Weekly briefing › No. 11
Weekly briefing · No. 11 · 19 Mar 2026
Six major 2026 breaches across North America exposed tens of millions of records through healthcare system compromises, retail attacks, and ransomware incidents.
Patient data, customer information, and sensitive government records remain the primary targets as attackers exploit third-party vulnerabilities and credential theft.
This issue’s disclosures
CriticalJan 15, 2026
Conduent
Healthcare · 25M+ records
A ransomware gang breached the business services provider handling Medicaid, SNAP, and benefits processing for over 30 states, exfiltrating approximately 8 TB of sensitive data including names, Social Security numbers, medical records, and health insurance details.
What it means: Millions of Americans receiving government benefits had their personal and health information exposed, requiring notifications across multiple states and triggering at least 10 class action lawsuits.
Jan 15, 2026
CriticalJan 08, 2026
IBM MOVEit (Colorado)
Healthcare · 4.1M records
Attackers exploited a MOVEit file transfer vulnerability to access a healthcare system's database, stealing sensitive patient health records from Colorado residents.
What it means: Millions of patients' confidential medical information became accessible to criminals, increasing risk of identity theft and fraudulent insurance claims.
Jan 08, 2026
HighJan 24, 2026
Panera Bread
Credential Theft · 5.1M records
A criminal group compromised Panera's systems through a Microsoft security weakness and published a stolen archive containing customer names, emails, phone numbers, and addresses after the company refused their ransom demand.
What it means: Millions of frequent Panera customers face heightened phishing and identity fraud risks from widely available contact information.
Jan 24, 2026
HighFeb 15, 2026
Canada Goose
Financial · 1M records
A third-party breach from August 2025 exposed customer transaction records containing names, addresses, phone numbers, and email addresses for the Canadian apparel company.
What it means: The luxury retailer's customer base became vulnerable to targeted phishing and fraud campaigns using verified purchase and personal contact information.
Feb 15, 2026
CriticalJan 15, 2026
CIRO
Financial · 750K records
A phishing attack in August 2025 led to the theft of investor Social Insurance Numbers and financial data, with the breach remaining undetected for months until mid-January notification.
What it means: Thousands of Canadian investors face significant identity theft and financial fraud risk from compromised regulatory records.
Jan 15, 2026
HighFeb 28, 2026
VIQ Solutions
Credential Theft · Undisclosed records
An Indian subcontractor improperly accessed sensitive legal records and court transcripts despite prior warnings about vendor risk in August 2025, exposing confidential litigation documents.
What it means: Legal discovery materials containing privileged information and protected client communications became compromised, threatening ongoing litigation and client confidentiality.
Feb 28, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 11, by the category we filed each one under.