Weekly briefing › No. 7
Weekly briefing · No. 7 · 19 Mar 2026
Six major North American data breaches spanning early 2026, late 2025, and mid-2024 exposed millions of customer and employee records through credential theft, ransomware, and API vulnerabilities.
Recent attacks underscore rising threats from vishing and insider threats targeting financial, retail, and technology sectors.
This issue’s disclosures
CriticalJan 21
Under Armour
Credential Theft · 72.7M records
In January 2026, customer data from the incident was published publicly on a popular hacking forum, including 72M email addresses.
What it means: Records contained names, dates of birth, genders, geographic locations and purchase information, creating targeted phishing and identity theft risk.
Jan 21
Feb 03
Coinbase
Credential Theft · 30 records
A contractor improperly accessed customer information, impacting a very small number of users (approximately 30).
What it means: The breach involved unauthorized use of support tools to obtain personal information, including email addresses, names, dates of birth, phone numbers, KYC details, and cryptocurrency wallet data.
Feb 03
CriticalJan 27
Panera Bread
Credential Theft · 5.1M records
On January 27, 2026, the cybercriminal group ShinyHunters leaked a massive database containing approximately 14 million Panera Bread records on the dark web.
What it means: The data included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses, fueling scam risk.
Jan 27
CriticalAug 16
National Public Data
Infrastructure · 2.9B records
In August 2024, National Public Data, a Florida-based background check company, suffered one of the largest data breaches in history with personal information of approximately 2.9 billion individuals compromised, including Canadians.
What it means: The breach exposed 2.9 billion records including full names, social security numbers, mailing addresses, email addresses, and phone numbers, and occurred because the NPD website had inadvertently published a zip file with the back-end passwords for the database.
Aug 16
CriticalFeb 04
Change Healthcare
Healthcare · 145M records
In February 2024, Change Healthcare, a healthcare technology company, was targeted in a ransomware attack that impacted 145 million individuals, with sensitive personal, medical, and billing information compromised, resulting in widespread disruption of critical healthcare operations across North America.
What it means: The attack targeted UH's Change Healthcare payment processing system, deploying ransomware to take systems offline, cascading across hospitals and clinics.
Feb 04
CriticalMay 31
Ticketmaster
Financial · 560M records
On May 31, 2024, Ticketmaster confirmed a significant data breach that exposed the personal and financial information of over 560 million customers.
What it means: Cybercriminals accessed 1.3 terabytes of data through unauthorized activity in a third-party cloud database environment, with stolen information including sensitive personal details such as names, addresses, email addresses, and credit card information.
May 31
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 7, by the category we filed each one under.