or social engineering against a single employee, pivot to a Microsoft Entra or Okta SSO account, then bulk exfiltration from Salesforce CRM. In 2026 alone, ShinyHunters has now confirmed breaches at Panera, Aura, ADT, Instructure, Vimeo, Zara, Carnival, and Charter using variations of this same playbook. The May 27 cluster suggests synchronized operational tempo.

The TeamPCP-attributed Mini Shai-Hulud and GitHub VS Code campaigns (May 11–20) demonstrated a new class of developer-targeted supply-chain attack: poisoned marketplace extensions and GitHub Actions cache poisoning extract OIDC tokens and credentials directly from CI/CD memory, then propagate through cryptographically valid provenance signatures — bypassing two-factor authentication and traditional package signing safeguards entirely.

Two further patterns appeared this month that defenders should not overlook. The Alberta voter list disclosure illustrates that a “breach” need not involve any external attacker at all: legitimately issued voter data was passed onward to an unauthorized third party and published in a publicly searchable form. Insider misuse and onward sharing of authorized data is now producing breaches at the scale of nation-state attacks. Separately, the Tabiq incident shows that one of the simplest and longest-recognized cloud misconfigurations (an Amazon S3 bucket left set to public) can still produce a million-record disclosure of identity documents and biometric selfies. The Lithuania Centre of Registers breach and the suspected Salt Typhoon attribution against an IBM Italy subsidiary reinforce that nation-state actors continue to exploit IT service providers and authorized third-party credentials as strategic supply-chain footholds in Europe.

---

Incident Details

1. Instructure (Canvas LMS) — ShinyHunters

Victim: Instructure Inc., the parent company of the Canvas Learning Management System used by approximately 41 percent of higher education institutions in North America and a large share of K-12 districts globally.

Impact / Why It Matters: The breach affected approximately 8,809 schools, universities, and online learning platforms — including all eight Ivy League universities, the University of California system, California State University, USC, Stanford, Princeton, Duke, Columbia, the University of Pennsylvania (306,000 affiliates), North Carolina K-12 districts, NUS in Singapore, multiple Australian universities, and Dutch universities. The breach occurred during finals season in many districts, disabling student access to assignments, grades, and coursework. It is the second confirmed Instructure compromise within eight months. On May 7, ShinyHunters defaced login pages at approximately 330 institutions and pivoted to direct school-by-school extortion. On May 11–12, Instructure paid an undisclosed ransom; ShinyHunters returned shred logs claiming data destruction and removed Instructure from its leak site. Security experts note that ransom payment provides no verifiable guarantee that copies were not retained.

Threat Actor: ShinyHunters extortion group.

Attack Method (Overview): On approximately April 25, 2026, ShinyHunters exploited a vulnerability in the Canvas Free-For-Teacher account program — a product-tier weakness rather than a peripheral business system compromise. Instructure detected the intrusion on April 29, revoked privileged credentials and rotated API keys, and publicly disclosed on May 1. After Instructure attempted “security patches” without engaging the attackers, ShinyHunters re-breached the platform on May 7. Instructure paid the ransom on May 11 and engaged the FBI, CISA, and overseas law enforcement.

Attack Vector(s): – Vulnerability exploitation (T1190 Exploit Public-Facing Application): The initial intrusion exploited a vulnerability in the Free-For-Teacher account program. – Compromised credentials (T1078 Valid Accounts): Stolen API keys and privileged credentials enabled persistent access; Instructure was forced to revoke and rotate them as part of incident response. – Third-party vendor and supply chain compromise (T1199 Trusted Relationship): The impact propagated to ~8,809 downstream education institutions because Canvas operates as a shared SaaS platform.

Data Exposed: Names, email addresses, student ID numbers, and a large volume of private messages between students and teachers (3.65 TB total). Instructure confirmed exposure of these categories and stated no evidence of compromise to passwords, dates of birth, government identifiers, or financial information.

Volume: 275 million users across approximately 8,809 institutions; 3.65 TB of data (ShinyHunters claim; Instructure has not officially confirmed the figures).

---

2. Carnival Corporation — ShinyHunters

Victim: Carnival Corporation, the world’s largest cruise line operator, parent of Carnival Cruise Line, Princess Cruises, Cunard, Seabourn, Costa Cruises, and Holland America Line. Analysis of leaked data indicates the records primarily originated from Holland America Line.

Impact / Why It Matters: On May 27, 2026, Carnival began sending notification letters to 5,995,277 individuals (~6M) and filed with the Maine Attorney General’s office. This is the long-tail confirmed-scale disclosure of an April 14 intrusion that ShinyHunters initially claimed in mid-April with an 8.7M record figure. The six-week gap between intrusion detection and formal notification reflects forensic scope determination. Carnival has a history of cybersecurity issues, including four separate cybersecurity events reported to New York Department of Financial Services between 2019 and 2021, two of which were ransomware attacks.

Threat Actor: ShinyHunters extortion group.

Attack Method (Overview): On April 14, 2026, ShinyHunters used social engineering against a Carnival employee to compromise an employee account, then used that valid account to access a limited portion of Carnival’s IT environment and exfiltrate files containing personal information. After Carnival refused to pay ransom, ShinyHunters leaked the 8.7M-record archive; the forensic analysis distinguishing 5,995,277 individuals affected was completed in late May.

Attack Vector(s): – Phishing — Social engineering variant (T1566 Phishing): The initial intrusion was a social engineering attack against a Carnival employee. – Compromised credentials (T1078 Valid Accounts): After the social engineering succeeded, the attackers authenticated as the legitimate employee to access Carnival’s internal systems.

Data Exposed: Names, addresses, email addresses, phone numbers, dates of birth, driver’s license numbers, passport numbers, gender details, geographic data, salutations, and cruise loyalty program status information. Payment card data does not appear to have been compromised.

Volume: 5,995,277 individuals confirmed (Maine AG filing); 8.7M total records leaked.

---

3. Charter Communications / Spectrum — ShinyHunters

Victim: Charter Communications, one of the largest broadband and cable providers in the United States, operating under the Spectrum brand and serving tens of millions of residential and business customers. Independent analysis of the leaked dataset indicates that most of the affected customer data originated from Spectrum Enterprise, the division providing telecommunications services to large businesses, corporations, government agencies, and other large clients.

Impact / Why It Matters: This is a parallel ShinyHunters extortion event to Carnival, surfacing publicly during the same final week of May. The breach exposes a structural weakness affecting the entire ShinyHunters target portfolio: a single successful voice phishing (vishing) call against an employee, followed by Microsoft Entra SSO compromise, can grant adversaries broad access to the entire Salesforce CRM environment behind it. The Spectrum dataset’s enterprise weighting is operationally important: many of the affected individuals are employees of companies that purchase Spectrum business services, expanding the attack surface for follow-on B2B phishing and business email compromise campaigns targeting those organizations. ShinyHunters claimed 42 million records and set a May 27 ransom deadline; after Charter refused to pay, ShinyHunters published the data on its dark web leak site. Charter publicly denied that sensitive personal information (PI) or customer proprietary network information (CPNI) was exfiltrated.

Threat Actor: ShinyHunters extortion group.

Attack Method (Overview): On approximately April 1, 2026, ShinyHunters used a voice phishing (vishing) attack to compromise the Microsoft Entra (Azure Active Directory) account of a Charter employee. The attackers then pivoted into Charter’s Salesforce CRM environment and exfiltrated a large volume of customer and employee data. Charter was listed on the ShinyHunters dark web leak site in mid-May with a May 27 ransom deadline. After Charter refused to pay, the group published the dataset on May 27–29, 2026.

Attack Vector(s): – Phishing — Vishing variant (T1566 Phishing): The defining vector. The operationally critical step was a voice phishing call to an employee, who was tricked into providing the credentials necessary to access their Microsoft Entra account. – Compromised credentials (T1078 Valid Accounts; T1528 Steal Application Access Token): After the vishing call succeeded, attackers authenticated as the legitimate employee to Microsoft Entra and Salesforce. – Third-party vendor and supply chain compromise (T1199 Trusted Relationship): The pivot from Entra into Salesforce was made possible by the trust relationship between Charter’s identity provider and its CRM SaaS application — a structural pattern recurring across the ShinyHunters campaign.

Data Exposed: Full names, email addresses (work and personal), home and company addresses, phone numbers, account plan details, customer support ticket subjects and timestamps, and limited Customer Proprietary Network Information per ShinyHunters’ claim (Charter denies CPNI exfiltration). Approximately 27,000 employee records were also leaked, including full names, work emails, and job titles. No passwords or payment information were observed in the leaked dataset.

Volume: 4.9M unique accounts confirmed by Have I Been Pwned analysis; 13M+ individuals per Cybernews research team analysis; 42M total records claimed by ShinyHunters; approximately 27,000 employee records.

---

4. Alberta Voter List (Centurion Project)

Victim: Almost 3 million Albertan voters (approximately 2.9 million records) whose personal information from the Alberta provincial List of Electors was made publicly searchable on a database operated by the Centurion Project, a pro-sovereignty (separatist) political organization led by political activist David Parker.

Impact / Why It Matters: Lorne Gibson, former Election Commissioner at Elections Alberta, has described this as “the largest data breach in Canada — I haven’t heard of anything that surpasses that scale.” Alberta NDP Leader Naheed Nenshi has characterized it as “probably the largest data breach in Canadian history.” The case is operationally unusual because it did not involve any external intrusion: the List of Electors was legitimately issued by Elections Alberta to the Republican Party of Alberta (a registered provincial political party), then onward-shared to vendors (including a US-based political technology firm named 10XVotes), and ultimately incorporated into the Centurion Project’s publicly searchable database. Elections Alberta confirmed the database’s source by verifying “salted” fictitious entries embedded in each issued copy. Affected populations include domestic violence survivors, law enforcement officers, and others for whom even name-plus-home-address disclosure carries significant safety risk. The Centurion Project’s app architecture — designed to identify low-engagement voters and pressure them to turn out — drew further concern because it was built by US Republican operatives and replicates technology previously deployed in the 2024 US presidential election; cross-border data transfer to a US firm raises additional concerns about US government access under the CLOUD Act.

Threat Actor: Not an external threat actor in the conventional sense. Elections Alberta and the RCMP are investigating onward-sharing and unauthorized publication by the Republican Party of Alberta, the Centurion Project Ltd., and intermediary vendors.

Attack Method (Overview): Elections Alberta issued an electors list to the Republican Party of Alberta in June 2025. The list was passed to vendors (reportedly including US-based 10XVotes) and ultimately incorporated into a publicly searchable database hosted on the Centurion Project’s website. Independent journalist Jen Gerson notified Elections Alberta on March 31, 2026 that anyone with rudimentary web skills could download the entire database. Elections Alberta issued a cease-and-desist letter on April 28; the Court of King’s Bench granted an emergency injunction on April 30, 2026; the database was taken offline. Throughout May, follow-on disclosures continued: cease-and-desist letters to 568 individuals (May 7), Privacy Commissioner third investigation launch, US 10XVotes website found to host similar Albertan data (May 20), and UCP caucus staffer participation in a Centurion Project meeting two weeks before the breach surfaced.

Attack Vector(s): – Insider misuse / onward sharing of authorized data (Malicious insider, T1078 Valid Accounts; T1567 Exfiltration Over Web Services): The defining vector. A political party authorized to receive the List of Electors passed it onward to vendors and, ultimately, to a third-party organization that published it on the open web. No external compromise was involved. – Third-party vendor and supply chain compromise (T1199 Trusted Relationship): The onward chain from political party to vendor to Centurion Project to publicly hosted database is itself a trust-relationship pattern: each handoff was based on a legitimate-looking request from a party that had been granted access by the previous holder.

Data Exposed: Full names, home addresses, phone numbers, unique elector identifiers, electoral divisions, and polling station designations for approximately 2.9 million Albertans.

Volume: 2.9 million records.

---

5. NYC Health + Hospitals

Victim: NYC Health + Hospitals (NYCHHC), the largest public healthcare system in the United States, providing care to over one million New Yorkers, most of whom are uninsured or receive state benefits such as Medicaid.

Impact / Why It Matters: The May 19, 2026 disclosure publicly confirmed the 1.8M individual scale and the full category list of compromised data, making this one of the largest healthcare breaches of 2026 by both scale and sensitivity. The data category list is unusually severe: in addition to standard PII and PHI, it includes biometric fingerprint and palm-print scans (which cannot be rotated like a password), precise geolocation data extracted from photographs of uploaded identity documents, taxpayer identification numbers, IRS-issued identity protection numbers, and online account credentials. The breach was traced to an unnamed third-party vendor. NYCHHC reported the incident to HHS on March 24, but the publicly accessible 1.8M scale disclosure and complete data category list was published on the website on May 19.

Threat Actor: Undisclosed; unauthorized actor accessed systems via a vendor breach.

Attack Method (Overview): In November 2025, an unauthorized actor exploited a vulnerability at an unnamed third-party vendor that had access to NYCHHC’s network. The intrusion remained undetected from approximately November 25, 2025 through February 2026, with attackers exfiltrating files during the window. NYCHHC detected suspicious network activity on February 2, 2026, secured the network, and engaged third-party forensic specialists. The investigation determined the scope and was disclosed to the public on May 19, 2026.

Attack Vector(s): – Third-party vendor and supply chain compromise (T1195 Supply Chain Compromise; T1199 Trusted Relationship): The defining vector — the intrusion originated at an unnamed third-party vendor with authorized network access. NYCHHC itself was not directly attacked. – Compromised credentials (T1078 Valid Accounts): Once inside via the vendor relationship, attackers leveraged authorized access to copy files for approximately three months.

Data Exposed: Health insurance plan and policy information, Medicaid/Medicare/government payor ID numbers, medical record numbers, disability codes, diagnoses, medications, test results, medical imagery, treatment plans, billing/claims/payment information, Social Security numbers, driver’s license numbers, passport numbers, taxpayer identification numbers, IRS-issued identity protection numbers, precise geolocation data, credit/debit card numbers, financial account information or credentials, online account credentials, and biometric data including fingerprints and palm prints.

Volume: 1.8 million individuals.

---

6. Tabiq (Reqrea) Hotel Check-in Platform — Public Amazon S3 Bucket Exposure

Victim: Tabiq, a hotel check-in system maintained by Japan-based startup Reqrea. Tabiq is used in multiple hotels across Japan and relies on facial recognition and document scanning to check arriving guests in. The exposure affected hotel guests from many countries worldwide, with files dating from early 2020 through May 2026.

