Weekly briefing › No. 12
Weekly briefing · No. 12 · 28 Mar 2026
This week witnessed significant identity broker exposures and healthcare ransomware disruptions across North America.
Data broker vulnerabilities dominated the landscape, with massive credential databases exposed while healthcare infrastructure faced continued ransomware pressure.
This issue’s disclosures
CriticalMar 03
Infutor/ActiveProspect
Data Broker · 677M records
An Elasticsearch database containing full names, addresses, phone numbers, dates of birth, and Social Security numbers was exposed on the internet without authentication. SOCRadar discovered the misconfigured database linked to data broker Infutor.
What it means: This represents wholesale compromise of identity infrastructure, providing criminals everything needed for large-scale fraud across financial services and healthcare sectors.
Mar 03
HighMar 19
Navia Benefit Solutions
Financial · 2.7M records
Threat actors exploited Broken Object Level Authorization vulnerability between December 2025-January 2026, accessing Social Security numbers, names, addresses, and health plan information. Multiple major employers' benefits data was compromised.
What it means: Employee benefits systems represent a goldmine for identity thieves, affecting workers across multiple Fortune 500 companies through a single vendor compromise.
Mar 19
HighMar 03
LexisNexis Legal & Professional
Individual Identity · 400K records
FulcrumSec exploited React2Shell vulnerability to access AWS infrastructure, stealing 2GB of data including federal judges, DOJ attorneys, and court clerk information. The attack leveraged over-privileged container access to Redshift databases.
What it means: Compromise of legal sector infrastructure threatens attorney-client privilege and exposes government legal operations to criminal-targeting sources.
Mar 03
Mar 19
Crunchyroll
Individual Identity · 6.8M records
Hackers compromised Okta SSO account of support agent and planted malware, stealing over 8 million support tickets containing email addresses, names, login information, and geographic data.
What it means: Customer service infrastructure provides extensive personal data for social engineering attacks and account takeover campaigns against younger demographics.
Mar 19
HighFeb 21
Kaplan North America
Individual Identity · 192K records
Unauthorized party accessed networks containing names, Social Security numbers, dates of birth, and driver's license numbers. The education and training provider began notifications in mid-March after discovering the breach in February.
What it means: Educational services hold complete identity packages needed for financial fraud, affecting students and professionals seeking career advancement.
Feb 21
CriticalMar 10
Telus Digital
Infrastructure · Unknown records
ShinyHunters exploited stolen Google Cloud credentials to access nearly 1 petabyte of data including customer support logs, voice recordings, FBI background checks, source code, and financial information from 28+ clients. Attackers demanded $65M Bitcoin ransom.
What it means: Supply chain compromise of major BPO provider exposes sensitive data across multiple industries, demonstrating risks of third-party vendor concentration.
Mar 10
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 12, by the category we filed each one under.