Weekly briefing › No. 15
Weekly briefing · No. 15 · 22 Apr 2026
Six major data breaches hit North American and global targets in 2026, compromising over 26 million records across financial services, healthcare, and government sectors.
Phishing attacks and third-party vendor compromises dominated the incident landscape, with several breaches involving months-long disclosure delays.
This issue’s disclosures
CriticalJan 14, 2026
Canadian Investment Regulatory Organization
Credential Theft · 750K records
Sophisticated phishing attack in August 2025 led to unauthorized access of Canadian investor personal and financial information, confirmed in January 2026 investigation.
What it means: Affected investors face elevated identity theft and fraud risk despite no evidence of dark web activity as of investigation date.
Jan 14, 2026
CriticalJan 23, 2026
Navia Benefit Solutions
Healthcare · 2.7M records
Unauthorized actor exploited read-only API vulnerability gaining undetected access from December 22, 2025 through January 15, 2026, exfiltrating health plan and personal data.
What it means: Millions of U.S. employees face phishing and medical identity theft risks from exposed Social Security numbers and health enrollment information.
Jan 23, 2026
CriticalMar 3, 2026
Cegedim Santé
Healthcare · 15.8M records
Late 2025 cyberattack compromised MonLogicielMedical platform used by 1,500 French doctors, stealing administrative files and 165,000 files containing doctors' free-text notes with HIV status and mental health details.
What it means: Patients face severe privacy violation and targeted extortion risks from exposure of highly sensitive medical and personal information.
Mar 3, 2026
HighApr 20, 2026
Canada Life
Financial · 70K records
Cybercriminal accessed employee account at major Canadian insurer, stealing personal information from benefits database including names, dates of birth, addresses, and annual income data.
What it means: Affected group benefits participants face targeted fraud and social engineering risks from exposure of income and employment details.
Apr 20, 2026
HighMar 12, 2026
Crunchyroll
Credential Theft · 6.8M records
Attacker compromised Telus International employee account via phishing malware, gaining Okta SSO access to download 8 million support tickets containing customer names, emails, and support interaction details.
What it means: Millions of anime subscribers face sophisticated phishing attacks leveraging detailed support ticket information to impersonate legitimate company communications.
Mar 12, 2026
CriticalMar 27, 2026
European Commission
Infrastructure · 350GB records
Attackers accessed cloud infrastructure hosting Europa.eu website on March 24, 2026, exfiltrating databases, mail server contents, and confidential contracts before access was revoked.
What it means: EU institutional data exposure creates diplomatic and security risks affecting multiple government operations and sensitive policy information.
Mar 27, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 15, by the category we filed each one under.