Weekly briefing › No. 25
Weekly briefing · No. 25 · 24 Jun 2026
Six critical data breaches hit North America in 2026, spanning education, healthcare, and retail.
Instructure's Canvas suffered the largest education-sector breach affecting 275 million users globally, while NYC Health and Hospitals exposed 1.8 million patients' data including biometrics.
This issue’s disclosures
CriticalMay 1, 2026
Instructure
Credential Theft · 275M records
Canvas was compromised twice within two weeks via exploited Free-For-Teacher accounts, affecting over 8,800 institutions with student records and messages.
What it means: The largest education-sector breach on record disrupted exam periods and revealed the sector's vulnerability to social engineering and weak institutional verification controls.
May 1, 2026
CriticalFeb 11, 2026
NYC Health + Hospitals
Healthcare · 1.8M records
An unnamed third-party vendor was breached, exposing patient medical records, financial data, and biometric fingerprints from November 2025 through February 2026.
What it means: The largest U.S. public health system breach demonstrated that healthcare organizations cannot protect data when vendors have unrestricted access.
Feb 11, 2026
CriticalMarch 15, 2026
Giant Tiger
Credential Theft · 3M records
The Canadian retailer's systems were breached in March, exposing names, email addresses, physical addresses, and phone numbers of nearly 3 million customers.
What it means: A major Canadian retailer's delayed disclosure of a major breach raised concerns about Canadian retailers' incident detection and response capabilities.
March 15, 2026
HighJan 25, 2026
Canada Computers
Financial · 1.3K records
Unauthorized access to the retailer's website systems exposed personal details and payment card data for 1,284 Canadian customers.
What it means: The incident highlighted vulnerability in e-commerce infrastructure and exposed the risks of inadequate access controls in retail technology platforms.
Jan 25, 2026
HighApr 1, 2026
Charter Communications
Credential Theft · 4.9M records
A vishing attack compromised an employee's Microsoft Entra account, granting attackers access to Salesforce data of approximately 4.9 million customer accounts.
What it means: Social engineering bypassed technical controls at a major U.S. broadband provider, exposing customer names, addresses, phone numbers, and email addresses.
Apr 1, 2026
HighApr 22, 2026
Carnival Corporation
Credential Theft · 7.5M records
Social engineering against a single employee account provided attackers access to personal information and loyalty program data for millions of cruise customers.
What it means: The world's largest cruise operator's breach confirmed that single employee accounts can expose millions of sensitive travel and financial records.
Apr 22, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 25, by the category we filed each one under.