Weekly briefing › No. 20
Weekly briefing · No. 20 · 20 May 2026
2026 saw major data breaches across North America with Canvas affecting Canadian universities, ADT and McGraw-Hill impacting millions of US customers, and global incidents at French government agencies.
Supply-chain compromises and credential-based attacks emerged as dominant threat vectors.
This issue’s disclosures
CriticalMay 09, 2026
Instructure Canvas
Credential Theft · 275M records
Hackers claiming responsibility compromised Canvas learning platform affecting students and staff at University of Toronto, UBC, and other Canadian institutions.
What it means: Educational data globally exposed with millions of student records containing personal identifiers subject to phishing and identity fraud.
May 09, 2026
CriticalFeb 28, 2026
VIQ Solutions
Credential Theft · Undisclosed records
Indian subcontractor accessed sensitive legal records at Canadian document processing firm despite prior staff warnings about vendor security risks.
What it means: Court transcripts with security-critical data exposed enabling potential fraud and compromising legal proceedings.
Feb 28, 2026
CriticalApril 05, 2026
ADT
Infrastructure · 5.5M records
Security systems company compromised with customer names, phone numbers, addresses and partial SSNs stolen through ransomware group exploitation.
What it means: Millions of US households and businesses using ADT face targeted phishing and identity theft from exposed contact and partial identification data.
April 05, 2026
CriticalApril 14, 2026
McGraw-Hill
Credential Theft · 13.5M records
Education publisher misconfigured Salesforce environment allowing attackers to exfiltrate student and educator account information.
What it means: US educators and students had names, emails, and addresses exposed through cloud platform misconfiguration enabling account targeting.
April 14, 2026
CriticalApril 20, 2026
France Titres ANTS
Credential Theft · 11.7M records
Attackers accessed France Titres government identity platform exposing names, birthdates, postal addresses, phone numbers and login credentials.
What it means: French citizens and professionals exposed to mass identity fraud and targeted attacks with government credentials compromised.
April 20, 2026
CriticalMay 15, 2026
Foxconn
Infrastructure · 8TB records
Electronics manufacturer North American facility hit by ransomware exposing 11 million confidential files and technical drawings.
What it means: Global supply chain disruption with internal project documentation and technical specifications for major tech brands compromised.
May 15, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 20, by the category we filed each one under.