Weekly briefing › No. 39
Weekly briefing · No. 39 · 26 Sep 2026
Six major data breaches have affected millions of North Americans in 2026, spanning identity verification, healthcare, education, and automotive insurance.
Combined, these incidents have exposed more than 300 million records, with critical implications for credential theft and healthcare fraud.
This issue’s disclosures
CriticalSep 4, 2026
IDScan.net (ID verification service)
Credential Theft · 153M+ records
Unauthorized third-party access exposed driver's license numbers and government-issued ID details from Canada and the US on IDScan.net's cloud platform.
What it means: Largest exposure of government-issued identity documents in North America; creates widespread identity theft and fraud risk affecting millions in both countries.
Sep 4, 2026
CriticalMay 1, 2026
Instructure Canvas
Infrastructure · 275M records
ShinyHunters exploited Free-for-Teacher accounts to steal 3.65 terabytes of data including student names, email addresses, ID numbers, and private messages.
What it means: Largest education sector breach on record affecting 8,809 institutions; 41 percent of US higher education institutions and seven Canadian universities confirmed compromised.
May 1, 2026
CriticalMay 2026
DentaQuest
Healthcare · 15M records
Second-largest US dental insurance company suffered cyberattack exposing health data for 15 million patients, the largest healthcare entity breach of 2026.
What it means: Unprecedented scale healthcare breach exposes patients to identity theft, medical fraud, and insurance claim manipulation.
May 2026
CriticalJul 2026
AssuranceAmerica
Financial · 6.9M records
Hackers stole personal information and driver's license numbers from 6.9 million Americans, largest known US driver's license data breach.
What it means: Enables large-scale identity fraud, license cloning, and account takeovers across financial and government systems.
Jul 2026
HighOct 2, 2025
TriZetto Provider Solutions (Cognizant)
Healthcare · 3.4M records
Unauthorized party accessed insurance eligibility verification records since November 2024; breach reported to HHS in February 2026.
What it means: Compromises health insurance information for millions; enables fraudulent claims and medical identity theft.
Oct 2, 2025
HighApr 2026
Carnival Corporation
Financial · 6M records
Hackers gained employee account access via social engineering and stole files with passenger names, addresses, dates of birth, and identification numbers.
What it means: Exposes travelers to identity theft, account takeovers, and fraudulent travel bookings.
Apr 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 39, by the category we filed each one under.