Weekly briefing › No. 37
Weekly briefing · No. 37 · 12 Sep 2026
Six verified major data breaches affecting millions across North America in 2024-2026, ranging from education to healthcare and financial services.
Recent disclosures underscore vendor risk and delayed detection as leading factors.
This issue’s disclosures
HighNov 25, 2025
Suno
Credential Theft · 55.3M records
Supply chain attack through compromised developer credentials gave attacker access to Suno environment for eight months before public disclosure in July 2026.
What it means: Users' email addresses, phone numbers, partial payment card data, and training documentation were stolen; company failed to notify victims.
Nov 25, 2025
CriticalOct 21, 2024
Conduent Business Services
Healthcare · 62.2M records
SafePay ransomware group accessed Conduent systems for 83 days, exfiltrating healthcare claims and government benefits data from hundreds of covered entities.
What it means: Third-largest US healthcare breach ever; victim count revised from 10.5M to 62.2M over nine months, exposing healthcare accessibility and vendor risk.
Oct 21, 2024
HighJul-Oct 2025
700Credit
Financial · 5.8M records
Attacker breached 700Credit integration partner in July, discovered exposed API in October; partner failed to notify for three months, allowing ongoing data exfiltration.
What it means: North American auto dealers saw customer SSNs, DOBs, addresses stolen; class action settlement reached $17.5M covering dealer customer exposure.
Jul-Oct 2025
CriticalDec 19, 2024
PowerSchool
Healthcare · 62M students, 9.5M teachers records
Attacker used stolen subcontractor credentials against PowerSource support portal lacking multi-factor authentication, accessing student records for nine days undetected.
What it means: Largest education data breach in US history; exposed SSNs, addresses, grades, medical info for minors across US and Canada; attacker sentenced to 4 years.
Dec 19, 2024
CriticalNov 25, 2025
NYC Health + Hospitals
Healthcare · 1.8M records
Unnamed third-party vendor breach gave attackers access to NYC H+H systems for 11 weeks; stolen medical records, fingerprints, government IDs, and financial data.
What it means: One of 2026's largest healthcare breaches; exposed sensitive biometric data and clinical information for largest US municipal health system serving Medicaid patients.
Nov 25, 2025
CriticalMar 30, 2024
AT&T
Credential Theft · 73M records
Data stolen in 2019 was acknowledged in March 2024; resurfaced in February 2026 on dark web with 148 million previously encrypted SSNs now fully decrypted.
What it means: Settlement of $177 million ($2.43 per person); demonstrates breach data becomes more dangerous over time as encryption keys are broken and records enriched.
Mar 30, 2024
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 37, by the category we filed each one under.