2026 saw major data breaches across North America with Canvas affecting Canadian universities, ADT and McGraw-Hill impacting millions of US customers, and global incidents at French government agencies. Supply-chain compromises and credential-based attacks emerged as dominant threat vectors.
Hackers claiming responsibility compromised Canvas learning platform affecting students and staff at University of Toronto, UBC, and other Canadian institutions.
What it means: Educational data globally exposed with millions of student records containing personal identifiers subject to phishing and identity fraud.
Indian subcontractor accessed sensitive legal records at Canadian document processing firm despite prior staff warnings about vendor security risks.
What it means: Court transcripts with security-critical data exposed enabling potential fraud and compromising legal proceedings.
Security systems company compromised with customer names, phone numbers, addresses and partial SSNs stolen through ransomware group exploitation.
What it means: Millions of US households and businesses using ADT face targeted phishing and identity theft from exposed contact and partial identification data.
Education publisher misconfigured Salesforce environment allowing attackers to exfiltrate student and educator account information.
What it means: US educators and students had names, emails, and addresses exposed through cloud platform misconfiguration enabling account targeting.
Attackers accessed France Titres government identity platform exposing names, birthdates, postal addresses, phone numbers and login credentials.
What it means: French citizens and professionals exposed to mass identity fraud and targeted attacks with government credentials compromised.
Electronics manufacturer North American facility hit by ransomware exposing 11 million confidential files and technical drawings.
What it means: Global supply chain disruption with internal project documentation and technical specifications for major tech brands compromised.