Six major 2026 data breaches targeted North Americans, exposing millions of personal and financial records across finance, technology, and retail sectors. Third-party vendor compromises and credential theft emerged as the dominant attack vectors across all incidents.
Threat actors claimed exposure of approximately 600,000 customer records related to past transactions through a third-party service.
What it means: Canadian luxury brand customers face identity theft and phishing risks from compromised transaction history.
Unauthorized attackers accessed the retail website's guest checkout system between December 2025 and January 2026, stealing payment card information.
What it means: Guest customers exposed to credit card fraud and identity theft from compromised financial data.
Social engineering attack compromised an employee account, granting attackers access to internal Okta systems and customer databases containing 3 million records.
What it means: US fintech customers face severe identity theft risk with exposed Social Security numbers and financial account information.
A dataset containing 72 million user email addresses tied to a previous breach resurfaced publicly in 2026, linked to third-party credential compromise.
What it means: Massive volume of US customer emails exposes users to targeted phishing campaigns and account takeover attempts.
Attackers accessed the national digital identity portal, exfiltrating names, emails, dates of birth, addresses, phone numbers, and login credentials from millions of accounts.
What it means: Citizens across Europe face severe identity fraud and account takeover risk from compromised government authentication data.
Threat actors breached Salesforce environment and exfiltrated 2.8 million customer records after Hallmark declined ransom demands.
What it means: Greeting card customers globally face phishing and identity theft from exposed names, addresses, phone numbers, and personal shopping data.