Weekly briefing › No. 23
Weekly briefing · No. 23 · 10 Jun 2026
Six major data breaches impacted North American organizations in 2026, ranging from educational platforms to retail and telecommunications.
The attacks exploited social engineering, misconfigured systems, and third-party vulnerabilities affecting hundreds of millions of users and customers.
This issue’s disclosures
CriticalMay 01, 2026
Instructure
Credential Theft · 275M records
ShinyHunters exploited a vulnerability in the Free-For-Teacher program to gain initial access, exfiltrating student records, teacher messages, and enrollment data across nearly 9,000 educational institutions.
What it means: Academic institutions serving millions of students face potential phishing, identity theft, and fraud targeting students and families using exposed personal messages and enrollment information.
May 01, 2026
HighMar 28, 2026
Giant Tiger
Credential Theft · 2.9M records
A hacker claimed to have stolen customer records from the Canadian retailer after a March attack, with the company disclosing the incident weeks later following the threat actor's public announcement.
What it means: Customers face fraud risk and identity theft from exposed email addresses, names, physical addresses, and phone numbers sold on criminal forums.
Mar 28, 2026
HighApr 01, 2026
Charter Communications
Credential Theft · 4.9M records
Attackers used a voice phishing call to trick a Charter employee into revealing Microsoft Entra credentials, then accessed Salesforce to exfiltrate customer and support ticket data.
What it means: Millions of customer records containing names, addresses, and account details enable targeted phishing, account takeover, and social engineering attacks against Spectrum subscribers.
Apr 01, 2026
CriticalMar 12, 2026
TELUS Digital
Credential Theft · 1PB stolen records
Attackers leveraged stolen Google Cloud credentials from the Salesloft breach to pivot into TELUS systems, stealing customer support records, voice recordings, financial data, and FBI background checks.
What it means: The massive data theft of voice recordings and financial information exposes Canadian customers and businesses to identity fraud, blackmail, and regulatory violations under PIPEDA.
Mar 12, 2026
HighMar 05, 2026
T-Mobile
Credential Theft · 393.8K records
An insider at T-Mobile accessed customer account information including Social Security numbers, driver's license numbers, account PINs, dates of birth, and associated phone numbers.
What it means: Customers face immediate risk of account takeover using stolen account PINs and government identifiers, and long-term identity theft risk from exposed SSNs.
Mar 05, 2026
HighJun 08, 2026
Nissan Motor
Credential Theft · 2.35M records
Customer records from Nissan Motor were exposed and leaked online, compromising personal information of millions across multiple regions and sales channels.
What it means: Vehicle owners face phishing targeting automobile warranty scams, account fraud, and identity theft using exposed personal and purchasing data.
Jun 08, 2026