Weekly briefing › No. 2
Weekly briefing · No. 2 · 19 Mar 2026
This week has seen a particularly severe escalation in North American data breaches, with major infrastructure and service providers falling victim to sophisticated attacks.
The threat landscape shows attackers increasingly targeting business process outsourcing firms and critical service providers to maximize their impact across multiple client organizations.
This issue’s disclosures
CriticalMar 11
TELUS Digital
Infrastructure · Unknown records
Canadian business process outsourcing company confirmed a cyberattack compromising 1 petabyte of data including FBI background checks, financial information, and voice recordings for multiple client companies.
What it means: This massive breach exposes sensitive data from numerous organizations that relied on TELUS Digital's services, creating ripple effects across multiple industries.
Mar 11
CriticalMar 2026
Infutor
Data Broker · 676.8M records
Data broker became victim of massive breach with hacker posting database containing Americans' full names, addresses, phone numbers, dates of birth, and Social Security Numbers.
What it means: This represents one of the largest exposures of American personal data, affecting roughly 1 in 2 U.S. citizens and enabling widespread identity theft.
Mar 2026
CriticalMar 2026
Federal Bureau of Investigation
Infrastructure · Unknown records
FBI systems used to manage surveillance and wiretap warrants were breached in a cyberattack, with the nature and quantity of compromised data still under investigation.
What it means: This breach potentially exposes highly sensitive law enforcement operations and could compromise ongoing federal investigations.
Mar 2026
Mar 2026
Loblaw Companies
Infrastructure · Unknown records
Canada's largest food and pharmacy retailer detected suspicious network activity compromising customer names, phone numbers, and email addresses.
What it means: This affects customers across thousands of stores including major brands like Shoppers Drug Mart and Real Canadian Superstore.
Mar 2026
HighMar 2026
AkzoNobel
Infrastructure · 170K files records
Dutch paint company's U.S. operations suffered breach compromising 170GB of data including passport details, client agreements, and internal technical documents.
What it means: The breach exposes sensitive business relationships and employee personal information from a major global manufacturing company.
Mar 2026
HighMar 2026
HungerRush
Infrastructure · Unknown records
Point-of-sale technology provider experienced breach with attackers mass-emailing extortion demands to restaurant customers, indicating access to email systems and infrastructure.
What it means: This threatens data security for thousands of restaurants and their customers who used the compromised platform.
Mar 2026
HighFeb 21
Kaplan Inc
Individual Identity · 192K+ records
Global educational services company disclosed unauthorized access to files containing names, Social Security numbers, and driver's license numbers affecting over 190,000 individuals.
What it means: Students and professionals using Kaplan's test preparation and certification services face identity theft risks from this sensitive data exposure.
Feb 21
Jan 2026
LexisNexis Legal & Professional
Infrastructure · Unknown records
American data analytics company confirmed breach through unpatched vulnerability exposing customer names, business contact information, and support tickets.
What it means: This affects legal professionals and businesses relying on LexisNexis for critical research and analytics services.
Jan 2026
This issue by category
Where this issue’s disclosures sit.
The 8 disclosures in issue No. 2, by the category we filed each one under.