Weekly briefing › No. 10
Weekly briefing · No. 10 · 19 Mar 2026
North American data breaches in 2026 have exposed tens of millions of records across healthcare, financial services, and government sectors.
Recent disclosures reveal systematic vulnerabilities in third-party vendor management and credential-based attacks.
This issue’s disclosures
CriticalFeb 26
Conduent
Healthcare · 25M records
Attackers spent three months inside Conduent's environment exfiltrating 8TB of healthcare and benefits data from Medicaid systems, SNAP programs, and health insurers.
What it means: One of the largest healthcare-related breaches on record affects millions of benefit recipients, creating identity theft and fraud exposure.
Feb 26
HighJan 31
Panera Bread
Credential Theft · 5.1M records
Attackers obtained customer contact data and published a 760MB archive containing names, emails, phone numbers, and addresses after ransom demands were refused.
What it means: Customer personal information is now available for phishing campaigns and identity fraud targeting Panera's 5 million affected accounts.
Jan 31
CriticalMar 05
University of Hawaii
Healthcare · 1.2M records
Ransomware gang breached the Cancer Center's Epidemiology Division in August 2025, stealing names, Social Security numbers, driver's license data, and voter registration information.
What it means: Compromised sensitive health and identity data puts patients at severe risk for identity theft and targeted fraud.
Mar 05
CriticalFeb 07
Odido
Infrastructure · 6.2M records
Attackers breached customer contact systems and downloaded names, addresses, emails, mobile numbers, dates of birth, and identification details from 6.2 million customers.
What it means: Customers face targeted phishing, SIM swap attacks, and account takeovers using verified identity and contact information.
Feb 07
HighJan 19
IBM/Colorado
Healthcare · 4.1M records
Hackers exploited a MOVEit file transfer vulnerability to steal 4.1 million Colorado patient records including protected health information.
What it means: Healthcare providers relying on vulnerable MOVEit systems face ongoing exposure until patches are applied enterprise-wide.
Jan 19
HighFeb 14
Figure Technology
Credential Theft · 967K records
Social engineering attack tricked an employee into providing access, allowing attackers to download user account data including names, dates of birth, addresses, and phone numbers.
What it means: Nearly one million user accounts are exposed to identity theft and phishing campaigns targeting verified personal information.
Feb 14
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 10, by the category we filed each one under.