Six verified major data breaches affecting millions across North America in 2024-2026, ranging from education to healthcare and financial services. Recent disclosures underscore vendor risk and delayed detection as leading factors.
Supply chain attack through compromised developer credentials gave attacker access to Suno environment for eight months before public disclosure in July 2026.
What it means: Users' email addresses, phone numbers, partial payment card data, and training documentation were stolen; company failed to notify victims.
SafePay ransomware group accessed Conduent systems for 83 days, exfiltrating healthcare claims and government benefits data from hundreds of covered entities.
What it means: Third-largest US healthcare breach ever; victim count revised from 10.5M to 62.2M over nine months, exposing healthcare accessibility and vendor risk.
Attacker breached 700Credit integration partner in July, discovered exposed API in October; partner failed to notify for three months, allowing ongoing data exfiltration.
What it means: North American auto dealers saw customer SSNs, DOBs, addresses stolen; class action settlement reached $17.5M covering dealer customer exposure.
Attacker used stolen subcontractor credentials against PowerSource support portal lacking multi-factor authentication, accessing student records for nine days undetected.
What it means: Largest education data breach in US history; exposed SSNs, addresses, grades, medical info for minors across US and Canada; attacker sentenced to 4 years.
Unnamed third-party vendor breach gave attackers access to NYC H+H systems for 11 weeks; stolen medical records, fingerprints, government IDs, and financial data.
What it means: One of 2026's largest healthcare breaches; exposed sensitive biometric data and clinical information for largest US municipal health system serving Medicaid patients.
Data stolen in 2019 was acknowledged in March 2024; resurfaced in February 2026 on dark web with 148 million previously encrypted SSNs now fully decrypted.
What it means: Settlement of $177 million ($2.43 per person); demonstrates breach data becomes more dangerous over time as encryption keys are broken and records enriched.