Weekly briefing › No. 21
Weekly briefing · No. 21 · 27 May 2026
Six critical 2026 breaches spanning North America exposed millions of records through employee credential theft, ransomware, and third-party vulnerabilities.
Canadian financial institutions and U.S. educational platforms faced significant incidents while global platforms like Canvas impacted institutions worldwide.
This issue’s disclosures
HighApr 20, 2026
Canada Life
Credential Theft · 70K records
Attackers accessed Canada Life employee account and extracted names, dates of birth, addresses, and income data from workplace benefits division.
What it means: Employees and retirees face identity theft risk with personal income and benefit information now in criminal hands.
Apr 20, 2026
CriticalMay 26, 2026
Giant Tiger
Credential Theft · 3M records
Canadian retailer disclosed attack from March containing customer email addresses, names, physical addresses, and phone numbers.
What it means: Millions of Canadian shoppers face phishing and fraud risk from exposed contact information now in breach databases.
May 26, 2026
CriticalMay 1, 2026
Instructure Canvas
Credential Theft · Unknown records
Unauthorized actors accessed Canvas systems on April 25 extracting student names, email addresses, IDs, and messages affecting educational institutions in US, Canada, and worldwide.
What it means: Students and staff across North America had personal academic information stolen during exam periods with ransom demands forcing system shutdown.
May 1, 2026
CriticalFeb 27, 2026
University of Hawaii Cancer Center
Healthcare · 1.2M records
Ransomware gang accessed epidemiology division extracting names, Social Security numbers, driver license data, and voter registration information from 1993-2007 studies.
What it means: Medical research patients face decades of identity theft risk with government-issued IDs and SSNs compromised from legacy research files.
Feb 27, 2026
CriticalMay 20, 2026
Norton Healthcare
Healthcare · 2.5M records
Attackers gained unauthorized access to systems containing patient medical records and employee data from major Kentucky healthcare provider with 40+ clinics.
What it means: Patients across Kentucky face medical identity theft with healthcare records sold on dark web markets affecting treatment history and billing data.
May 20, 2026
CriticalApr 20, 2026
France Titres ANTS
Credential Theft · 11.7M records
Attackers accessed individual and professional accounts on government portal extracting names, emails, dates of birth, addresses, phone numbers, and login credentials after teen suspect was detained.
What it means: Millions of French citizens have government identity data exposed enabling credential fraud and financial impersonation across Europe.
Apr 20, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 21, by the category we filed each one under.