Weekly briefing › No. 3
Weekly briefing · No. 3 · 19 Mar 2026
Six major data breaches struck North American organizations across healthcare, hospitality, financial services, and retail sectors between January and March 2026.
Credential theft, vendor vulnerabilities, and human error remain the primary attack vectors, affecting millions of individuals.
This issue’s disclosures
CriticalJan 19
IBM MOVEit / Colorado Healthcare
Healthcare · 4.1M records
Attackers exploited a known vulnerability in MOVEit transfer software to access patient records at a Colorado healthcare facility.
What it means: Healthcare organizations remain vulnerable to widely-publicized software flaws when patches are not applied promptly.
Jan 19
CriticalJan 31
Conduent
Healthcare · 25M records
A technology contractor handling Medicaid claims and benefit administration across 46 states suffered a breach revealing medical records, Social Security numbers, and insurance details.
What it means: Third-party service providers handling sensitive government data pose systemic risk to millions of beneficiaries.
Jan 31
HighJan 26
Panera Bread
Credential Theft · 5.1M records
Attackers compromised Microsoft identity provider access to steal customer account data including names, emails, phone numbers, and addresses.
What it means: Enterprise authentication systems remain attractive targets for threat actors seeking mass customer data access.
Jan 26
Feb 10
Stellantis
Credential Theft · Undisclosed records
Customer information was compromised through a third-party platform supporting North American customer service operations for Chrysler, Fiat, Jeep, and Dodge brands.
What it means: Automotive manufacturers face growing supply chain risks from integrated third-party service providers.
Feb 10
HighFeb 14
Canada Goose
Credential Theft · 980K records
Customer transaction data was exposed through a breach at a third-party vendor in August 2025, including names, addresses, phone numbers, and email addresses.
What it means: Vendor security incidents create delayed notification timelines and extend customer risk windows.
Feb 14
CriticalMar 11
TELUS Digital
Infrastructure · 1P records
Attackers compromised customer data, source code, financial records, voice recordings, and background check files across multiple BPO divisions.
What it means: Business process outsourcers managing diverse client data become single points of failure for cross-sector breaches.
Mar 11
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 3, by the category we filed each one under.