Weekly briefing › No. 29
Weekly briefing · No. 29 · 31 Jul 2026
Six major data breaches impacted North Americans in 2026, exposing hundreds of millions of records across education, telecommunications, government, legal, and manufacturing sectors.
Breaches ranged from credential theft and social engineering to wiper attacks and ransomware, with impacts spanning educational institutions, government agencies, healthcare manufacturers, and critical infrastructure.
This issue’s disclosures
CriticalMay 7, 2026
Instructure
Credential Theft · 275M records
ShinyHunters exploited the Free-For-Teacher program in late April 2026 to breach Canvas, exfiltrating usernames, emails, student IDs, course enrollment details, and private messages from 8,809 institutions.
What it means: The largest education sector breach on record compromised the learning records and communications of roughly 40% of North American higher education students during finals week.
May 7, 2026
CriticalMay 26, 2026
Charter Communications
Credential Theft · 13M records
ShinyHunters used social engineering calls to compromise Microsoft Entra accounts, then pivoted to Salesforce to extract customer names, addresses, phone numbers, and nearly 10 million support ticket records.
What it means: The breach exposed about 40% of Charter's customer base to targeted phishing, fraud, and account takeover attacks across the largest US broadband provider.
May 26, 2026
CriticalJanuary 21, 2026
Social Security Administration
Credential Theft · 500M+ records
DOGE employees uploaded sensitive Social Security data to unauthorized cloud servers without agency approval and attempted to share records with a political advocacy group seeking to match voter rolls.
What it means: Hundreds of millions of Social Security numbers, birth dates, and citizenship records were exposed through policy violations and sent outside government control, potentially enabling widespread identity fraud.
January 21, 2026
February 19, 2026
VIQ Solutions
Healthcare · Thousands records
The Canadian transcription firm subcontracted work to India-based e24 Technologies in violation of government contracts, exposing thousands of sensitive court files including domestic violence and national security cases.
What it means: Internal warnings about offshore data access were ignored for months, resulting in a vendor governance failure that compromised confidential court proceedings across multiple jurisdictions.
February 19, 2026
CriticalMar 11, 2026
Stryker
Infrastructure · N/A records
Iran-linked group Handala weaponized Stryker's Microsoft Intune device management platform to wipe more than 200,000 endpoints globally, destroying data and halting manufacturing, shipping, and surgery scheduling.
What it means: A state-sponsored wiper attack targeting critical medical device manufacturing disrupted hospital operations across 79 countries and forced surgical procedure cancellations.
Mar 11, 2026
CriticalMay 12, 2026
Foxconn
Infrastructure · 8TB records
Nitrogen ransomware group compromised Foxconn's North American operations and exfiltrated 8 terabytes containing engineering schematics, circuit board layouts, and confidential data from Apple, Nvidia, Google, Intel, AMD, and Dell.
What it means: A single electronics manufacturer serving six Fortune 500 companies became a central point of failure exposing proprietary technology blueprints and supply chain intelligence globally.
May 12, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 29, by the category we filed each one under.