Impact / Why It Matters: More than one million scanned passports, driver’s licenses, and selfie verification photos were left publicly readable on the open internet — accessible to anyone who knew the storage bucket name “tabiq,” with no authentication required. The data category is particularly damaging because unlike credit card numbers, passport numbers and driver’s license numbers cannot be easily reissued, and facial verification selfies cannot be rotated. The exposed dataset is sufficient to enable both physical-document identity fraud and synthetic-identity creation, and crosses mandatory data breach notification thresholds in multiple jurisdictions (Japan, EU, UK, US states). This is one of the largest cloud-misconfiguration disclosures of 2026.

Threat Actor: Not applicable — no external intrusion occurred. Independent security researcher Anurag Sen discovered the public bucket and notified TechCrunch, which alerted Reqrea and Japan’s cybersecurity coordination team JPCERT. Reqrea locked down the bucket after the notification.

Attack Method (Overview): An Amazon S3 bucket used by the Tabiq check-in system was configured to be publicly accessible, allowing anyone with a web browser and knowledge of the bucket name to view all stored customer documents without a password. Reqrea has stated it does not know how the bucket was set to public — Amazon S3 buckets default to private and now include explicit warnings against public configuration. Reqrea is still reviewing logs to determine whether any unauthorized parties accessed the data prior to the researcher’s discovery.

Attack Vector(s): – System error / IT failure / misconfiguration (T1562 Impair Defenses; Misconfiguration exploitation): The defining vector. An Amazon S3 bucket containing highly sensitive identity documents was configured to allow unauthenticated public read access. No external compromise or credential theft was involved — the security boundary itself was incorrectly defined.

Data Exposed: Full names, addresses, dates of birth, passport numbers and scanned passport images, driver’s license numbers and scanned driver’s license images, and facial verification selfies of more than 1 million hotel guests worldwide.

Volume: More than 1 million identity documents and verification images.

---

7. Mini Shai-Hulud Supply-Chain Campaign — TeamPCP (OpenAI, Mistral AI, UiPath, OpenSearch, TanStack)

Victim: Hundreds of open-source projects in the npm and PyPI ecosystems, with named confirmed-impact organizations including OpenAI (two employee devices compromised; limited credential exfiltration from internal source-code repositories), Mistral AI, UiPath, OpenSearch, Guardrails AI, and TanStack itself. TanStack’s React Router alone is downloaded approximately 12 million times per week.

Impact / Why It Matters: This is one of the most consequential software supply-chain compromises of 2026 to date. The campaign bypassed two-factor authentication and carried cryptographically valid provenance signatures — exposing a major blind spot in current software security defenses. OpenAI lost code-signing certificates for macOS, Windows, iOS, and Android applications, with macOS users required to update by June 12, 2026 or face application failure. Microsoft Threat Intelligence reported a Linux information-stealing tool with a destructive sabotage component that would randomly execute a recursive wipe on Israeli or Iranian systems.

Threat Actor: TeamPCP, a cloud-focused cybercriminal group that emerged in late 2025 and is also credited with the original Shai-Hulud, SAP, Checkmarx, Bitwarden, Lightning, Intercom, Trivy, and (via the same broader campaign) the GitHub VS Code extension compromises.

Attack Method (Overview): On May 11, 2026, TeamPCP launched a coordinated chain attack against the TanStack/router repository: a fork (renamed to evade fork-list searches) opened a pull request triggering a pull_request_target workflow, executed attacker code that poisoned the GitHub Actions cache with a malicious pnpm store, then waited for legitimate maintainer PRs to merge — at which point the release workflow restored the poisoned cache and extracted OIDC tokens directly from /proc/<pid>/mem. The OIDC tokens were used to publish malicious package versions.

Attack Vector(s): – Third-party vendor and supply chain compromise (T1195.002 Compromise Software Supply Chain): The defining vector — attackers compromised trusted open-source packages used by tens of thousands of downstream organizations. – Vulnerability exploitation (T1190 Exploit Public-Facing Application): The attack chained three vulnerabilities in GitHub Actions configurations (pull_request_target misuse, cache poisoning, OIDC token extraction from process memory). CISA added the related CVEs to its Known Exploited Vulnerabilities catalog on May 27, 2026. – Compromised credentials (T1528 Steal Application Access Token; T1552.001 Credentials in Files): The malware harvested GitHub tokens, npm publish tokens, AWS credentials, Kubernetes secrets, SSH keys, and .env files.

Data Exposed: At OpenAI specifically — limited credential material from a small set of internal source-code repositories accessible to two employees, plus code-signing certificates for ChatGPT Desktop, Codex App, Codex CLI, and Atlas across macOS/Windows/iOS/Android. OpenAI stated no customer data, production systems, or intellectual property were compromised. Across the ecosystem broadly — GitHub PATs, npm publish tokens, AWS credentials, Kubernetes service accounts, SSH keys, CI/CD secrets, and Vault tokens were targeted.

Volume: Hundreds of compromised packages across npm and PyPI; ecosystem-wide impact still being measured. OpenAI characterized exposure as limited credential material only.

---

8. GitHub (Internal Repositories via Nx Console VS Code Extension)

Victim: GitHub, the Microsoft-owned source-code hosting platform.

Impact / Why It Matters: On May 19–20, 2026, GitHub detected and contained the compromise of an employee device that had installed a poisoned version of the Nx Console VS Code extension (a verified-publisher extension with 2.2 million installs). The trojanized version was live on the Visual Studio Marketplace for only 18 minutes (12:30 PM to 12:48 PM UTC on May 18, 2026), but that window was sufficient for attackers to distribute a credential stealer that harvested 1Password vault data, Claude Code configurations, npm tokens, GitHub tokens, and AWS credentials from anyone with auto-update enabled. TeamPCP listed roughly 3,800 GitHub-internal repositories and source code for sale on the Breached cybercrime forum, demanding at least $50,000. GitHub states it found no evidence of impact to customer repositories or enterprise environments. This and the Mini Shai-Hulud TanStack incident are tracked together as CVE-related supply-chain attacks; CISA added them to KEV on May 27 with a June 10 federal remediation deadline.

Threat Actor: TeamPCP.

Attack Method (Overview): An attacker compromised the Nx Console VS Code extension’s release pipeline and published a malicious update on May 18 at 12:30 PM UTC. The extension behaved like the legitimate Nx Console but silently ran a shell command at startup that downloaded and executed a hidden package from a planted commit on the nrwl/nx GitHub repository. A GitHub employee’s device picked up the update via auto-update during the 18-minute window. GitHub detected the compromise on May 19 and isolated the endpoint. GitHub rotated critical secrets and credentials overnight.

Attack Vector(s): – Third-party vendor and supply chain compromise (T1195.002 Compromise Software Supply Chain): The defining vector — a poisoned update to a trusted, verified-publisher VS Code marketplace extension propagated automatically to any user with auto-update enabled. – Compromised credentials (T1552 Unsecured Credentials; T1528 Steal Application Access Token): The malicious extension’s payload was a credential stealer targeting 1Password, Claude Code, npm, GitHub, and AWS credentials.

Data Exposed: Approximately 3,800 GitHub-internal source-code repositories. GitHub has stated that no customer data was exfiltrated.

Volume: 3,800 internal repositories (TeamPCP claims ~4,000).

---

9. UK Biobank (Genomic Data — Re-disclosure with Strategic Reframing)

Victim: UK Biobank, the major UK genomic research platform holding genetic and health data on approximately 500,000 British volunteers.

Impact / Why It Matters: Nature published research on May 13, 2026 documenting that the UK Biobank breach has prompted the entire field of genomics to rethink open science. The breach has structural implications: genomic data is uniquely irreplaceable, and exposure extends to genetic relatives who never consented to inclusion. The Guardian reported that private health records of half a million Britons appeared for sale on a Chinese-language website. The incident is reshaping international debate on open-science models in genomics.

Threat Actor: Undisclosed; data was offered for sale on a Chinese-language website.

Attack Method (Overview): Public details of the intrusion technique have not been disclosed. UK Biobank suspended platform access as a forensic measure while conducting a board-led investigation.

Attack Vector(s): – Others (intrusion vector undisclosed): The specific entry vector has not been publicly disclosed.

Data Exposed: Genetic data and health records on approximately 500,000 individuals.

Volume: 500,000 records.

---

10. Lithuania Centre of Registers (Foreign Intelligence Operation)

Victim: Centre of Registers (Registrų centras), the Lithuanian state agency responsible for the country’s real estate and legal-entity registries. Personal data exposed includes records of intelligence officers, political emigrants from Russia and Belarus, the President of Lithuania, and ordinary citizens.

Impact / Why It Matters: Lithuanian President Gitanas Nausėda declared on May 27 that “hostile states” orchestrated the breach, characterizing it as a state-sponsored intelligence operation. The case is acutely concerning given Lithuania’s role as host to numerous Russian and Belarusian political emigrants, and the country’s ongoing tensions with Russia. In April 2026, Lithuanian and international authorities charged 13 defendants in a GRU-linked network that had planned assassinations of two individuals in Vilnius. Knowing where targets live is a first operational step in physical attack. The President’s own data was among those accessed. Adrijus Jusas, the head of the Centre of Registers, resigned on May 25. The Lithuanian State Security Department confirmed intelligence officers among the victims.

Threat Actor: Suspected foreign state actor (publicly characterized by Lithuania’s President as “hostile states”; Russia is the most heavily suspected actor based on context, but Lithuanian authorities have not publicly named a state).

Attack Method (Overview): Attackers obtained valid login credentials belonging to user accounts at Lithuania’s Migration Department — an institution authorized to query the registers — and used those credentials to issue queries from a foreign country at scale over a period of months. The Centre of Registers itself was not directly breached; the strength of the system was set by the weakest authorized credential held outside it.

Attack Vector(s): – Compromised credentials (T1078 Valid Accounts): The defining vector — valid Migration Department login credentials were used to authenticate as legitimate authorized users. – Third-party vendor and supply chain compromise (T1199 Trusted Relationship): The Migration Department’s authorized access to the registry was the trust boundary that was exploited.

Data Exposed: Names, surnames, identification numbers, dates of birth, and property information for 600,000+ records. Phone numbers, email addresses, bank account details, service payment information, real estate transaction documents, court rulings, and building plans were stated to be not among the compromised data.

Volume: 600,000+ records.

---

11. Zara (Anodot Supply-Chain)

Victim: Zara (Inditex Group), the Spanish fast-fashion retailer.

Impact / Why It Matters: Latest confirmed downstream victim of the Anodot analytics platform compromise — joining Vimeo, Rockstar Games, Mytheresa, Carnival (separately compromised), 7-Eleven, McGraw Hill, and dozens of other organizations. Have I Been Pwned loaded the Zara dataset on May 8, 2026. While credentials and payment data were not exposed, the customer-support-ticket content provides material for targeted phishing referencing real order and purchase history.

Threat Actor: ShinyHunters.

Attack Method (Overview): ShinyHunters compromised Anodot and used stolen Anodot authentication tokens to authenticate to Zara’s BigQuery instance. After Inditex refused to engage, ShinyHunters leaked a 140 GB archive.

Attack Vector(s): – Third-party vendor and supply chain compromise (T1195 Supply Chain Compromise; T1199 Trusted Relationship): Zara’s data was accessed via the Anodot trust relationship. – Compromised credentials (T1078 Valid Accounts; T1528 Steal Application Access Token): Anodot OAuth/authentication tokens were used to authenticate as a legitimate analytics integration.

Data Exposed: 197,400 unique email addresses, product SKUs, order IDs, geographic locations, customer support ticket content.

Volume: 197,400 customers; 140 GB archive leaked.

---

12. Asian Football Confederation (AFC) + Al Nassr FC

Victim: The Asian Football Confederation (the-afc.com), the governing body for football across Asia, and Al Nassr FC, the Saudi Premier League club home to Cristiano Ronaldo, Sadio Mané, and Marcelo Brozović.

Impact / Why It Matters: The breach exposed sensitive identity documents and contracts for over 150,000 players, coaches, and officials — including diplomatic passport scans tied to football officials. The 2026 FIFA World Cup begins June 11, 2026 across Canada, Mexico, and the US. The exposure creates risks of contract manipulation, financial fraud, targeted phishing of high-profile athletes, and physical security threats.

Threat Actor: An actor operating under the handle “fuckiewuckie” on the PwnForums marketplace, who credited ShinyHunters with facilitating the leak. Dataminr researchers suggest the credit may be a credibility-building tactic.

Attack Method (Overview): The actor advertised and posted the database to the PwnForums dark web marketplace on or around April 27, 2026. The exact intrusion vector against AFC’s systems has not been disclosed publicly.

Attack Vector(s): – Others (intrusion vector undisclosed): The technical method of compromise of AFC infrastructure has not been disclosed.

Data Exposed: Passport scans (including diplomatic passports), professional contracts, email addresses, AFC Champions League Elite preliminary player registration forms, full names, dates of birth, nationalities, player positions, match details, and registration files.

Volume: 150,000+ players, coaches, and officials.

---

13. Vimeo (Anodot Supply-Chain)

Victim: Vimeo, the video-hosting platform.

Impact / Why It Matters: Although Vimeo’s own infrastructure was not directly breached, attackers compromised its third-party analytics integration (Anodot) and pivoted into Vimeo’s cloud data warehouses on Snowflake and BigQuery. After ransom negotiations failed, ShinyHunters publicly leaked a 106 GB archive on its dark web site on May 5, 2026.

Threat Actor: ShinyHunters.

Attack Method (Overview): ShinyHunters stole Anodot authentication tokens and used those tokens to authenticate to Vimeo’s Snowflake and BigQuery cloud data warehouses. Anodot’s status page indicates the incident began on April 4, 2026.

Attack Vector(s): – Third-party vendor and supply chain compromise (T1195 Supply Chain Compromise; T1199 Trusted Relationship): The attackers leveraged the trust relationship between Vimeo and Anodot. – Compromised credentials (T1078 Valid Accounts; T1528 Steal Application Access Token): Stolen Anodot OAuth/authentication tokens were used to authenticate as a legitimate analytics integration.

Data Exposed: 119,200 unique customer email addresses, customer names, video metadata.

Volume: 119,200 affected accounts.

---

14. Sandhills Medical (South Carolina)

Victim: Sandhills Medical, a healthcare provider in South Carolina.

Impact / Why It Matters: Healthcare data breaches consistently produce the most expensive long-term consequences for affected individuals because medical records combine PII, insurance, and clinical data.

Threat Actor: Undisclosed (ransomware operator).

Attack Method (Overview): A ransomware attack in 2025 on Sandhills Medical led to data exfiltration; state officials disclosed the scope of impact in early May 2026.

Attack Vector(s): – Others (intrusion vector undisclosed): The specific entry vector was not disclosed.

Data Exposed: Personal information of patients.

Volume: 78,000 individuals.

---

15. Finland Valtori (Espionage Probe Expansion)

Victim: Valtori, Finland’s Government ICT Centre, which provides mobile device management services to approximately 50,000 government users including ministries, prosecutors, the Office of the President, the National Police Board, and Finnish Customs.

