Weekly briefing › No. 6
Weekly briefing · No. 6 · 19 Mar 2026
North America experienced significant data breaches across healthcare, finance, and retail sectors in early 2026, with millions of customer records exposed through vulnerable third-party systems and compromised credentials.
Organizations are increasingly targeted through supply chain weaknesses and legacy infrastructure gaps.
This issue’s disclosures
CriticalJan 16
Canadian Investment Regulatory Organization (CIRO)
Financial · 750,000 records
Attackers compromised investor data including social insurance numbers, investment account details, and government ID numbers through a sophisticated attack in August 2025.
What it means: Investors face heightened risk of identity theft and account takeover with government-issued identifiers and financial account information exposed.
Jan 16
CriticalJan 15
Conduent
Healthcare · 25.0M records
A business services provider handling Medicaid claims and benefit administration across 46 states lost healthcare records including medical data and insurance information.
What it means: Nationwide healthcare system vulnerability exposed as critical backend infrastructure shows inadequate security controls for sensitive patient and government benefit data.
Jan 15
HighJan 22
Panera Bread
Credential Theft · 5.1M records
Customer names, email addresses, phone numbers and physical addresses were stolen and published online after the company declined to pay an extortion demand.
What it means: Customers face targeting through exposed contact information and elevated risk of account takeover and physical security threats at home addresses.
Jan 22
CriticalJan 10
Colorado Healthcare (IBM MOVEit)
Healthcare · 4.1M records
Sensitive patient health data from a Colorado provider was stolen by exploiting a vulnerability in file transfer software used to manage healthcare systems.
What it means: Patients' medical histories and treatment information exposed, creating long-term privacy risks and potential insurance fraud opportunities.
Jan 10
HighFeb 05
Substack
Credential Theft · 697,000 records
Approximately 663,000 to 697,000 user accounts had email addresses, phone numbers and account metadata exposed through API data harvesting that went undetected for four months.
What it means: User contact information compiled for targeted communication attacks, with extended exposure window indicating inadequate security monitoring.
Feb 05
CriticalAug 15
University of Hawaii Cancer Center
Healthcare · 1.2M records
Epidemiology research data including names, social insurance numbers, driver's licenses and voter registration information was stolen from the center's division.
What it means: Comprehensive personal identity data exposed enabling potential voter fraud, identity theft, and fraud targeting research participants across multiple institutions.
Aug 15
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 6, by the category we filed each one under.