Weekly briefing › No. 16
Weekly briefing · No. 16 · 29 Apr 2026
Six major cybersecurity incidents impacted North America in 2026, affecting over 13 million individuals across financial services, healthcare, entertainment, and medical device sectors.
Critical vulnerabilities in third-party vendor access and phishing attacks remain the primary attack vectors.
This issue’s disclosures
HighApr 20, 2026
Canada Life
Credential Theft · 70K records
Attackers accessed Canada Life employee credentials and extracted personal and financial data from up to 70,000 customers through compromised employee account access.
What it means: Canadians should monitor accounts for fraud risk as names, dates of birth, addresses and income information were exposed.
Apr 20, 2026
CriticalJan 15, 2026
Navia
Healthcare · 2.7M records
An exposed API allowed unauthorized access to Navia's benefits administration platform between December 22, 2025 and January 15, 2026, compromising employee benefits data.
What it means: Millions of American workers face identity theft risk as Social Security numbers, account data, and health plan information were stolen.
Jan 15, 2026
CriticalApr 20, 2026
Citizens Bank
Financial · 3.4M records
Ransomware group Everest breached a third-party vendor handling customer communications for Citizens Bank, exfiltrating names, addresses and account numbers.
What it means: American bank customers across 14 states face account fraud and identity theft exposure with sensitive financial data compromised.
Apr 20, 2026
CriticalFeb 14, 2026
Figure Technology Solutions
Credential Theft · 967K records
Social engineering attack manipulated a company employee into providing system access, allowing hackers to download customer records including names, dates of birth and contact information.
What it means: Nearly one million fintech customers face identity theft and phishing attack risk from compromised personal data.
Feb 14, 2026
HighMar 12, 2026
Crunchyroll
Credential Theft · 6.8M records
Hackers phished a Telus International support agent and stole Okta SSO credentials, accessing Crunchyroll support systems and extracting 8 million customer support tickets with 6.8 million unique email addresses.
What it means: Global anime streaming subscribers face phishing and account takeover risk as email addresses and support interaction details were exposed.
Mar 12, 2026
CriticalMar 19, 2026
Stryker
Infrastructure · 200K devices records
Iran-linked group Handala compromised a Microsoft Intune administrator account and used device management systems to remotely wipe over 200,000 devices across 79 countries without deploying malware.
What it means: Global hospitals and surgical centers faced operational shutdown impacting patient care delivery as manufacturing, shipping and critical systems halted.
Mar 19, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 16, by the category we filed each one under.