Impact / Why It Matters: On May 7–8, Yle reported that the breach reached the Office of the President (data linked to more than 50 people) and Finnish Customs. The case is being investigated by the Finnish National Bureau of Investigation as suspected espionage and aggravated unauthorized access. Compromised material is fragmentary in isolation, but when combined “could form information that affects Finland’s security.” Part of a coordinated wave of European government breaches exploiting Ivanti EPMM vulnerabilities (CVE-2026-1281, CVE-2026-1340).

Threat Actor: Unattributed; investigation ongoing as suspected espionage.

Attack Method (Overview): The attacker exploited a then-unpatched Ivanti EPMM vulnerability allowing unauthenticated remote code execution. A patch was applied the same day it was released, but data marked as “deleted” had not actually been erased.

Attack Vector(s): – Vulnerability exploitation (T1190 Exploit Public-Facing Application): Ivanti EPMM zero-day exploitation enabled unauthenticated remote code execution. – System error / IT failure / misconfiguration: The MDM system marked deleted records as removed without actually erasing them.

Data Exposed: Names, work email addresses, phone numbers, device identifiers, configuration details, country-level device location data of approximately 50,000 government users.

Volume: ~50,000 government users.

---

16. Trellix (Source Code Repository Breach)

Victim: Trellix, the cybersecurity vendor formed from the 2022 merger of McAfee Enterprise and FireEye. Trellix protects more than 50,000 business and government customers and over 200 million endpoints.

Impact / Why It Matters: Source code theft from a security vendor creates cascading downstream risk: attackers gain a technical blueprint of detection logic, signatures, and product architecture. On May 7, 2026, the RansomHouse group publicly claimed responsibility, posting screenshots indicating access to Trellix’s appliance management system. Third major security-vendor source code incident in 2026 alongside the Checkmarx GitHub leak and the Cisco internal development environment breach.

Threat Actor: RansomHouse.

Attack Method (Overview): An unauthorized party gained access to a portion of Trellix’s internal source code repository, including its appliance management system. Trellix discovered the intrusion, engaged forensic experts, and notified law enforcement.

Attack Vector(s): – Others (intrusion vector undisclosed): Trellix has not disclosed whether the breach resulted from a zero-day vulnerability, weak or stolen credentials, supply-chain compromise of a code-hosting platform, or an insider.

Data Exposed: An undisclosed portion of internal source code, including content related to the appliance management system.

Volume: Undisclosed; 50,000+ business and government customers indirectly exposed.

---

17. Salt Typhoon — IBM Sistemi Informativi (Italy)

Victim: Sistemi Informativi, an IBM Italy subsidiary providing IT infrastructure management to numerous Italian public agencies and private institutions.

Impact / Why It Matters: The breach is reportedly linked to Salt Typhoon, a sophisticated Chinese state-sponsored APT active since at least 2019. Prior Salt Typhoon victims include US House staff emails, the US National Guard, Viasat, Canadian telecom firms, and European telecoms. The intrusion temporarily took the subsidiary’s website offline. IBM confirmed the incident on May 3, 2026; some reporting questions the Salt Typhoon attribution.

Threat Actor: Salt Typhoon (China-linked APT, attribution under continued analysis).

Attack Method (Overview): Salt Typhoon’s hallmark TTP is the silent exploitation of edge device vulnerabilities (Citrix, Cisco) for initial access, followed by long-dwell-time data staging. The exact vector against Sistemi Informativi has not been publicly disclosed.

Attack Vector(s): – Vulnerability exploitation (T1190 Exploit Public-Facing Application): Salt Typhoon’s hallmark technique is exploitation of unpatched edge appliances. – Third-party vendor and supply chain compromise (T1199 Trusted Relationship): Sistemi Informativi sits at the center of an Italian IT supply chain serving public administration.

Data Exposed: Undisclosed by IBM.

Volume: Undisclosed.

---

18. NVIDIA GeForce NOW (Armenia)

Victim: NVIDIA GeForce NOW users located in Armenia.

Impact / Why It Matters: NVIDIA confirmed on May 7, 2026 that GeForce NOW user information was exposed in a regionally scoped breach affecting Armenian users. The disclosure is significant because a ShinyHunters impersonator publicly claimed to have hacked NVIDIA’s GeForce Now infrastructure — illustrating that the ShinyHunters “brand” is being co-opted by unrelated actors to amplify the perceived credibility of unrelated claims.

Threat Actor: Undisclosed by NVIDIA; an unrelated actor falsely impersonating ShinyHunters claimed responsibility.

Attack Method (Overview): NVIDIA confirmed the breach to Bleeping Computer but did not disclose the technical entry vector.

Attack Vector(s): – Others (intrusion vector undisclosed): NVIDIA has not publicly disclosed the technical vector.

Data Exposed: User information for GeForce NOW Armenia users.

Volume: Undisclosed (Armenian users only).

---

References

1. Wikipedia — 2026 Canvas security incident
2. Inside Higher Ed — Instructure Pays Ransom to Canvas Hackers
3. The Hacker News — Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak
4. Bitdefender Business Insights — Technical Advisory: ShinyHunters Breach of Instructure Canvas LMS
5. The Register — Double Canvas breach acknowledged as ShinyHunters sets new pay-or-leak deadline
6. Halcyon — Education Sector in the Crosshairs: ShinyHunters’ Extortion Campaign Against Instructure
7. Security Week — Carnival Data Breach Exposed 6 Million People
8. Bleeping Computer — Carnival Cruise confirms data breach affecting nearly 6 million people
9. The Record — Cruise giant Carnival confirms data breach affecting nearly 6 million people
10. Malwarebytes — Carnival confirms data breach impacting nearly 6 million
11. Bleeping Computer — Charter confirms data breach after ShinyHunters extortion threat
12. Cybernews — Inside the Charter data breach: hackers leak 13M+ customer data
13. The Register — ShinyHunters adds Charter to trophy shelf after 4.9M customer records leak
14. TechRepublic — ShinyHunters Alleges 42M Records Stolen from Charter Communications
15. Techlicious — Charter confirms Spectrum data breach: 13 million customers exposed
16. CBC News — Elections Alberta granted injunction to pull down electoral list posted publicly by separatist group
17. CBC News — Elections Alberta issues cease-and-desist letters over voter info breach, privacy commissioner launches probe
18. The Tyee — Alberta’s Voters Data Breach Was Very Bad. And Inevitable
19. Canada’s National Observer — Alberta voter data found on website of US company linked to Centurion Project
20. Elections Alberta — Message to Albertans from the Chief Electoral Officer re: Unauthorized Use of List of Electors
21. TechCrunch — NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people
22. Biometric Update — Data breach exposes medical, financial, biometric data of 1.8 million
23. TechRadar — NYC Health + Hospitals mega data breach
24. TechCrunch — A hotel check-in system left a million passports and driver’s licenses open for anyone to see
25. Security Affairs — Public Amazon bucket leaks sensitive guest data from Japanese hotel platform Tabiq
26. Privacy Guides — Data Breach Roundup (May 15 – 21, 2026) — Tabiq misconfiguration
27. OpenAI — Our response to the TanStack npm supply chain attack
28. Bleeping Computer — OpenAI confirms security breach in TanStack supply chain attack
29. CyberScoop — ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages
30. The Hacker News — GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension
31. Bleeping Computer — GitHub confirms breach of 3,800 repos via malicious VSCode extension
32. Help Net Security — TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension
33. Nature — UK Biobank breach prompts the field of genomics to rethink open science
34. The Guardian — Private health records of half a million Britons offered for sale on Chinese website
35. Tech Times — Lithuania Data Breach: 600,000 Records Expose Spy Home Addresses to Hostile States
36. Security Week — Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries
37. LRT — Lithuania investigates massive data breach, suspects foreign intelligence operation
38. Infosecurity Magazine — Zara Data Breach Impacts Nearly 200,000 Customers
39. Bleeping Computer — Zara data breach exposed personal information of 197,000 people
40. UpGuard — ShinyHunters claims Asian Football Confederation data breach
41. SC Media — Asian Football Confederation reportedly suffers massive data breach
42. TechRadar — The Vimeo data breach exposed personal information of 119,000 people
43. Bleeping Computer — Vimeo data breach exposes personal information of 119,000 people
44. WLTX — 78,000 impacted by data breach in South Carolina
45. Yle News — Finnish state data ‘espionage’ breach reached president’s office, documents show
46. The Hacker News — Trellix Confirms Source Code Breach With Unauthorized Repository Access
47. Bleeping Computer — Trellix source code breach claimed by RansomHouse hackers
48. Security Affairs — Salt Typhoon breach IBM subsidiary in Italy
49. Bleeping Computer — NVIDIA confirms GeForce NOW data breach affecting Armenian users

This report compiles major data breaches disclosed during April 2026 that affected approximately 1 million+ individuals, plus a small number of incidents below that threshold included for systemic significance. The selection criterion is the disclosure / notification date, not the date of the underlying breach — some incidents involved earlier intrusions but were publicly disclosed (or had their scope materially expanded) during April 2026. Each case is analyzed for victim profile, threat actor, attack methodology, Attack Vector, exposed data types, and impact volume. The Attack Vector taxonomy used in this report follows the IBM Cost of a Data Breach Report categories, with the corresponding MITRE ATT&CK technique mappings noted for each vector to support threat-modeling and detection-engineering use cases.

Executive Summary

Top Incidents by Exposure Volume (Disclosure Date)

Rank	Incident	Scale	Disclosed
1	Rockstar Games (gaming, Take-Two subsidiary)	~78.6M records	April 14, 2026
2	McGraw Hill (Big-Three educational publisher)	13.5M (45M claimed)	April 15, 2026
3	Carnival Corporation (cruise operator)	8.7M	April 18–21, 2026
4	Pitney Bowes (US shipping / mailing logistics)	8.2M (25M+ claimed)	April 18–21, 2026
5	Canada Life Assurance (Canadian insurer)	5.6M+	April 2026
6	ADT (US home-security provider)	5.5M (10M+ claimed)	April 24 (SEC 8-K) / April 27, 2026 (dump)
7	Citizens Bank (third-party breach)	3.5M	April 2026
8	Amtrak (US national passenger rail)	2.1M (9.4M claimed)	April 17, 2026
9	Hallmark (cards / Hallmark+ streaming)	1.7M (~6.2M records across 20 files)	April 12–13, 2026
10	Udemy (online learning marketplace)	1.4M	April 24–27, 2026

Most Frequently Exposed Data Types

1. Personally Identifiable Information (PII) — names, addresses, emails, phone numbers (in nearly every incident: McGraw Hill, Kemper, Pitney Bowes, ADT, Amtrak, Hallmark, Udemy, Carnival, Rituals, Basic-Fit, etc.)
2. Loyalty / Membership Profile Data — preferred store, account type, gender, Mariner Society loyalty status (Carnival, Rituals, Hallmark, Hallmark+ streaming subscribers, Inditex transaction records)
3. Customer Support Interaction Records — historical support tickets and travel/order context (Adobe, Amtrak, Hallmark, McGraw Hill)
4. Financial / Banking Information — Basic-Fit (bank account / IBAN), Udemy (instructor payout methods: PayPal, cheque, bank transfer), Kemper (Stripe payment logs with transaction amounts), ADT (last-4 SSN/Tax ID for a subset)
5. National ID / Government Identifiers — France Titres / ANTS (login IDs, account identifiers, place of birth), ADT (last-4 SSN/Tax ID), AFC (passport scans)
6. Internal Corporate / Employee Data — Pitney Bowes (employee records with job titles), Adobe (alleged 15K employee records + complete HackerOne bug-bounty submissions), Vercel (API keys, NPM tokens, GitHub tokens, source code), Kemper (employee training materials), BePrime (plaintext credentials, security audit reports)
7. Multi-domain Analytics / Game-Economy Data — Rockstar Games (in-game revenue metrics, player behavior tracking, GTA Online and Red Dead Online economy data) — competitive intelligence rather than identity-fraud material

Top Attack Vectors of April 2026

1. Third-party vendor & Supply chain compromise — Dominant #1 of the month
   • ShinyHunters’ Salesforce extortion wave reached the majority of victims (Marcus & Millichap, McGraw Hill, Kemper, Medtronic, Pitney Bowes, Carnival, Canada Life, ADT, Amtrak, Hallmark, Udemy, Inditex).
   • Anodot (Israeli AI-analytics SaaS) compromise produced cascading Snowflake/BigQuery breaches — most notably Rockstar Games (78.6M records) and Inditex.
   • Vercel breached via Context.ai OAuth compromise; the Context.ai compromise dated back to June 2024.
   • Adobe reportedly reached through an Indian BPO contractor — a fourth-party / nth-party vendor risk.
2. Compromised credentials (SSO Vishing-driven theft)
   • Stolen Salesforce credentials, Okta SSO sessions, and Snowflake/Anodot OAuth tokens functioned as valid, MFA-bypassing access throughout the ShinyHunters campaign.
   • ADT was breached by vishing an employee’s Okta SSO account, then pivoting into Salesforce.
   • Carnival was breached via a single phished employee account.
3. System error / Cloud Misconfiguration (Salesforce-hosted public webpage flavor)
   • McGraw Hill’s 13.5M leak was attributed to a Salesforce-hosted public webpage misconfiguration affecting multiple Salesforce customers — no authenticated intrusion required.

Notable Attack Patterns

• ShinyHunters’ Salesforce Extortion Wave — the threat actor of the month: A single threat actor (also tracked as UNC6040) was tied to disclosed breaches at Rockstar Games, Marcus & Millichap, Pitney Bowes, McGraw Hill, Kemper, Medtronic, Inditex, Carnival, Canada Life, ADT, Amtrak, Hallmark, and Udemy in a single month. The pattern: vishing → stolen Salesforce/Okta credentials → CRM data exfiltration → “pay-or-leak” extortion with a 3-to-7-day deadline. Encryption-based ransomware is no longer the operating model; data-theft-and-leak is.
• GTA VI–Timed Pressure on Rockstar Games: With Grand Theft Auto VI scheduled for November 19, 2026 release, ShinyHunters’ April 14 dump of 78.6M Rockstar records (multi-domain GTA Online / Red Dead Online analytics) illustrates how threat actors increasingly time disclosures for maximum business and reputational impact rather than just financial extortion.
• Fourth-party / nth-party Vendor Risk Crystallized at Adobe: The attacker reportedly did not breach Adobe directly — they breached an Indian BPO contractor with privileged helpdesk access, deployed a RAT via malicious email, escalated to a manager via ClickFix social engineering, then exfiltrated 13M+ tickets and Adobe’s complete HackerOne bug-bounty submission archive via the support platform’s bulk-export function.
• French National Identity-Document Authority Hit: France Titres / ANTS — the agency that issues French passports, ID cards, and driver’s licenses — was breached on April 15, 2026, with threat actor “breach3d” claiming up to 19M records. CNIL, the Paris Public Prosecutor, and ANSSI are all involved.
• Cybersecurity Vendor Itself Compromised: BePrime (Mexico-based cybersecurity firm) was breached on April 20 via admin accounts that lacked MFA, giving the attacker live surveillance camera access and operational control of 1,858 network devices and 2,600+ connected devices at downstream clients including Iberdrola, Whirlpool, and Alsea.

