Weekly briefing › No. 38
Weekly briefing · No. 38 · 19 Sep 2026
Six major breaches have impacted millions of North Americans in 2026, spanning healthcare, identity verification, insurance, and education.
Credential theft and social engineering remain the dominant attack vectors, with one Canadian insurer and five US entities affected.
This issue’s disclosures
CriticalSep 1, 2026
IDScan.net
Infrastructure · 150M records
Hackers compromised identity verification platform serving Hertz, FedEx, and Target; exposed driver license photos for 150 million drivers in US and Canada via dark web search engine.
What it means: Victims face elevated risk of synthetic identity fraud, account takeover, and long-term identity theft as biometric and personal documents are now publicly searchable.
Sep 1, 2026
CriticalMay 2026
DentaQuest
Healthcare · 15M records
Major dental insurance company suffered cyberattack exposing protected health information for 15 million patients; breach disclosed publicly in July after HHS reporting.
What it means: Affected patients face fraud risk from exposed healthcare data; company must provide mandated breach notifications and credit monitoring.
May 2026
CriticalMar 16, 2026
AssuranceAmerica
Financial · 6.999M records
Auto insurance provider detected malicious activity targeting single employee on March 16; attackers copied files containing names, contact info, policy details, and driver license numbers affecting nearly 7 million individuals.
What it means: Largest known exposure of US driver license numbers in 2026; victims exposed to identity theft and fraud from complete credential sets.
Mar 16, 2026
HighApr 10, 2026
Carnival Corporation
Credential Theft · 5.995M records
Cruise operator detected breach April 14 and confirmed April 22 that 6M individuals had personal information copied via social engineering; ShinyHunters published 8.7M records after extortion demand failed.
What it means: Exposed data includes names, dates of birth, emails, and loyalty program info; victims at risk for credential reuse attacks and targeted fraud.
Apr 10, 2026
CriticalNov 25, 2025
NYC Health + Hospitals
Healthcare · 1.8M records
Unauthorized actor accessed safety-net hospital network from November 2025 through February 2026; stolen data included medical records, SSNs, banking data, and biometric fingerprints and palm prints.
What it means: Biometric data theft creates permanent identity risk; system serves Medicaid population with limited fraud monitoring access.
Nov 25, 2025
HighApr 18, 2026
Canada Life
Credential Theft · 70K records
ShinyHunters used single employee account to access Salesforce environment and steal personal information for 70K individuals; ransom deadline set April 21 before public disclosure April 23.
What it means: Exposed data includes PII for large corporate group; Canada Life offering credit monitoring as incident was contained after ransomware threat.
Apr 18, 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 38, by the category we filed each one under.