Weekly briefing › No. 8
Weekly briefing · No. 8 · 19 Mar 2026
Major healthcare and technology breaches exposed tens of millions of North Americans during 2026, with Conduent affecting over 25 million individuals across multiple states and triggering regulatory investigations.
Critical credential and personal data thefts span financial services, retail, and telecommunications sectors.
This issue’s disclosures
CriticalFeb 05
Conduent
Healthcare · 25.9M records
Ransomware gang accessed government technology contractor systems for three months, stealing 8TB of healthcare and benefits data affecting Texas, Oregon, and other states.
What it means: Victims face long-term identity theft and medical fraud risk as Social Security numbers and health insurance information are permanently compromised.
Feb 05
CriticalJan 29
Panera Bread
Credential Theft · 5.1M records
Attackers accessed internal systems and released 760MB of customer records including names, emails, phone numbers, and addresses after ransom demands were refused.
What it means: Customers are at high risk for phishing attacks and identity fraud as complete contact details are now publicly available.
Jan 29
CriticalJan 15
IBM/Colorado Healthcare
Healthcare · 4.1M records
Exploitation of MOVEit transfer software vulnerability compromised sensitive healthcare records of 4.1 million Colorado patients managed by IBM systems.
What it means: Patients' medical histories and personal health information are exposed to potential misuse and targeted medical identity theft schemes.
Jan 15
HighFeb 15
Canada Goose
Credential Theft · 1M records
Luxury retailer disclosed data exposure of nearly one million customer records through third-party breach originating in August 2025, including names, addresses, and contact information.
What it means: Customer transaction history and personal contact data enable targeted marketing fraud and identity theft campaigns.
Feb 15
HighFeb 27
University of Hawaii
Healthcare · 1.2M records
Ransomware gang breached cancer center epidemiology division and stole data of 1.2 million individuals including names, Social Security numbers, and driver's license information.
What it means: Research subjects and patients face permanent loss of control over their most sensitive identity documents enabling lifetime fraud.
Feb 27
HighJan 20
700Credit
Financial · 5.8M records
Largest credit check provider for North American automotive businesses suffered massive breach between July and October 2025 via compromised third-party API.
What it means: Car buyers and dealers have financial profiles and credit information exposed, enabling loan fraud and account takeovers.
Jan 20
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 8, by the category we filed each one under.