---

Incident-by-Incident Detailed Analysis

---

1. Rockstar Games — 78.6 Million Records Leaked (Largest Single Dump of April 2026)

• Affected entity: Rockstar Games, developer of Grand Theft Auto and Red Dead Redemption franchises (subsidiary of Take-Two Interactive).
• Why this matters: With Grand Theft Auto VI scheduled for a November 19, 2026 release, the timing of this breach is uniquely sensitive. Although Rockstar describes the leaked data as “non-material,” the dataset is alleged to contain in-game revenue metrics, player behavior tracking, and game-economy data for GTA Online and Red Dead Online — competitive intelligence of significant value to other studios and to threat actors targeting players. The attack pattern (Anodot → Snowflake token abuse) is a textbook example of SaaS-to-SaaS trust-chain compromise, with implications well beyond gaming. At 78.6 million records, this is the largest single publicly-released dataset of April 2026.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters compromised Anodot, an Israeli AI-powered cloud-cost-monitoring and analytics SaaS used by Rockstar, and extracted authentication tokens that allowed the group to impersonate a legitimate internal service and silently access Rockstar’s connected Snowflake data warehouse. ShinyHunters listed Rockstar on April 11, 2026 with an April 14 deadline; after Rockstar declined to negotiate, the group published 78.6M records on April 14, 2026.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1195 Supply Chain Compromise / T1199 Trusted Relationship): The attack entered through Anodot’s compromised environment; Anodot’s privileged access tokens to Snowflake provided the lateral pathway into Rockstar.
  • Compromised credentials (T1078 Valid Accounts): Stolen Anodot authentication tokens were used as valid, trusted credentials against Snowflake — no Snowflake vulnerability was exploited.
• Exposed data: Multi-domain analytics data used for GTA Online and Red Dead Online, including in-game revenue and purchase metrics, player behavior tracking, and game-economy data. No traditional consumer PII identified in the public dump.
• Volume: ~78.6 million records publicly leaked.

---

2. Marcus & Millichap — 30 Million+ Salesforce Records Claimed

• Affected entity: Marcus & Millichap, Inc. (major US commercial real estate brokerage; investment sales, financing, research, advisory services).
• Why this matters: Real-estate transaction data combined with PII is a particularly high-value dataset for fraud, identity theft, and targeted social engineering against high-net-worth investors. The 30M-record claim places this incident among the largest single-victim disclosures of the month.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters listed Marcus & Millichap on its leak site on April 11, 2026, claiming 30M+ Salesforce records compromised. A “final warning” with an April 14 deadline was issued. Part of ShinyHunters’ broader Salesforce-focused extortion campaign.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts): Salesforce credentials obtained earlier in 2026 through social-engineering / vishing campaigns targeting Salesforce-customer employees.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): The attack leveraged the trust relationship between Marcus & Millichap and the Salesforce SaaS platform.
  • Phishing (T1566): Underlying credential-theft technique consistent with the broader UNC6040 vishing playbook.
• Exposed data: PII and internal corporate data within Salesforce CRM records (specific fields not publicly itemized as of disclosure).
• Volume: 30M+ records claimed by the threat actor.

---

3. Pitney Bowes — 8.2M Unique Emails Released / 25M+ Salesforce Records Claimed

• Affected entity: Pitney Bowes Inc. (US global shipping, mailing, and ecommerce-logistics services provider).
• Why this matters: Beyond customer PII, the breach exposed a subset of Pitney Bowes employee records with job titles — useful for crafting highly targeted business email compromise (BEC) attacks against the company’s own staff and partners. The combination of mailing/shipping customer data with detailed employee-org information creates secondary risk for invoice-fraud and supplier-impersonation campaigns across the wider logistics ecosystem.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters listed Pitney Bowes on its leak site around April 18, 2026, claiming 25M+ Salesforce records compromised and demanding payment by April 21. After the deadline, the group publicly released the dataset, which Have I Been Pwned indexed at 8.2M unique email addresses. Part of ShinyHunters’ broader Salesforce-focused extortion wave.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts): Salesforce credentials harvested through ShinyHunters’ 2026 vishing/social-engineering campaign.
  • Phishing (T1566): Underlying credential-theft technique against Salesforce-customer employees.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce as the targeted SaaS data repository.
• Exposed data: Names, email addresses, phone numbers, physical addresses; subset of Pitney Bowes employee records with job titles.
• Volume: 8.2M unique email addresses publicly released; ShinyHunters claimed 25M+ Salesforce records.

---

4. France Titres / ANTS — Up to 19 Million Records Claimed at French National ID Authority

• Affected entity: France Titres / ANTS (Agence nationale des titres sécurisés) — French national agency that manages secure identity documents, vehicle registrations, and government identity portals.
• Why this matters: A breach at a national identity-document authority is uniquely high-impact. Even though the agency states the data does not grant direct access to portals, the combination of personal identifiers, place of birth, and account identifiers is highly weaponizable for impersonation, document fraud, phishing, and social engineering targeting French citizens. The incident has triggered involvement from CNIL (French data protection authority), the Paris Public Prosecutor, and ANSSI (French national cybersecurity agency).
• Threat actor: A threat actor operating under the alias “breach3d”
• Attack methodology: France Titres detected the breach on April 15, 2026 on its ants.gouv.fr portal. Threat actor “breach3d” claimed up to 19M records were stolen. ANTS notified affected individuals and engaged CNIL, prosecutorial, and ANSSI authorities.
• Attack Vector:
  • Vulnerability exploitation (T1190 Exploit Public-Facing Application): The specific technical entry point has not been publicly disclosed, but the attack appears to have exploited weaknesses in the public-facing portal.
• Exposed data: Login IDs, full names, email addresses, dates of birth, account identifiers; in some cases postal addresses, places of birth, and phone numbers.
• Volume: Up to 19M records (attacker claim).

---

5. McGraw Hill — 13.5M Unique Emails (Salesforce-hosted Webpage Misconfiguration)

• Affected entity: McGraw Hill (one of the world’s “Big Three” educational publishers, headquartered in Ohio).
• Why this matters: An education publisher’s customer base spans students, educators, and institutions globally — including minors in some segments. The leaked dataset of 13.5M unique email addresses with names, phone numbers, and addresses is a goldmine for spear-phishing aimed at educators (often holders of institutional credentials) and credential-stuffing attacks against re-used passwords. The incident illustrates how a single SaaS misconfiguration can cascade into a multi-million-record exposure across multiple Salesforce customers.
• Threat actor: ShinyHunters (UNC6040)
• Attack methodology: ShinyHunters listed McGraw Hill in mid-April 2026 claiming up to 45M Salesforce records, with an April 14 ransom deadline. After the deadline lapsed, the group dumped 100+ GB of data containing 13.5M unique email addresses on April 15. McGraw Hill confirmed the breach as a Salesforce-hosted webpage misconfiguration affecting multiple Salesforce customers, and stated its core systems and customer databases were not breached.
• Attack Vector:
  • System error / misconfiguration (related to T1562 Impair Defenses, indirectly): A misconfigured Salesforce-hosted public webpage exposed customer data without requiring authenticated intrusion.
  • Vulnerability exploitation (T1190 Exploit Public-Facing Application): Threat actors enumerated the misconfigured public-facing Salesforce community/site to harvest data at scale.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): The underlying platform was a third-party SaaS environment (Salesforce) hosting McGraw Hill data.
• Exposed data: Email addresses, names, phone numbers, physical addresses (fields appearing inconsistently across records). SSNs and financial data stated by McGraw Hill to be out of scope.
• Volume: 13.5M unique email addresses confirmed; ShinyHunters claimed up to 45M Salesforce records.

---

6. Kemper Corporation — ~13M Salesforce Records (29 GB)

• Affected entity: Kemper Corporation (Chicago-based insurance provider with ~$12 billion in assets).
• Why this matters: A large insurance-sector breach where Salesforce records containing customer PII and Stripe payment logs were exposed. The combination of identity data with transaction amounts increases identity-fraud and pretexting risk.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters posted Kemper data on its dark web leak site on April 15, 2026, claiming 29 GB of data covering 13M+ Salesforce records, consistent with the broader April Salesforce campaign.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce CRM as the targeted SaaS platform.
  • Compromised credentials (T1078 Valid Accounts): Consistent with the UNC6040 pattern of using stolen Salesforce credentials.
  • Phishing (T1566): Consistent with the broader UNC6040 vishing playbook used to obtain Salesforce credentials, although the specific entry point at Kemper has not been publicly disclosed.
• Exposed data: Internal corporate documents, employee training materials, employee names and email addresses, and Stripe payment logs containing customer names and transaction amounts.
• Volume: 29 GB / ~13M Salesforce records.

---

7. Adobe (alleged, unconfirmed by Adobe) — ~13M Support Tickets + HackerOne Archive Claim

• Affected entity: Adobe Inc. (California-based software company).
• Why this matters: Beyond the volume of customer support tickets, the alleged inclusion of Adobe’s complete HackerOne bug-bounty submission archive is the most consequential element. If accurate, the attacker would possess detailed, potentially-unpatched vulnerability disclosures across Adobe’s product portfolio — a roadmap for future exploitation against millions of Adobe customers. The incident also underscores fourth-party / nth-party vendor risk, as the entry point was a contracted BPO firm rather than Adobe itself.
• Threat actor: A threat actor calling himself “Mr. Raccoon” — probabilistic links by Google Threat Intelligence Group to the UNC6783 cluster.
• Attack methodology: Mr. Raccoon claimed in early April 2026 to have breached Adobe’s customer-support environment via an Indian BPO contractor. The attacker reportedly sent a malicious email to a BPO employee deploying a Remote Access Tool (RAT), then pivoted to a manager account using spearphishing and ClickFix techniques, ultimately exfiltrating data through the support platform’s bulk-export functionality.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship / T1195 Supply Chain Compromise): The attack entered through a contracted BPO firm with privileged access to Adobe’s helpdesk environment.
  • Phishing — Spearphishing Attachment (T1566.001): Initial access via malicious email to a BPO employee delivering a RAT.
  • Phishing — Spearphishing Link / ClickFix social engineering (T1566.002): A second-stage phishing attack escalated access from the BPO employee to their manager.
  • Compromised credentials (T1078 Valid Accounts): Manager-level credentials used to access bulk customer data.
• Exposed data (per attacker claim): ~13M customer support tickets containing PII and issue descriptions; ~15K employee records; Adobe’s complete HackerOne bug-bounty program submissions; internal documents.
• Volume: 13M support tickets and 15K employee records (claimed; not officially confirmed by Adobe as of late April 2026).

---

8. Medtronic — 9M+ Records Claimed at World’s Largest Medical Device Maker

• Affected entity: Medtronic plc (world’s largest medical device manufacturer by revenue, ~$33.5B; 90,000 employees in 150 countries).
• Why this matters: A medical device giant of this scale handling sensitive corporate and potentially personal data is a high-value target. Although Medtronic states product, manufacturing, and patient-safety systems were segmented and unaffected, a 9M-record breach at a healthcare-adjacent vendor raises concerns about downstream phishing and identity-fraud risk, regulatory scrutiny, and reputational impact on a critical-infrastructure-tier supplier.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters listed Medtronic on its Tor leak site on April 18, 2026, claiming theft of 9M+ records and terabytes of internal data, with an April 21 ransom deadline. Medtronic disclosed the breach via SEC 8-K filing on April 24. The listing was later removed from the leak site, suggesting possible negotiation or payment.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts): Consistent with ShinyHunters’ broader Salesforce-focused 2026 campaign — initial access typically obtained through stolen Salesforce credentials harvested via vishing/social engineering against employees of victim organizations. Medtronic has not publicly confirmed the specific entry point.
  • Phishing (T1566): Underlying credential-theft technique consistent with UNC6040 patterns.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Consistent with the broader April Salesforce-related campaign.
• Exposed data: PII (per attacker claim, not officially confirmed by Medtronic) and “terabytes of internal corporate data.”
• Volume: 9M+ records (claimed by ShinyHunters; not independently verified).

---

9. Carnival Corporation — 8.7M Records / 7.5M Unique Emails (Holland America Mariner Society)

• Affected entity: Carnival Corporation (Carnival Cruise Line, Princess Cruises, Holland America, Cunard).
• Why this matters: The leaked dataset specifically related to Holland America’s Mariner Society loyalty program, demonstrating the secondary-data risk of customer loyalty platforms. Exposure of dates of birth and gender alongside contact data significantly raises identity-theft and account-takeover risk for affected travelers. Cruise customer records are particularly attractive for impersonation and pretexting because they include travel itineraries and are tied to travel-document workflows.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters listed Carnival on its leak site on April 18, 2026, claiming 8.7M+ records with an April 21 deadline. After the deadline, the group published the full dataset containing 8.7M records and 7.5M unique email addresses. Carnival confirmed the entry point was a phishing incident affecting a single user account.
• Attack Vector:
  • Phishing — Spearphishing Link (T1566 / T1566.002): A single user account was compromised via phishing.
  • Compromised credentials (T1078 Valid Accounts): The phished account’s valid credentials enabled access to systems holding loyalty-program customer data.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce-hosted CRM data within the broader April wave.
• Exposed data: Names, email addresses, dates of birth, gender, and loyalty-program (Mariner Society) status data.
• Volume: 8.7M records / 7.5M unique email addresses.

---

10. Canada Life Assurance Company — 5.6M+ Records

• Affected entity: Canada Life Assurance Company (Winnipeg-based insurance and financial services; one of the largest insurers in Canada).
• Why this matters: A large financial-services breach in Canada with elevated regulatory exposure under PIPEDA and provincial privacy law.
• Threat actor: ShinyHunters
• Attack methodology: Part of the same April 2026 ShinyHunters extortion wave; specific intrusion details have not been publicly disclosed.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce CRM.
  • Compromised credentials (T1078 Valid Accounts): Consistent with UNC6040 patterns.
  • Phishing (T1566): Consistent with UNC6040 entry tactics.
• Exposed data: PII (specific field-level disclosure pending).
• Volume: 5.6M+ records.

