Major healthcare and technology breaches exposed tens of millions of North Americans during 2026, with Conduent affecting over 25 million individuals across multiple states and triggering regulatory investigations. Critical credential and personal data thefts span financial services, retail, and telecommunications sectors.
Ransomware gang accessed government technology contractor systems for three months, stealing 8TB of healthcare and benefits data affecting Texas, Oregon, and other states.
What it means: Victims face long-term identity theft and medical fraud risk as Social Security numbers and health insurance information are permanently compromised.
Attackers accessed internal systems and released 760MB of customer records including names, emails, phone numbers, and addresses after ransom demands were refused.
What it means: Customers are at high risk for phishing attacks and identity fraud as complete contact details are now publicly available.
Exploitation of MOVEit transfer software vulnerability compromised sensitive healthcare records of 4.1 million Colorado patients managed by IBM systems.
What it means: Patients' medical histories and personal health information are exposed to potential misuse and targeted medical identity theft schemes.
Luxury retailer disclosed data exposure of nearly one million customer records through third-party breach originating in August 2025, including names, addresses, and contact information.
What it means: Customer transaction history and personal contact data enable targeted marketing fraud and identity theft campaigns.
Ransomware gang breached cancer center epidemiology division and stole data of 1.2 million individuals including names, Social Security numbers, and driver's license information.
What it means: Research subjects and patients face permanent loss of control over their most sensitive identity documents enabling lifetime fraud.
Largest credit check provider for North American automotive businesses suffered massive breach between July and October 2025 via compromised third-party API.
What it means: Car buyers and dealers have financial profiles and credit information exposed, enabling loan fraud and account takeovers.