Weekly briefing › No. 32
Weekly briefing · No. 32 · 8 Aug 2026
Five major verified breaches impacting North Americans in 2024-2026, ranging from 280,000 to 192.7 million individuals.
Mega-breaches dominate the landscape, with Instructure's Canvas LMS, Change Healthcare, and 700Credit leading by volume and cascading impact.
This issue’s disclosures
CriticalApr 30, 2026
Instructure Holdings (Canvas LMS)
Credential Theft · 275M records
ShinyHunters exploited unpatched support ticket vulnerability in Canvas free-for-teacher environment, exfiltrating 3.65TB of student and faculty records across 8,809 North American institutions.
What it means: Most widely used learning management system in US colleges became single point of failure affecting students during finals week; ransom paid but no guarantee data destroyed.
Apr 30, 2026
CriticalFeb 2024
Change Healthcare (UnitedHealth Group)
Healthcare · 192.7M records
BlackCat ransomware group compromised clearinghouse processing 1 in 3 US patient records, disrupting healthcare claims nationwide and stealing protected health information from nearly two-thirds of American population.
What it means: Single vendor failure cascaded across entire US healthcare system; demonstrates systemic dependence on centralized claims processors and fragility of payment infrastructure.
Feb 2024
HighMay 2025
700Credit
Financial · 5.8M records
Attacker compromised third-party integration partner in July 2025, gaining persistent API access to dealership customer records across North America; SSNs, addresses, birthdates stolen over 5-month window.
What it means: Undetected third-party compromise enabled credential stuffing and potential identity fraud for millions of car, RV, and boat buyers; breach remained undetected until October.
May 2025
HighMar 19, 2025
Nova Scotia Power
Infrastructure · 280K records
Sophisticated ransomware attack breached utility infrastructure March 19, remained undetected 37 days, then exfiltrated Social Insurance Numbers, driver licenses, and bank account details before encryption.
What it means: Canadian critical infrastructure targeted with double-extortion; company refused ransom citing sanctions law; attackers published stolen data despite containment claims.
Mar 19, 2025
HighNov 25, 2025
Organisation not named
Healthcare · 1.8M records
The disclosure as indexed does not name the organisation.
Unnamed vendor breach gave attackers 78-day window into largest public health system, exfiltrating patient and employee medical records, fingerprint scans, SSNs, and insurance data from November through February 2026.
What it means: Third-party vendor compromise at safety-net healthcare system serving mostly uninsured and Medicaid patients; two months of undetected access exposed biometric and financial data.
Nov 25, 2025
This issue by category
Where this issue’s disclosures sit.
The 5 disclosures in issue No. 32, by the category we filed each one under.