---

11. ADT — 5.5M Individuals Confirmed (Okta SSO Vishing → Salesforce)

• Affected entity: ADT Inc. (oldest and largest US home-security provider, founded 1874; 6M+ residential and small-business monitoring customers).
• Why this matters: A home-security breach is uniquely sensitive because the threat actor obtains addresses of homes that explicitly chose to install alarm monitoring — a population with a higher concentration of valuables. The combination of names, addresses, phone numbers, dates of birth, and partial SSN/Tax IDs is high-value for both identity fraud and physical-security targeting (phishing impersonating ADT support, social-engineering scams about “alarm system upgrades”). Critically, no payment information or customer security system data was accessed.
• Threat actor: ShinyHunters
• Attack methodology: ADT detected unauthorized access to its cloud environments on April 20, 2026 and disclosed the incident via SEC 8-K filing on April 24, 2026. ShinyHunters listed ADT on its leak site on April 23 claiming 10M+ records, with an April 27 deadline. ADT did not pay; ShinyHunters publicly released an 11 GB archive on April 27. Have I Been Pwned indexed the breach with 5.5M unique email addresses confirmed exposed. ShinyHunters told BleepingComputer they breached ADT by compromising an employee’s Okta SSO account through a vishing attack, then pivoted into ADT’s Salesforce instance.
• Attack Vector:
  • Phishing — Vishing (T1566): Voice-phishing call against an ADT employee to harvest Okta SSO credentials.
  • Compromised credentials (T1078 Valid Accounts): The stolen Okta SSO session enabled authenticated access to ADT’s cloud and Salesforce environments, bypassing technical controls because the access looked legitimate.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): The Okta-to-Salesforce trust chain was exploited; Salesforce was the actual data repository accessed.
• Exposed data: Names, phone numbers, physical addresses, email addresses; in a smaller percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs. No payment information; home security systems were not affected per ADT.
• Volume: 5.5M individuals confirmed via Have I Been Pwned; ShinyHunters claimed 10M+ records.

---

12. Citizens Bank — 3.5 Million Customers (Third-Party Breach)

• Affected entity: Citizens Financial Group (Rhode Island-based bank holding company, founded 1828).
• Why this matters: A retail-banking breach affecting account-level information for millions of customers, with elevated risk of account takeover and targeted financial fraud.
• Threat actor: Not publicly attributed at time of writing.
• Attack methodology: Citizens Bank was breached via a cyberattack on a third-party company; specifics of the intermediary have not been disclosed.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1195 Supply Chain Compromise / T1199 Trusted Relationship): Citizens Bank itself was not directly breached; the attackers reached customer data through an external party that processed or stored Citizens Bank data.
• Exposed data: Customer names, addresses, and account numbers.
• Volume: 3.5 million customers.

---

13. Amtrak — 2.1M Unique Emails Confirmed (9.4M Records Claimed)

• Affected entity: Amtrak (National Railroad Passenger Corporation, the US national passenger rail operator).
• Why this matters: As critical national transportation infrastructure, Amtrak’s customer base and travel patterns are valuable for both criminal phishing and potentially intelligence-collection use cases. The breach revealed 2.1M+ unique accounts with exposed data including names, emails, addresses, and customer support records. Customer support records and travel histories enable highly contextual social-engineering attacks because attackers can reference real prior interactions in phishing messages. Amtrak’s customer base includes frequent business and government travelers, making this dataset particularly attractive for follow-on targeting.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters claimed in April 2026 that 9.4M Salesforce records had been obtained from Amtrak. After ransom negotiations failed, the group published the dataset, which Have I Been Pwned indexed on April 17, 2026 with 2.1M unique email addresses. The intrusion is attributed to ShinyHunters’ broader 2026 Salesforce social-engineering campaign.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts): Salesforce credentials harvested earlier in 2026 from Amtrak employees via social engineering.
  • Phishing — Vishing (T1566): The initial credential-theft phase relied on phishing/vishing of employees.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce CRM as the targeted SaaS platform.
• Exposed data: Email addresses, full names, physical addresses, and customer support records / support ticket history.
• Volume: 2.1M unique email addresses confirmed via Have I Been Pwned; ShinyHunters claimed 9.4M records.

---

14. Hallmark — 1.7M Unique Emails / ~6.2M Records Across 20 Files

• Affected entity: Hallmark Cards, Inc. and the Hallmark+ streaming service.
• Why this matters: Hallmark customer data, including support-ticket histories, enables highly personalized scams targeting customers around occasions (birthdays, anniversaries, condolences) that the threat actor can infer from purchase records. The dataset includes both legacy Hallmark customers and Hallmark+ streaming subscribers.
• Threat actor: ShinyHunters
• Attack methodology: Hallmark was allegedly breached on March 9, 2026 with attackers accessing the company’s Salesforce environment. After ransom demands were not met, ShinyHunters dumped the 9.59 GB dataset on April 12, 2026. Have I Been Pwned indexed it on April 13, 2026.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts): Salesforce credentials obtained via ShinyHunters’ broader 2026 Salesforce social-engineering campaign.
  • Phishing (T1566): Underlying credential-theft technique.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce CRM as the targeted SaaS platform.
• Exposed data: Full names, email addresses, phone numbers, physical addresses, and historical customer support tickets.
• Volume: 1.7M unique email addresses (~6.2M total records across 20 files).

---

15. Udemy — 1.4M Unique Emails Leaked (Includes Instructor Payout Methods)

• Affected entity: Udemy, Inc. (one of the world’s largest online learning marketplaces).
• Why this matters: The leaked dataset is unusually rich for a Salesforce-derived breach: in addition to standard customer PII, it includes instructor payout method details (PayPal, bank transfers, cheques) and employer information. This combination provides attackers with everything needed to run targeted invoice-fraud, fake-payment-update, and tax-fraud scams against Udemy instructors — a particularly vulnerable population because instructors transact with Udemy financially.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters listed Udemy on its leak site on April 24, 2026 with a “Pay or Leak” warning and a final deadline of April 27, 2026. After the deadline, the group released a 2.3 GB dataset containing 1.4M+ records from Udemy’s Salesforce environment. Have I Been Pwned indexed the dataset on April 26, 2026.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts): Salesforce credentials harvested via ShinyHunters’ 2026 vishing/social-engineering campaign against Salesforce-customer employees.
  • Phishing (T1566): Underlying credential-theft technique.
  • Third-party vendor / Supply chain compromise (T1199 Trusted Relationship): Salesforce CRM as the targeted SaaS platform.
• Exposed data: 1.4M unique email addresses (customers and instructors), names, physical addresses, phone numbers, employer information, and instructor payout methods (PayPal, cheque, bank transfer).
• Volume: 1.4M unique email addresses publicly leaked.

---

16. Basic-Fit — ~1M Members Across Six Countries (Including Bank Account Details)

• Affected entity: Basic-Fit (Europe’s largest gym chain, 5.8M+ registered members and 2,150+ clubs across 12 countries — Netherlands, Belgium, France, Spain, Germany, Luxembourg, etc.).
• Why this matters: Unlike most April 2026 incidents, the Basic-Fit breach exposed bank account details — directly enabling SEPA direct-debit fraud and account-takeover risk for affected European members. The combination of names, addresses, dates of birth, and banking information is one of the most directly fraud-enabling datasets disclosed this month.
• Threat actor: Not publicly attributed; no group has claimed responsibility.
• Attack methodology: Basic-Fit detected unauthorized access to the system that records members’ visits to its clubs. Although the access was blocked within minutes of detection by system-monitoring processes, an external forensic investigation found that data on roughly 1M members across six countries had been downloaded by the attacker. Disclosed April 13, 2026; affected members and the relevant data-protection authority were notified.
• Attack Vector:
  • Others (technical entry point not publicly disclosed): Basic-Fit has not disclosed the attack technique. The brief intrusion-to-detection window plus high data volume is consistent with either compromised credentials (T1078) against an internal application or a vulnerability exploitation event (T1190) against the visit-tracking system, but neither has been publicly confirmed.
• Exposed data: Names, home addresses, email addresses, phone numbers, dates of birth, and bank account details. No identification documents (Basic-Fit does not store these) and no passwords accessed.
• Volume: ~1M members affected (200,000 in the Netherlands plus members across Belgium, Luxembourg, France, Spain, and Germany).

---

17. Rituals — Undisclosed Subset of 41M+ “My Rituals” Loyalty Database

• Affected entity: Rituals (Netherlands-based luxury cosmetics and home-fragrance brand, 1,400+ retail boutiques and 4,800 luxury perfumeries across 33 countries; €2.4B revenue in 2025).
• Why this matters: The “My Rituals” loyalty database has 41M+ members across Europe, the UK, and the United States. Although Rituals has not disclosed the exact affected count, the upper bound is one of the largest single-victim data exposures of the month. Loyalty-program data of this scale is highly weaponizable for phishing campaigns built around occasion-based purchasing patterns (gifts, birthdays, beauty subscriptions). The breach also fits a broader pattern of European retail loyalty-database breaches in 2026 (Co-op, Marks & Spencer), suggesting a coordinated targeting campaign or shared tooling.
• Threat actor: Not publicly attributed; no group has claimed responsibility as of disclosure.
• Attack methodology: Rituals identified an “unauthorized download” of My Rituals member data in April 2026 and disclosed the breach on April 22, 2026 via website notice and direct email to affected customers. Rituals stated that access was contained immediately upon discovery; relevant authorities (including the Dutch Data Protection Authority / Autoriteit Persoonsgegevens) were notified, and an external forensic investigation is underway. The company has not disclosed the technical entry point.
• Attack Vector:
  • Others (technical entry point not publicly disclosed): Rituals has declined to comment on attribution or attack vector for security reasons. The pattern (large-scale unauthorized data download from a customer database) is consistent with either compromised credentials (T1078) or an exposed application interface (T1190), but neither has been publicly confirmed.
• Exposed data: Full name, date of birth, gender, postal address, email address, phone number, preferred Rituals store, and account type. No passwords or payment information accessed (per Rituals).
• Volume: Exact affected count not disclosed; the My Rituals database contains 41M+ members worldwide.

---

18. Inditex (Zara, Bershka, Stradivarius) — Tied to the Anodot/Snowflake Wave

• Affected entity: Inditex (world’s largest clothing retailer; parent of Zara, Bershka, Stradivarius, Pull&Bear, Oysho, etc.; 7,200+ stores in 93 markets).
• Why this matters: Inditex itself reports that no customer names, contact information, passwords, or payment data were exposed — only commercial transaction records. However, the breach is significant because it is part of a multi-victim event tied to a “former technology provider” and overlaps with ShinyHunters’ Snowflake/Anodot attack wave (the same path used in the Rockstar Games breach), illustrating the cascading risk of shared SaaS and AI-analytics infrastructure across retail giants.
• Threat actor: ShinyHunters (claimed via the Anodot/Snowflake compromise)
• Attack methodology: Inditex publicly disclosed unauthorized access on April 15, 2026 (detected April 16) involving customer transaction databases hosted by a third-party (former) technology provider. ShinyHunters separately claimed to have compromised Zara’s BigQuery instances via the prior compromise of Israeli AI-analytics firm Anodot — the same access path used in the Rockstar Games Snowflake breach.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1195 / T1199): The breach originated at a former technology / AI-analytics provider (Anodot) that had access to Inditex BigQuery / Snowflake environments.
  • Compromised credentials (T1078 Valid Accounts): Cloud-data-warehouse credentials obtained through the upstream Anodot compromise.
• Exposed data: Commercial transaction records (per Inditex). No customer names, addresses, passwords, or payment data per Inditex’s statement.
• Volume: Inditex did not publish a record count. ShinyHunters’ broader Snowflake-wave campaign affects multiple multinational retailers; volume specific to Inditex is undisclosed but is grouped within multi-million-record claims for the wave.

---

19. Vercel — Cloud Platform Breached via June 2024 Context.ai OAuth Compromise

• Affected entity: Vercel (San Francisco-based cloud application platform widely used for hosting JavaScript / Next.js applications).
• Why this matters: The Vercel incident is the clearest example in April of how a single compromised AI-tool OAuth grant can give attackers long-lived, password-independent access to a major cloud infrastructure provider, with downstream supply-chain implications for everyone deploying on Vercel. Multiple employee accounts with access to internal deployments, API keys, NPM tokens, GitHub tokens, source code, and database data were claimed to be in the dataset; NPM token theft in particular raises supply-chain risk for any package maintained from Vercel.
• Threat actor: A threat actor claiming affiliation with ShinyHunters posted the data on BreachForums on April 19, 2026; ShinyHunters itself denied involvement.
• Attack methodology: By compromising a single AI tool, the attacker bypassed traditional perimeter defenses and gained long-lived, password-independent access to a major cloud infrastructure provider. Specifically, the attacker leveraged a compromised OAuth integration with Context.ai, a third-party AI tool authorized to access Vercel’s environment. The initial compromise of the Context.ai OAuth application occurred around June 2024 — meaning the attacker had persistent access for an extended dwell time before exploitation became visible.
• Attack Vector:
  • Third-party vendor / Supply chain compromise (T1199 / T1195): The trust boundary between Vercel and Context.ai was the entry point. The attacker did not breach Vercel directly; they breached an AI tool that had been granted broad OAuth scopes into Vercel’s systems.
  • Compromised credentials (T1078 Valid Accounts): The stolen OAuth tokens functioned as valid, MFA-independent credentials, enabling persistent access.
• Exposed data: Multiple Vercel employee accounts with access to internal deployments, API keys, NPM tokens, GitHub tokens, source code, and database data (claimed by the attacker).
• Volume: ~580 records of employee information claimed by the attacker; broader infrastructure access also claimed but not fully verified at time of writing.

---

20. BePrime — Cybersecurity Vendor Hit, Live Surveillance Camera Access at Downstream Clients

• Affected entity: BePrime (Mexico-based cybersecurity company serving large Latin American enterprises including Iberdrola, Whirlpool, and Alsea — operator of Domino’s, Starbucks, and Vips outlets).
• Why this matters: A breach at a cybersecurity vendor that managed network and surveillance devices for major industrial clients. The data exposed included plaintext credentials, security audit reports, and live surveillance camera access — meaning the breach gave attackers operational access to physical-security infrastructure at downstream clients, not just data.
• Threat actor: Not publicly attributed at time of writing.
• Attack methodology: On April 20, 2026, an attacker infiltrated BePrime admin accounts that lacked MFA, harvested API keys, and took control of 1,858 network devices and 2,600+ connected devices belonging to BePrime clients. Data was posted on a data breach forum.
• Attack Vector:
  • Compromised credentials (T1078 Valid Accounts / T1110 Brute Force): Admin accounts lacking MFA were the initial entry point.
  • Third-party vendor / Supply chain compromise (T1195 / T1199): Once inside BePrime, the attacker used BePrime’s privileged position as a security vendor to reach 4,000+ devices at downstream clients including Iberdrola and Whirlpool.
• Exposed data: 12.6 GB including plaintext credentials, transaction records, security audit reports, and live surveillance camera access; affected downstream clients include Iberdrola, Whirlpool, and Alsea.
• Volume: 12.6 GB; 1,858 network devices and 2,600+ connected devices under attacker control.

