Weekly briefing › No. 24
Weekly briefing · No. 24 · 17 Jun 2026
Six significant data breaches in 2026 exposed millions of North American records across financial services, retail, education, and healthcare sectors.
Credential theft via social engineering and voice phishing remained the primary attack vector.
This issue’s disclosures
CriticalJan 15, 2026
CIRO
Credential Theft · 750K records
Phishing attack in August 2025 led to credential compromise, exposing investor social insurance numbers and financial data.
What it means: Canadian investors face identity theft and fraud risk from financial credential exposure on the dark web.
Jan 15, 2026
CriticalMar 12, 2026
TELUS Digital
Credential Theft · Undisclosed records
ShinyHunters stole BigQuery data from compromised Google Cloud credentials, accessing customer support records, call recordings, and internal data.
What it means: Canadian customers and employees face privacy breach with financial and background check information exposed.
Mar 12, 2026
CriticalApr 15, 2026
Kemper Corporation
Financial · 13M records
ShinyHunters ransomware attack exposed 29GB of personal information and corporate data from the major US insurance provider.
What it means: US policyholders face identity theft and fraud from exposure of personal identifiable information and financial records.
Apr 15, 2026
CriticalMay 1, 2026
Instructure
Healthcare · 275M records
ShinyHunters accessed student and staff data from nearly 9,000 institutions including Canadian universities, stealing names, emails, student IDs, and private messages.
What it means: North American students and educators face phishing and privacy risks from exposure of academic records and personal communications.
May 1, 2026
CriticalApr 1, 2026
Charter Communications
Credential Theft · 4.9M records
ShinyHunters used voice phishing to obtain Salesforce credentials, accessing customer records through the CRM platform.
What it means: US broadband customers face phishing and fraud from exposed personal data linked to service accounts.
Apr 1, 2026
HighApr 22, 2026
Carnival Corporation
Credential Theft · Undisclosed records
Social engineering attack on employee account opened path to IT systems, with attackers copying customer personal information.
What it means: North American cruise passengers face identity theft risk from exposure of booking and personal details.
Apr 22, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 24, by the category we filed each one under.