Weekly briefing › No. 28
Weekly briefing · No. 28 · 8 Jul 2026
Six critical breaches in 2026 exposed millions of North Americans across education, telecommunications, healthcare, cruise lines, insurance oversight, and utilities sectors.
Credential compromise and social engineering emerged as the dominant attack vectors, with ransom demands and extortion campaigns marking a shift toward organized data-theft operations.
This issue’s disclosures
CriticalMay 1, 2026
Instructure
Credential Theft · 30M+ records
Education platform Canvas used by 41% of North American higher education institutions was breached twice by extortion group, first exposing student and staff data, then defacing login portals during final exam periods.
What it means: Academic institutions across the U.S. and Canada faced operational disruption and student data exposure during critical exam periods.
May 1, 2026
CriticalApril 22, 2026
Carnival Corporation
Credential Theft · 6M records
Social engineering attack against single employee account opened path to IT systems allowing attackers to copy personal information including names, addresses, email addresses, phone numbers, and dates of birth.
What it means: Millions of cruise passengers face identity theft and fraud risks from leaked personal identity information.
April 22, 2026
CriticalMarch 2026
Telus
Credential Theft · Millions records
Canadian telecommunications firm breached with personally identifiable information, call data, background check details, and source code stolen.
What it means: Canadian customers exposed to identity fraud, financial abuse, and surveillance risks from leaked call records and personal data.
March 2026
HighJune 2026
London Hydro
Infrastructure · 170K records
Canadian electricity provider's systems breached exposing customer names, addresses, email addresses, phone numbers, account numbers, billing data, and meter information.
What it means: Ontario residents face phishing and account takeover risk from leaked utility account and contact information.
June 2026
CriticalJun 17, 2026
NAIC
Financial · Credit data records
National Association of Insurance Commissioners database breached compromising credit rating data from Moody's, S&P, and other agencies, forcing suspension of investment risk designations.
What it means: U.S. insurance market disrupted as regulatory oversight of capital requirements halted, affecting insurer operations nationwide.
Jun 17, 2026
CriticalJune 2026
DentaQuest
Healthcare · 2.6M records
Dental benefits administrator breached in May extortion campaign with 234GB archive containing names, phone numbers, addresses, birth dates, gender data, government-issued IDs, and health insurance information.
What it means: Millions of U.S. dental plan members exposed to identity theft and healthcare fraud through leaked insurance and government ID data.
June 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 28, by the category we filed each one under.