---

21. KelpDAO — $292M DeFi Loss

• Affected entity: KelpDAO (decentralized cryptocurrency staking platform; rsETH protocol).
• Why this matters: A high-impact crypto incident with $292M in financial loss across multiple platforms that depend on KelpDAO. Included for systemic significance to the broader DeFi ecosystem despite the absence of a traditional PII record count.
• Threat actor: Not publicly attributed at time of writing.
• Attack methodology: On April 18, 2026, KelpDAO detected suspicious activity that forced it to pause operations and rsETH contracts. Investigation is ongoing.
• Attack Vector:
  • Vulnerability exploitation (T1190 Exploit Public-Facing Application): Consistent with typical DeFi exploits where smart contract or protocol-level vulnerabilities are abused for unauthorized fund movement; specific technical root cause has not been publicly confirmed.
• Exposed data: Financial assets (no traditional PII disclosure reported).
• Volume: $292M in loss; record count not applicable.

---

22. Asian Football Confederation (AFC) — ~150K Members Including Cristiano Ronaldo, Passport Scans

• Affected entity: The Asian Football Confederation (supreme governing body of football, futsal, and beach soccer across most of Asia).
• Why this matters: Although the absolute number of affected individuals (~150,000) is below the 1M threshold, this incident is included for systemic significance: it is described as one of the largest data breaches in football history, and the dataset includes high-profile individuals (including Cristiano Ronaldo) along with passport scans, which carry an unusually elevated identity-fraud and impersonation risk.
• Threat actor: Not publicly attributed at time of writing.
• Attack methodology: Attackers exfiltrated AFC’s member database and posted highly sensitive personal details on a dark web forum.
• Attack Vector:
  • Others: Insufficient public information to attribute a definitive vector.
• Exposed data: Passport scans, emails, contract details, and AFC registration files for players, coaches, and other members.
• Volume: ~150,000 members. > ※ Included for systemic significance despite being below the 1M threshold.

---

References

1. SharkStriker — April 2026 Data Breaches: 15+ Major Incidents & Latest Updates
2. TechCrunch — Cosmetics giant Rituals confirms data breach of customer membership records
3. BleepingComputer — Cosmetics giant Rituals discloses data breach affecting customers
4. BleepingComputer — Data breach at edtech giant McGraw Hill affects 13.5 million accounts
5. The Register — McGraw Hill linked to 13.5M-record data leak
6. CyberInsider — McGraw Hill data breach incident exposed 13.5 million accounts
7. Rescana — McGraw-Hill Salesforce Data Breach 2026: Analysis of ShinyHunters Extortion and Cloud Misconfiguration Risks
8. Rescana — ADT Salesforce Data Breach 2026: ShinyHunters Compromise Okta SSO via Vishing Attack
9. Have I Been Pwned — Amtrak Data Breach
10. UpGuard — Amtrak data breach exposes over 2 million customer records
11. Cybernews — Hackers threaten to leak over 9M Amtrak records, including personal info
12. SC Media — Amtrak allegedly breached by ShinyHunters, massive data leak threatened
13. Cyber News Centre — 23rd April 2026 Cyber Update: Vercel Breach Exposes Critical Flaw in AI Tool OAuth Permissions
14. Strobes — Vercel Security Breach 2026: How One AI Tool Did It
15. MINE2 — Anodot SaaS Breach: ShinyHunters Stole OAuth Tokens to Hit Dozens of Companies
16. State of Surveillance — Rockstar Games Breached Through a Tool It Probably Forgot It Had
17. centrexIT — The Attack Surface Most Companies Aren’t Watching: Their CRM
18. Security Boulevard — Cisco CRM “Salesforce Data Breach” Claims Tied to ShinyHunters
19. Security Boulevard — Amtrak Data Breach Exposes Millions of Customer Records
20. ComplianceHub.Wiki — Rituals Cosmetics Confirms Membership Database Breach: GDPR Notification, Dutch AP, and the Loyalty Program Risk Pattern
21. Privacy Guides — Data Breach Roundup (Apr 17 – 23, 2026)
22. CM-Alliance — Major Cyber Attacks, Data Breaches, Ransomware Attacks in April 2026
23. ShieldWorkz — Incident report: The McGraw Hill Salesforce breach
24. The420.in — McGraw Hill Data Breach Exposes 1.35 Million Users After Salesforce Flaw
25. National CIO Review — 13.5 Million Accounts Affected in Latest ShinyHunters Campaign

This report compiles major data breaches disclosed between January 1 and March 31, 2026 that affected 1 million+ individuals. The selection criterion is the disclosure / notification date, not the date of the underlying breach — some incidents involved earlier intrusions but were publicly disclosed (or had their scope materially expanded) during Q1 2026.

Each case is analyzed for victim profile, threat actor, attack methodology, Attack Vector, exposed data types, and impact volume. The Attack Vector taxonomy used in this report follows the IBM Cost of a Data Breach Report categories, with the corresponding MITRE ATT&CK technique mappings noted for each vector to support threat-modeling and detection-engineering use cases.

Executive Summary

Top 10 Incidents by Exposure Volume (Disclosure Date)

Rank	Incident	Scale	Disclosed
1	IDMerit (KYC identity verification SaaS)	~3 billion records exposed (~1B sensitive KYC records, 1TB, 26 countries)	Feb 18, 2026
2	Infutor (Verisk Marketing Solutions)	~676.8 million records (KYC/PII)	March 2026
3	Conduent (US gov IT services contractor)	25 million+ people (8TB+)	February 2026 (expanded)
4	Cegedim MonLogicielMedical (French healthcare SW)	15.8 million patients	March 3, 2026
5	CarGurus (online auto marketplace)	12.6M accounts / 17M records	February 2026
6	Match Group (Hinge / Match / OkCupid)	10+ million records	January 28, 2026
7	Crunchyroll (anime streaming)	~6.8 million users	March 2026
8	Odido (Netherlands telecom)	6.2 million customers	February 2026
9	Mercer Advisors (wealth management)	5.7 million records	Feb 16-23, 2026
10	Kyowon Group (South Korean education / lifestyle)	5.5+ million customers	January 2026

Most Frequently Exposed Data Types

1. Personally Identifiable Information (PII) — names, addresses, emails, phone numbers (in nearly every incident)
2. Social Security Numbers / National IDs — Conduent, Navia, Infutor, IDMerit, FICOBA, Mercer, Hightower, TriZetto, etc.
3. Health/Medical Information (PHI) — Conduent, Cegedim, TriZetto, QualDerm, NYC Health, Navia (HSA/FSA), UH Cancer Center
4. Financial / Banking Information — Odido (IBAN), FICOBA, Mercer Advisors, Figure Technology, Brightspeed
5. Behavioral / Usage Data — Match Group (dating profiles), Crunchyroll (viewing), Panera (orders), CarGurus

Top 3 Attack Vectors of Q1 2026

1. Compromised credentials (SSO Vishing-driven theft) — Dominant #1 of the quarter
   • ShinyHunters’ Okta SSO vishing campaign was the common root cause of most mega-breaches.
   • Match Group, CarGurus, Panera, Crunchbase, Mercer Advisors, Beacon Pointe, Pathstone, Betterment, Allianz Life — a single threat actor hit ~100 organizations simultaneously.
2. Third-party vendor & Supply chain compromise
   • Conduent → state governments + Volvo, AppsFlyer → Match Group, Navia → HackerOne + hundreds, TriZetto → OCHIN + dozens, QualDerm → 158 dermatology practices, NYC Health Hospitals → external vendor.
3. System error / Cloud Misconfiguration (the new mega-exposure standard)
   • IDMerit (unauthenticated MongoDB, 3B records), Infutor (Elasticsearch, 676M records), Illinois DHS (4-year public exposure) — mega-scale exposure without an external attacker even needing to break in.

Notable Attack Patterns

• ShinyHunters’ SSO Vishing Campaign — the threat actor of the quarter: Throughout January–February 2026, the group struck ~100 organizations simultaneously. Voice phishing (vishing) to steal Okta/Microsoft/Google SSO credentials, then exfiltration from SaaS data stores (AppsFlyer, Salesforce, Google Drive, etc.). Standard MFA (SMS, OTP) is defeated by AiTM phishing — only phishing-resistant MFA (FIDO2/Passkey) is effective.
• Healthcare Business Associate (BA) Onslaught: Conduent, TriZetto, QualDerm, Navia and other HIPAA business associates became single points of failure for hundreds of providers and employers. According to HIPAA Journal, ~9.6 million individuals’ US healthcare records were exposed in the first two months of 2026 alone.
• Wealth Management (RIA) Industry Under Coordinated Attack: Mercer Advisors (5.7M), Beacon Pointe, Pathstone, Hightower, Edelman Financial Engines, EP Wealth, Cetera, Ameriprise, Betterment (1.4M) — wealth management firms became targets of ShinyHunters’ campaign. Lack of MFA is the common allegation across class actions.
• Cloud Misconfiguration produced the #1 and #2 incidents of the quarter: IDMerit and Infutor were both exposures, not break-ins. Attackers didn’t need to penetrate anything.
• Iran-linked Wiper Attack on Stryker (March 11) — not data theft but MS Intune-abused global device wipe. 79 countries, 200,000+ devices affected.

---

Incident-by-Incident Detailed Analysis

---

1. IDMerit — ~3 Billion Records Exposed (~1B sensitive KYC records, 26 countries)

• Affected entity: IDMerit (California-based AI-powered KYC identity verification SaaS provider). Serves fintech, financial services, telecom, and other regulated sectors with real-time identity verification and AML screening.
• Why this matters: The single largest exposure of Q1 2026. US: ~203M records, Mexico: 124M, Philippines: 72M, Germany / Italy / France: 50M+ each. KYC data is uniquely dangerous — SSNs, national IDs, telecom metadata are permanent identifiers that cannot be reset like passwords. Fuels SIM-swapping, account takeover, targeted phishing, credit fraud, “long-tail privacy harms” (damage years later). Discovery November 11, 2025 → secured November 12 → public disclosure February 18, 2026 (99 days later) — disclosure delay carries regulatory significance.
• Threat actor: None confirmed (no evidence of malicious access; Cybernews researchers warned automated crawlers continuously scan for exposed databases and typically index them within hours).
• Attack methodology: A MongoDB instance was left exposed to the public internet with no authentication required. Anyone with the URL could read, copy, export, or delete the entire 1TB of contents without credentials. Not an external attack — a cloud misconfiguration.
• Attack Vector:
  • System error (IT failure / misconfiguration): Missing authentication and access controls on the MongoDB instance. A basic authentication control — standard in any production database deployment — would have prevented the entire exposure. Maps indirectly to T1562 (Impair Defenses).
• Exposed data: Full names, residential addresses and postal codes, dates of birth, national identity numbers (SSN or equivalent), phone numbers, gender, email addresses, telecom metadata (mobile network info — exploitable for SIM swapping), breach status / social profile annotations
• Volume: ~3 billion records (1TB), of which ~1 billion are sensitive KYC PII. 26 countries. > ※ After Cybernews published, IDMerit issued a statement (Feb 26, 2026) saying that “while the company owns and operates its own proprietary platform, IDMerit does not own, control, or store customer data or the underlying data maintained by independent data sources.” Some KYC industry outlets (e.g., KYCFrance) raised questions about Cybernews’s reporting. However, Cybernews published screenshots and samples of the exposed MongoDB instance, and multiple outlets corroborated. This report records both the multi-source confirmation and IDMerit’s partial denial.

---

2. Infutor (Verisk Marketing Solutions) — ~676.8 Million Records Exposed

• Affected entity: Infutor (consumer identity verification and identification data analytics platform), serving insurance, consumer finance, higher education, real estate.
• Why this matters: The #2 single-incident exposure of Q1 2026 (676M records). KYC-grade identity data including SSNs becomes raw fuel for large-scale identity fraud campaigns on the dark web. Even consumers who never directly transacted with Infutor are affected — they had no way of knowing their data was even held by Infutor.
• Threat actor: Not publicly attributed (discovered via dark web posting)
• Attack methodology: Per SOCRadar’s analysis, a misconfigured Elasticsearch database was publicly exposed to the open internet. No authentication required — over 676 million records were accessible. Closer to persistent exposure than active intrusion.
• Attack Vector:
  • System error (IT failure / misconfiguration): Missing authentication and access controls on the Elasticsearch index, exposed directly to the internet. (T1562 indirect mapping.)
• Exposed data: Full names, dates of birth, physical addresses, phone numbers, Social Security Numbers (SSNs)
• Volume: 676,798,866 unique records

---

3. Conduent — 25 Million+ Affected (8TB+) — Disclosure Expanded in Feb 2026

• Affected entity: Conduent Inc. (NJ-based US government IT services contractor). Processes medical billing, toll transactions, prepaid cards for government programs. Manages data for 100M+ individuals.
• Why this matters: Texas alone reported 15.4 million affected; Oregon reported 10.5 million. One of the largest healthcare-related breaches in US history. Permanent identifiers (SSNs cannot be changed) make this a lifelong identity-theft risk. A single government contractor became a systemic single point of failure for nationwide PII/PHI exposure. Multiple consolidated class actions. The Texas Attorney General announced an investigation in February 2026 referencing potential 192M+ impact (under investigation).
• Threat actor: SafePay ransomware group
• Attack methodology: Initial access October 21, 2024; detected January 13, 2025 — roughly 3 months of dwell time during which 8TB+ was exfiltrated. After the initial 2025 SEC filing, the affected count steadily expanded: ~4 million → 10 million → finally 25 million+ confirmed in February 2026.
• Attack Vector:
  • Vulnerability exploitation (T1190): Initial access vector not officially disclosed; presumed exploitation of an internet-facing system.
  • Compromised credentials (T1078): Three-month dwell with lateral movement using valid accounts.
  • Third-party / Trusted relationship (T1199): Conduent itself is a trusted third-party vendor to state governments and major employers; its compromise propagated to clients including Volvo Group (~17,000 employees confirmed exposed).
• Exposed data: Full names, Social Security Numbers, dates of birth, addresses, medical records, health insurance details, treatment information, claims data
• Volume: 25+ million people (8.5TB)

