Weekly briefing › No. 26
Weekly briefing · No. 26 · 1 Jul 2026
Six major 2026 data breaches impacted millions of North Americans, including Canadian financial regulators and educators, U.S. healthcare systems, and global pharmaceutical suppliers.
Attacks exploited phishing, third-party vendors, and social engineering to exfiltrate sensitive personal data ranging from medical records to investment details.
This issue’s disclosures
CriticalJan 14, 2026
CIRO
Credential Theft · 750K records
A sophisticated phishing attack targeting Canada's investment regulator compromised sensitive financial data on 750,000 investors including social insurance numbers and account details.
What it means: Investors face elevated risk of identity theft and fraud as criminals hold master financial profiles linking names, income, and investment holdings.
Jan 14, 2026
HighApr 22, 2026
Canada Life
Healthcare · 70K records
Criminals exploited an employee account at Canada's largest life insurer to access customer personal data including names, dates of birth, and income information.
What it means: Corporate employees covered under group benefits are at risk for targeted fraud and identity theft using their workplace benefit information.
Apr 22, 2026
CriticalMay 7, 2026
Instructure
Infrastructure · 275M records
Attackers breached Canvas learning management system twice in five days, stealing names, email addresses, student IDs and private messages between students and teachers.
What it means: Millions of students worldwide have personal communications and academic records exposed, enabling highly targeted phishing and social engineering attacks on minors.
May 7, 2026
CriticalFeb 2, 2026
NYC Health + Hospitals
Healthcare · 1.8M records
Attackers accessed the largest public health system in the U.S. for three months through a third-party vendor breach, stealing medical records, fingerprints, and government IDs.
What it means: Exposure of biometric data like fingerprints is permanent and irreplaceable, putting patients and employees at lifelong risk despite any password resets.
Feb 2, 2026
HighMay 27, 2026
Carnival Corporation
Financial · 6M records
An attacker used social engineering to trick a Carnival employee into granting system access on April 14, leading to theft of customer names, addresses, and booking details.
What it means: Millions of travelers had payment and personal information stolen, increasing risk of fraud tied to upcoming vacation bookings.
May 27, 2026
CriticalMay 7, 2026
West Pharmaceutical Services
Infrastructure · Unknown records
A ransomware attack detected May 4 encrypted systems and exfiltrated data across the pharmaceutical packaging supplier's global operations, forcing production shutdowns.
What it means: Disruption to critical drug supply chains affects patient access to medications, while stolen data from a healthcare supplier puts customer confidentiality at risk.
May 7, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 26, by the category we filed each one under.