Weekly briefing › No. 34
Weekly briefing · No. 34 · 22 Aug 2026
Six major breaches have struck North American organizations across healthcare, education, and telecom sectors in 2026.
Combined impact exceeds 65 million records, with credential theft and ransomware as primary attack vectors.
This issue’s disclosures
CriticalOct 21, 2024 - Jan 13, 2025
Conduent Business Services LLC
Healthcare · 62.2M records
Medicaid claims processor experienced 83-day unauthorized network access, exposing names, Social Security numbers, health insurance details, and medical records.
What it means: Third-largest U.S. healthcare breach on record; affected individuals across 30+ states face long-term identity theft risk.
Oct 21, 2024 - Jan 13, 2025
CriticalNov 2025 - Feb 2026
NYC Health + Hospitals
Healthcare · 1.8M records
Third-party vendor compromise allowed attackers to copy personal, medical, financial, and biometric information from hospital systems.
What it means: One of 2026's largest healthcare breaches; sensitive patient data including SSNs and diagnoses exposed across NYC hospital system.
Nov 2025 - Feb 2026
CriticalApr 26, 2026 - May 7, 2026
Instructure (Canvas)
Credential Theft · 41M student/faculty records
ShinyHunters exploited free-for-teacher program and defaced portals at 330 institutions including Harvard and Princeton during exam periods.
What it means: Largest education-sector breach on record; Canvas serves 41% of North American higher education institutions.
Apr 26, 2026 - May 7, 2026
HighMay 2026
Charter Communications
Credential Theft · 13M+ records
Extortion group stole 42M customer records and published data covering support interactions and billing information.
What it means: Major telecom breach affecting millions of cable and internet customers; data published on leak sites.
May 2026
HighMay 15, 2026
SM Energy
Financial · 3,931+ records
Zero-day exploit in third-party email system led to theft of names, addresses, emails, and Social Security numbers from 3,931 state-level registrants.
What it means: Energy sector employee data exposed; company offering 24-month credit monitoring with October 31 enrollment deadline.
May 15, 2026
HighJul 2025 - Oct 2025
700Credit
Financial · 5.8M records
Largest North American credit check provider compromised via third-party API; hackers accessed customer information for automotive businesses.
What it means: Major supply chain risk for auto dealers and finance companies; 5.8 million individuals affected across North America.
Jul 2025 - Oct 2025
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 34, by the category we filed each one under.