---

4. Cegedim MonLogicielMedical — 15.8 Million French Patients

• Affected entity: Cegedim (French healthcare software company); MonLogicielMedical platform used by 3,800 French physicians
• Why this matters: One of the largest healthcare data breaches in European history. 165,000 files contained doctors’ free-text notes including HIV status, psychiatric diagnoses, sexual orientation, and mental-health conditions. Politicians were among the exposed. The most damning detail: France’s CNIL had already fined Cegedim €800,000 in September 2024 for unlawfully processing this exact category of health data — clearly insufficient remediation. Late 2025 intrusion → criminal complaint filed October 2025 → silence for four months until France24’s report forced March 3, 2026 confirmation. Disclosure delay is itself a major issue.
• Threat actor: Not publicly attributed
• Attack methodology: Late 2025 intrusion into the MonLogicielMedical platform. 15.8 million patient records exfiltrated.
• Attack Vector:
  • Vulnerability exploitation (T1190) or Compromised credentials (T1078): Specific entry path not disclosed.
  • Third-party / Supply Chain (T1199): SaaS for 3,800 doctors — single compromise cascaded to all those physicians’ patient records.
• Exposed data: Full names, dates of birth, medical records, doctors’ free-text notes (HIV status, psychiatric diagnoses, sexual orientation, mental-health conditions), prescriptions, health insurance information
• Volume: 15.8 million patient records

---

5. CarGurus — 12.6M Accounts / 17M Records

• Affected entity: CarGurus (Boston-based online automotive marketplace)
• Why this matters: One of the largest publicly-reported consumer breaches in February 2026. Australian security researcher Troy Hunt was the first to flag it via Have I Been Pwned, before CarGurus issued formal disclosure. A class-action suit alleges CarGurus failed to provide adequate breach notification. Part of the broader ShinyHunters social-engineering wave.
• Threat actor: ShinyHunters
• Attack methodology: ShinyHunters used social engineering (vishing) to compromise credentials and infiltrate CarGurus systems. ~17 million records and 12.6 million accounts exfiltrated.
• Attack Vector:
  • Compromised credentials (T1078): Employee SSO credentials stolen via ShinyHunters’ vishing — attacker accessed systems as a legitimate user.
  • Phishing (T1566): Voice phishing (vishing) of employees.
• Exposed data: Email addresses, account creation dates, user UUIDs, internal IDs, internal corporate records, IP addresses, PII (names, addresses, etc.)
• Volume: ~17 million records / 12.6 million accounts

---

6. Match Group (Hinge / Match.com / OkCupid) — 10+ Million Records

• Affected entity: Match Group (operator of Tinder, Hinge, Match.com, OkCupid, Meetic, etc.)
• Why this matters: Dating-app data is among the most psychologically sensitive consumer data. Exposure of user IDs, IPs, locations, matches, and subscription transaction details enables highly targeted phishing, romance scams, and extortion. Match stated passwords, financial data, and private messages were not impacted. The flagship example of ShinyHunters’ Okta SSO vishing campaign.
• Threat actor: ShinyHunters (also known as Scattered LAPSUS$ Hunters)
• Attack methodology: Voice phishing to steal a Match Group employee’s Okta SSO credentials → access to AppsFlyer marketing-analytics instance → exfiltration of user usage data. Phishing domain matchinternal.com was confirmed.
• Attack Vector:
  • Phishing (T1566) — specifically vishing. T1566.002 (Spearphishing Link) when combined with the lookalike Okta login domain.
  • Compromised credentials (T1078) — stolen Okta SSO account.
  • Third-party vendor & Supply chain (T1199) — AppsFlyer, a trusted third-party analytics platform, was the exfiltration channel (though AppsFlyer denies its own systems were breached).
• Exposed data: User IDs, IP addresses, Hinge subscription transaction IDs and amounts, match records, dating profile bios, locations, phone numbers, authentication tokens, internal employee emails, internal corporate contracts
• Volume: 10+ million records (1.7GB compressed archive)

---

7. Crunchyroll — ~6.8 Million Users (Anime Streaming)

• Affected entity: Crunchyroll (major anime streaming platform)
• Why this matters: Global user base affected. ~100GB of data including customer service ticket data — exposure of email + support inquiries makes for excellent targeted-phishing fuel.
• Threat actor: Not publicly attributed (hacker self-claim)
• Attack methodology: March 2026 unauthorized access. Customer service ticket system breach.
• Attack Vector:
  • Compromised credentials (T1078) or Vulnerability exploitation (T1190): Specific path not disclosed.
• Exposed data: ~100GB of data — user information and customer service ticket content (likely emails, inquiry contents)
• Volume: ~6.8 million (per hacker claim)

---

8. Odido — 6.2 Million Customers (Netherlands Telecom)

• Affected entity: Odido (major Dutch telecom operator)
• Why this matters: One of the largest single-telco incidents of Q1. Includes passport / driver’s license details for some customers, raising significant identity-theft risk. GDPR-applicable — Dutch DPA notified. Passwords, call records, billing, and location data were not impacted.
• Threat actor: Not publicly attributed
• Attack methodology: Unauthorized access detected over the weekend of February 7, 2026. Customer contact system breached, data exfiltrated.
• Attack Vector:
  • Compromised credentials (T1078) or Vulnerability exploitation (T1190): Specific vector not disclosed.
• Exposed data: Full names, addresses, email addresses, mobile numbers, customer numbers, IBANs, dates of birth, passport or driver’s license details (for some)
• Volume: 6.2 million customers

---

9. Mercer Advisors — 5.7 Million Records (Wealth Management)

• Affected entity: Mercer Advisors (Denver-based, one of the largest US RIAs — $96B+ AUM)
• Why this matters: The flagship example of ShinyHunters’ coordinated attack against the wealth management industry. Lack of MFA is the central allegation in the class actions. Wealth-management data — SSNs, asset levels, tax IDs — becomes raw material for high-stakes targeted fraud, hyper-credible phishing, and even physical extortion of high-net-worth individuals. Mercer refused ransom → data dumped to dark web. Two class actions filed (March 2 — Berger v. Mercer; March 6 — Amick v. Mercer).
• Threat actor: ShinyHunters
• Attack methodology: ~February 16, 2026 — vishing-based intrusion. Data exfiltrated from Salesforce environment. 48-hour ransom ultimatum → Mercer refused → February 18 data publication. Of 5,704,000 records, approximately 1.3 million contain deep PII.
• Attack Vector:
  • Phishing (T1566) — vishing impersonating IT support, persuading employees to install malicious Salesforce Data Loader or grant access tokens.
  • Compromised credentials (T1078) — stolen credentials used to access Salesforce.
  • Third-party vendor (T1199) — Salesforce environment used as the breach pathway.
• Exposed data: Full names, contact information (postal/email addresses, phone), full or partial SSNs, driver’s license numbers, government-issued IDs (passport), dates of birth, financial account numbers, Tax IDs, reported annual income and net worth valuations, emergency contacts, contract documents, legal documents
• Volume: ~5.7 million records (~1.3M with deep PII)

---

10. Kyowon Group — 5.5+ Million Customers (South Korean Education / Lifestyle)

• Affected entity: Kyowon (major South Korean education / culture / hospitality conglomerate; offers educational services, health appliances, hotels)
• Why this matters: Largest South Korean breach of Q1 2026. 600 of Kyowon’s 800 servers were impacted — operational disruption alongside data theft. Subject to South Korea’s PIPA — regulatory response will be closely watched.
• Threat actor: Not publicly attributed (ransomware group)
• Attack methodology: January 2026 ransomware attack — 600 of 800 servers impacted, operations significantly disrupted alongside data exfiltration.
• Attack Vector:
  • Vulnerability exploitation (T1190) or Compromised credentials (T1078): Specific entry path not disclosed; classic ransomware pattern.
• Exposed data: Customer data of ~5.5 million people (specific data types still under investigation)
• Volume: 5.5+ million people

---

11. Panera Bread — 5.1 Million Accounts (Jan breach, disclosed in Feb)

• Affected entity: Panera Bread (large US bakery-cafe chain)
• Why this matters: ShinyHunters extortion → refusal → data leak pattern. Panera had already settled a 2024 breach for $2.5 million in January 2026, and was breached again — a repeat-offender pattern raising governance concerns. ShinyHunters claimed 14M records, but Have I Been Pwned analysis confirmed ~5.1M unique accounts.
• Threat actor: ShinyHunters
• Attack methodology: January 2026 social-engineering-based intrusion. Panera refused ransom; ShinyHunters released a 760MB archive in retaliation.
• Attack Vector:
  • Phishing (T1566) + Compromised credentials (T1078): Same ShinyHunters vishing playbook.
• Exposed data: Names, email addresses, phone numbers, physical addresses
• Volume: ~5.1 million unique accounts (ShinyHunters claimed 14M)

---

12. TriZetto Provider Solutions (Cognizant) — 3.43 Million Patients

• Affected entity: TriZetto Provider Solutions (Cognizant subsidiary, US healthcare IT provider). Eligibility/verification SaaS used by health insurers and providers.
• Why this matters: One of Q1’s largest healthcare incidents. Initial access November 19, 2024; detected October 2, 2025 — ~11 months of undetected dwell. Potential HIPAA violation. Notification began February 6, 2026; March 2026 confirmed scope (3,433,965 individuals). OCHIN (an EHR SaaS) also impacted — ~9% of OCHIN’s patient base (~700,000) separately affected. 44+ HIPAA-covered entities have issued their own notifications — actual blast radius is likely larger.
• Threat actor: Not publicly attributed (no ransomware group has claimed responsibility)
• Attack methodology: November 19, 2024 — unauthorized external network access began → October 2, 2025 — suspicious activity detected on TriZetto’s web portal → external cybersecurity experts engaged → November 28, 2025 — confirmed PHI exfiltration → February 6, 2026 — Maine AG notification + individual notifications begin.
• Attack Vector:
  • Vulnerability exploitation (T1190): External network → web portal compromise (specific CVE not disclosed).
  • Compromised credentials (T1078): 11-month dwell — likely use of valid accounts.
  • Third-party / Supply Chain (T1199): TriZetto is a business associate to many healthcare entities — single breach cascaded across dozens of organizations and 3.4M patients.
• Exposed data: Names, addresses, dates of birth, SSNs, insurance details, provider information (financial data not affected)
• Volume: 3,433,965 individuals

---

13. QualDerm Partners — 3.12 Million Patients

• Affected entity: QualDerm Partners (Tennessee-based; provides healthcare management services to 158 dermatology, skin cancer care, cosmetics, plastic surgery, and pathology practices in 17 US states). Serves ~15M patients annually.
• Why this matters: One of the largest healthcare incidents of Q1. Despite a brief intrusion window (December 23-24, 2025), 3.12M patient records were extracted in just 2 days — aggressive, surgical data hunting. Affects 17 states. Date of death also exposed — heightened identity-theft risk for surviving family members. Notification delay (Dec 24 detection → Feb 22 notification start) raises class-action exposure.
• Threat actor: Not publicly attributed
• Attack methodology: December 24, 2025 — anomalous activity identified. Forensic investigation confirmed unauthorized access between December 23-24, 2025. February 22, 2026 — notification mailing began. March 2026 — formal reporting to Oregon AG / OCR.
• Attack Vector:
  • Specific vector not disclosed — Compromised credentials (T1078) or Vulnerability exploitation (T1190) likely.
  • Third-party / Supply Chain (T1199): Single management-services provider compromise → 158 practices’ patient data exposed.
• Exposed data: Names, addresses, dates of birth, doctor names, medical record numbers, dates of death, email addresses, treatment and diagnosis information, health insurance information; for some, government-issued ID (driver’s license)
• Volume: 3,117,874 individuals

---

14. Navia Benefit Solutions — 2.7 Million

• Affected entity: Navia (US benefits administration company managing HSA, FSA, HRA, COBRA services). 10,000+ client companies, 1M+ direct participants.
• Why this matters: A single benefits-SaaS provider’s breach exposed employee data across hundreds of client companies simultaneously — including HackerOne (yes, the bug bounty platform). HackerOne identified the root cause as a BOLA (Broken Object Level Authorization) vulnerability in Navia’s API. Classic supply-chain blast radius. Washington State Health Care Authority also impacted — ~27,000 Medicaid members and other state employees.
• Threat actor: Not publicly attributed
• Attack methodology: Intrusion between December 22, 2025 and January 15, 2026. Exploitation of an exposed API with a Broken Object Level Authorization flaw — authenticated users could access other users’ objects without authorization. January 23 — Navia detected suspicious activity. March 13, 2026 — substitute notice posted; March 18 — individual notifications.
• Attack Vector:
  • Vulnerability exploitation (T1190): BOLA flaw in API — object-level authorization missing; authenticated users could read other users’ data.
  • Third-party vendor / Supply chain (T1199): Navia is a benefits administrator for hundreds of clients — single breach cascaded to all client employees.
• Exposed data: Social Security Numbers, names, dates of birth, phone numbers, email addresses, addresses, HRA/FSA/COBRA enrollment information, plan dates (enrollment, effective, termination), Navia ID numbers, employee IDs, dependent information
• Volume: 2,697,540 individuals

---

15. Crunchbase — 2M+ Records

• Affected entity: Crunchbase (global business intelligence / company information platform)
• Why this matters: A platform widely used by investors, startups, and VCs was compromised. Exposed data includes PII alongside contracts and executive contact details — superb fuel for targeted spear-phishing. Part of the same January cluster of ShinyHunters’ SSO vishing campaign.
• Threat actor: ShinyHunters
• Attack methodology: December 2025 vishing campaign targeting Google/Microsoft/Okta SSO. January 23, 2026 — ShinyHunters posted ~400MB compressed archive on the dark web after Crunchbase declined to pay ransom. January 26 — Crunchbase confirmed the breach.
• Attack Vector:
  • Phishing (T1566) — vishing.
  • Compromised credentials (T1078) — stolen SSO credentials.
• Exposed data: Names, contact details (addresses, phone, email), job information, contracts, internal corporate documents, executive contact details
• Volume: 2M+ records (~400MB compressed archive)

---

16. Allianz Life — ~1.4 Million (Investigation/Notification Expanded, Feb 2026)

• Affected entity: Allianz Life Insurance Company of North America (Minnesota-based, subsidiary of German Allianz Group)
• Why this matters: July 2025 cloud CRM breach (Salesforce-based) had its scope significantly expanded in Q1 2026, with class-action investigation announced February 25, 2026 at 1,497,036 individuals affected. Have I Been Pwned confirmed exposure of 1.1M records. Part of ShinyHunters’ Salesforce-targeting campaign — the precursor to the broader RIA / insurance-industry mega-breaches in this quarter.
• Threat actor: ShinyHunters (Scattered Spider suspected)
• Attack methodology: July 16, 2025 — social engineering (vishing) compromised a third-party cloud-CRM system. ShinyHunters extracted ~2.8M data records (individual customers + business partners) from Salesforce instances.
• Attack Vector:
  • Phishing (T1566) — vishing.
  • Compromised credentials (T1078) — Salesforce SSO.
  • Third-party vendor (T1199) — third-party CRM (Salesforce).
• Exposed data: Names, addresses, dates of birth, SSNs, email addresses, gender, phone numbers
• Volume: 1,497,036 individuals (HIBP confirmed 1.1M) > ※ Original breach occurred July 2025, but scope expansion (1.4M) and class-action investigations were disclosed in Q1 2026 — included on disclosure-date basis.

