Weekly briefing › No. 27
Weekly briefing · No. 27 · 1 Jul 2026
Major 2026 breaches affecting North America expose hundreds of millions of records across healthcare, education, financial, retail and telecommunications sectors.
ShinyHunters emerges as prolific threat actor targeting cloud platforms and stealing credentials at scale.
This issue’s disclosures
CriticalMay 1, 2026
Instructure Inc.
Credential Theft · 275M records
Attackers exploited a stored cross-site scripting vulnerability in Canvas support ticket system to gain access to 275 million student and staff records across 8,809 institutions globally.
What it means: Students lost access to coursework during finals as defaced login screens disrupted exams across US universities; company paid ransom despite FBI guidance against payment.
May 1, 2026
CriticalMar 12, 2026
Telus Digital
Credential Theft · 700TB-1PB records
Attackers accessed Telus systems for months using stolen Google Cloud Platform credentials from a prior Salesloft vendor breach, exfiltrating customer support recordings, source code, and employee records including FBI background checks.
What it means: Data from at least 28 major corporations handled by Telus BPO services compromised; largest data theft by volume confirmed in 2026.
Mar 12, 2026
CriticalMay 27, 2026
Carnival Corporation
Credential Theft · 6M records
Social engineering attack tricked employee into granting access April 14; attacker copied personal data including passport and driver license numbers from customer systems before detection on April 22.
What it means: Affected 800,000 Texans alone; criminal group ShinyHunters leaked loyalty program data enabling targeted phishing using real booking and trip details.
May 27, 2026
CriticalFeb 2, 2026
NYC Health + Hospitals
Healthcare · 1.8M records
Attackers accessed systems from November 2025 through February 2026 via unnamed third-party vendor vulnerability; copied medical records, biometric fingerprints and palm prints, SSNs and government IDs.
What it means: Biometric data exposure is permanent and cannot be reissued; largest public health system in US largely serves uninsured and Medicaid patients.
Feb 2, 2026
HighJan 14, 2026
Canadian Investment Regulatory Organization
Financial · 750K records
Sophisticated phishing attack first detected August 2025 compromised Canada's investment watchdog systems; unauthorized access to Social Insurance Numbers, government IDs and investment account statements.
What it means: Regulator responsible for protecting investors cannot protect itself; five months elapsed before full disclosure to affected Canadian investors.
Jan 14, 2026
HighMar 31, 2026
Hallmark Cards Inc.
Credential Theft · 2.8M records
ShinyHunters accessed Salesforce environment containing customer records with names, addresses, phone numbers, emails and dates of birth; data leaked after company refused April 2 ransom deadline.
What it means: Customer support tickets exposed enabling targeted phishing; Hallmark publicly silent on breach despite company statement from threat actors.
Mar 31, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 27, by the category we filed each one under.