---

17. Betterment — ~1.4 Million (Robo-Investing Platform)

• Affected entity: Betterment (automated investment / robo-advisor platform)
• Why this matters: Part of ShinyHunters’ coordinated RIA / fintech campaign. A notable detail: a DDoS attack was used as a diversion tactic during data exfiltration. Follow-up fraud campaigns impersonating Betterment staff target users.
• Threat actor: ShinyHunters
• Attack methodology: January 9, 2026 — social-engineering attack began. Threat actors gained access to third-party operational platforms used for marketing and customer support. January 13 — DDoS attack mitigated within hours but suspected to be a diversion tactic during active data exfiltration. February 5 — leaked dataset surfaced on Have I Been Pwned.
• Attack Vector:
  • Phishing (T1566) — exploiting human vulnerabilities.
  • Compromised credentials (T1078) — third-party platform credential theft.
  • Denial-of-service (DoS) (T1498/T1499) — January 13 DDoS as diversion during exfiltration.
• Exposed data: Names, email addresses; for some customers, physical addresses, phone numbers, dates of birth, employer details
• Volume: ~1.4 million customers

---

18. Brightspeed — 1M+ Customers (Broadband Telecom)

• Affected entity: Brightspeed (US fiber broadband provider, 20 states; Connect Holding II LLC)
• Why this matters: Single-ISP incident. Attackers (Crimson Collective) claim ability to remotely disconnect customers from service — a threat dimension beyond data theft. Four class actions filed (federal courts in NC, OH, VA, TX).
• Threat actor: Crimson Collective (extortion gang)
• Attack methodology: January 4, 2026 — Telegram post claiming 1M+ records stolen. January 6 — sample data released as proof. Demand: 3 BTC (~$276,000).
• Attack Vector:
  • Compromised credentials (T1078) or Vulnerability exploitation (T1190): Specific vector not disclosed.
• Exposed data: Names, emails, phone numbers, billing/service addresses, account status, network type, consent flags, billing system, payment history, partial payment-card information, appointment/order records, site IDs
• Volume: 1M+ customers

---

19. NYC Health + Hospitals — 1M+ Patients (March 24 Notification)

• Affected entity: New York City Health and Hospitals Corporation (largest US public healthcare system, serving 1M+ patients annually)
• Why this matters: Compromise of America’s largest public healthcare system. Unauthorized access from November 25, 2025 to February 11, 2026 — ~2.5 months. Highly sensitive data exposed (biometrics, SSNs, financial accounts). Entry pathway identified as a third-party vendor breach.
• Threat actor: Not publicly attributed
• Attack methodology: February 2, 2026 — suspicious activity detected. Investigation with external cybersecurity professionals confirmed unauthorized access November 25, 2025 to February 11, 2026, with file copying. Initial pathway: third-party vendor security breach. March 24 — public notice issued.
• Attack Vector:
  • Third-party vendor (T1199): Vendor compromise → access to NYC Health systems.
  • Compromised credentials (T1078): Long dwell suggests valid-account lateral movement.
• Exposed data: Health insurance details, medical records (diagnoses, medications, test results, treatment plans), biometric data (fingerprints, palm prints), billing/payment information, SSNs, driver’s license numbers, financial account details, online account credentials
• Volume: 1M+ patients (specific count under investigation; system serves 1M+ patients per year)

---

20. FICOBA (French National Bank Account Registry) — 1.2 Million

• Affected entity: Fichier National des Comptes Bancaires et Assimilés (FICOBA) — French national bank account registry
• Why this matters: Compromise of national financial infrastructure — a government system holding metadata on every bank account in France. Sharply elevates targeted-financial-fraud risk against French citizens.
• Threat actor: Not publicly attributed
• Attack methodology: Late January 2026 breach. 1.2 million accounts impacted. Specific intrusion path not disclosed.
• Attack Vector:
  • Specific vector not disclosed. Likely Vulnerability exploitation (T1190) or Compromised credentials (T1078).
• Exposed data: Bank account metadata (presumably account holder names, account numbers, banking institutions)
• Volume: 1.2 million accounts

---

21. University of Hawaii Cancer Center — ~1.2 Million (Expanded Disclosure)

• Affected entity: University of Hawaii Cancer Center (Epidemiology Division)
• Why this matters: A textbook research-data risk. Long-retained research data (collected 1993–2007) highlights the importance of data retention policy — old data that arguably should have been deleted became a liability. Contrary to early reporting, the breach includes names, SSNs, driver’s license data, voter registration data, plus four research studies and two additional files of names/SSNs collected for epidemiological research.
• Threat actor: Ransomware group (specifics not disclosed)
• Attack methodology: August 2025 intrusion; scope expanded to ~1.15M and disclosed in February–March 2026.
• Attack Vector:
  • Vulnerability exploitation (T1190): Ransomware pattern.
• Exposed data: Names, Social Security Numbers, driver’s license data, voter registration data, epidemiological research data (with SSNs)
• Volume: ~1.2 million people

---

22. Eurail — 1.3TB Data Offered for Sale (January)

• Affected entity: Eurail (European integrated rail pass provider)
• Why this matters: GDPR-applicable. Includes passport details for travelers — high identity-theft and targeted-phishing risk. Data offered for sale on Telegram with samples.
• Threat actor: Not publicly attributed
• Attack methodology: ~January 10, 2026 — unauthorized access discovered. Attackers claim 1.3TB exfiltrated from cloud storage and support systems.
• Attack Vector:
  • Compromised credentials (T1078) or Cloud misconfiguration (T1530 — Data from Cloud Storage): Specific vector not disclosed.
• Exposed data: Names, contact details, travel companion details, passport information (numbers and expiry dates)
• Volume: 1.3TB (specific headcount under investigation, but Eurail’s user base suggests likely 1M+)

---

23. LexisNexis — ~3.9 Million Database Records (March Disclosure)

• Affected entity: LexisNexis (legal and data analytics firm)
• Why this matters: Exposed users include federal judges, DOJ attorneys, and SEC staff (118 confirmed) — extreme sensitivity. Root cause was an unpatched, publicly known critical CVE (React2Shell, CVSS 10.0) — a hard-to-defend governance failure. Class-action exposure rising post-disclosure.
• Threat actor: FulcrumSec
• Attack methodology: Initial access February 24, 2026; confirmed March 3. Exploited React2Shell vulnerability (publicly known since November 2025; patches available since early December) on an unpatched frontend application to enter the AWS environment. Over-permissioned IAM roles then enabled lateral movement from the frontend container into production databases and into AWS Secrets Manager (where 53 credentials were stored in plaintext). 2.04GB exfiltrated.
• Attack Vector:
  • Vulnerability exploitation (T1190 — Exploit Public-Facing Application): React2Shell (CVSS 10.0) used against an unpatched frontend.
  • Compromised credentials (T1078, T1555): 53 plaintext credentials harvested from AWS Secrets Manager and used for lateral movement.
• Exposed data: 3.9 million database records, 21,042 customer accounts, 400,000 user profiles (118 belonging to federal judges, DOJ attorneys, and SEC staff)
• Volume: 2.04GB / 3.9M database records / 400K user profiles

---

24. Nike — 1.4TB Internal Data Exfiltrated (January Disclosure)

• Affected entity: Nike
• Why this matters: While the affected-individual count is undisclosed, the 1.4TB of internal files represents serious internal design and manufacturing IP exposure rather than primarily user data. 188,347 items — claimed by the WorldLeaks extortion gang. Sustained intrusion (not a smash-and-grab) implied by data volume.
• Threat actor: WorldLeaks extortion group
• Attack methodology: Specific intrusion path not disclosed. ~1.4TB of design and manufacturing-related internal files exfiltrated. Volume implies long-dwell access.
• Attack Vector:
  • Specific entry vector not disclosed — possible Compromised credentials (T1078), Third-party (T1199), or Vulnerability exploitation (T1190).
• Exposed data: 188,347 internal files (design and manufacturing-related, 1.4TB)
• Volume: 1.4TB / 188,347 files (consumer-PII headcount unclear, but included for scale and sensitivity)

---

25. Stryker — Global Device Wiper Attack (March 11)

• Affected entity: Stryker (Fortune 500 medical device manufacturer; 56,000 employees, 79 countries; $25.1B in 2025 revenue)
• Why this matters: The most jolting attack of Q1 2026 — operational paralysis rather than data theft. Iran-linked group Handala abused Stryker’s MS Intune console to issue an enterprise-wide remote wipe command. Across 79 countries, employees watched in real time as their corporate laptops and BYOD personal phones were factory-reset. Stryker’s Lifenet ECG transmission system became nonfunctional across most of Maryland, forcing emergency services to fall back to radio. Separate from the wipe, employee data was stolen — 6+ employee class-action lawsuits filed (also tied to a previously undisclosed 2024 breach with PII/medical-records exfiltration). Handala claimed 50TB exfiltration (likely inflated).
• Threat actor: Handala (Iran-linked, suspected MOIS connection, overlap with MuddyWater / TA450)
• Attack methodology: March 11, 2026, ~03:30 EST — attack launched. AiTM (Adversary-in-the-Middle) phishing (Tycoon 2FA suspected) → MFA bypass → Intune admin credential theft → enterprise wipe policy executed via Intune console → 200,000+ devices wiped. Attacker also used a non-malware file to execute commands and evade threat detection.
• Attack Vector:
  • Phishing (T1566) — AiTM phishing campaign defeats standard MFA (SMS/OTP). Tycoon 2FA platform suspected.
  • Compromised credentials (T1078) — Intune admin credentials stolen and used as a valid account.
  • Denial-of-service (T1499 — Endpoint DoS): Mass endpoint wipe equates to operational shutdown.
  • Valid accounts + Living-off-the-land: No malware deployed — abuse of native Intune functionality evades detection.
• Exposed data: Employee PII, medical records (including from a separate 2024 breach now under class-action review). For the March 2026 attack itself, 50TB exfiltration claim remains unverified.
• Volume: 200,000+ devices wiped / 79 countries, employee PII (specific count being established through class actions)

---

26. Coinbase — Insider Breach (Feb 3 Disclosure)

• Affected entity: Coinbase (global cryptocurrency exchange)
• Why this matters: Insider breach — a fundamentally different governance problem from external attacks. Internal support tool screenshots were leaked online. Specific impact headcount undisclosed but reputationally significant for a major exchange.
• Threat actor: Malicious insider
• Attack methodology: Disclosed February 3, 2026. Internal support tool screenshots leaked online and later removed.
• Attack Vector:
  • Malicious insider: Authorized internal user intentionally exposed data (potentially T1078 — Valid Accounts, T1530 — Data from Cloud Storage).
• Exposed data: Internal support tool screenshots (specific underlying data not disclosed)
• Volume: Not disclosed > ※ Whether the affected count exceeds 1 million is not confirmed, but included for symbolic relevance as a major-exchange incident.

---

27. Illinois & Minnesota Department of Human Services — ~1 Million Combined (January Disclosure)

• Affected entities: Illinois DHS (700K+) and Minnesota DHS (303K) — US state human services agencies
• Why this matters: In the Illinois incident, sensitive information sat publicly accessible on the open internet for FOUR YEARS — an internal-use website for resource allocation and decision-making was inadvertently made publicly accessible. The Minnesota breach resulted from excessive internal access leading to improper disclosure. Both incidents required no external attacker — pure system error and insider-error categories — yet produced mega-scale exposure. Strong signal that misconfiguration is now first-class breach risk.
• Threat actor: None (internal error / system failure)
• Attack methodology: Illinois — internal-use website unintentionally exposed to public internet for 4 years. Minnesota — excessive internal access permissions resulted in improper information disclosure.
• Attack Vector:
  • System error (IT failure / misconfiguration): Illinois — public-exposure misconfiguration. (T1562 indirect.)
  • Insider error: Minnesota — overprivileged internal access leading to improper exposure.
• Exposed data: Illinois — names, addresses, case numbers, case status, referral information. Minnesota — names, addresses, emails, dates of birth, phone numbers, Medicaid IDs, first 4 digits of SSNs, other PHI.
• Volume: ~1 million combined

---

References

1. PKWARE — 2026 Data Breaches
2. SharkStriker — January 2026
3. SharkStriker — February 2026
4. Strobes Security — February 2026
5. Strobes Security — March 2026
6. Security Boulevard — January 2026
7. Security Boulevard — Navia 2.7M
8. Security Magazine — January 2026
9. Security Magazine — February 2026
10. HIPAA Journal — January 2026 Healthcare Report
11. HIPAA Journal — February 2026 Healthcare Report
12. HIPAA Journal — Navia
13. HIPAA Journal — TriZetto
14. HIPAA Journal — QualDerm
15. HIPAA Journal — Stryker
16. Cyber Management Alliance — January 2026
17. Cyber Management Alliance — March 2026
18. PrivacyGuides — Data Breach Roundup
19. BleepingComputer — Match Group
20. BleepingComputer — TriZetto
21. BleepingComputer — Allianz Life
22. The Register — ShinyHunters Match Group
23. The Register — Brightspeed
24. Cybernews — Hinge/OkCupid leak
25. Cybernews — IDMerit
26. Cybernews — QualDerm
27. Cybernews — Mercer / Beacon Pointe
28. Cybernews — ShinyHunters RIA
29. Malwarebytes — Conduent
30. Malwarebytes — Brightspeed
31. TechRepublic — Conduent
32. SC Media — Conduent 25M
33. Fox Business — Conduent 25M
34. IDStrong — Conduent
35. ClassAction.org — Infutor
36. ClassAction.org — Mercer Advisors
37. CPO Magazine — Navia
38. InvestmentNews — Hightower (industry-wide RIA attacks)
39. InvestmentNews — Mercer Advisors
40. WealthManagement — Mercer
41. Financial Planning — Mercer
42. CyberPress — Betterment
43. CyberSecurityNews — TriZetto
44. SecurityWeek — QualDerm
45. SecurityWeek — Allianz Life
46. NYC Health — Notice of Data Breach
47. Beckers Hospital Review — NYC Health
48. Tech.co — 2026 Data Breaches
49. BrightDefense — Recent Data Breaches
50. BrightDefense — IDMerit
51. BrightDefense — Crunchbase
52. Zyphe — IDMerit
53. Lumos Blog — Stryker Hack
54. Guardz — Stryker
55. The National CIO Review — Brightspeed
56. Anonhaven — AppsFlyer SDK
57. UpGuard — Match Group
58. SWK Technologies — February 2026 Recap
59. KYCFrance (counter-narrative) — Cybernews-Fueled Cyber Anxiety: Fake IDMerit Breach Story