Weekly briefing › No. 9
Weekly briefing · No. 9 · 19 Mar 2026
Six major data breaches impacted North American organizations in 2026, exposing millions of individuals to identity theft, financial fraud, and unauthorized access.
Healthcare, financial services, and logistics sectors accounted for the largest incidents by volume of affected records.
This issue’s disclosures
CriticalFeb 2026
Conduent
Healthcare · 25M records
Ransomware attackers spent three months in systems accessing Medicaid claims, public assistance records, and health insurance data across 46 states.
What it means: Millions of Americans lost control of sensitive medical and financial records used for benefit programs and healthcare coverage verification.
Feb 2026
CriticalJan 2026
Panera Bread
Credential Theft · 5.1M records
Attackers compromised internal systems and published customer names, email addresses, phone numbers, and physical addresses after ransom demands were refused.
What it means: Panera customers face heightened identity theft and phishing risks as their contact information spread across criminal marketplaces.
Jan 2026
CriticalMar 2026
University of Hawaii Cancer Center
Healthcare · 1.2M records
Ransomware gang accessed epidemiology division data containing names, Social Security numbers, driver license information, and voter registration records.
What it means: Victims gained exposure to comprehensive identity fraud and sensitive personal records covering multiple years of research participants.
Mar 2026
HighFeb 2026
Canada Goose
Credential Theft · 1M records
Third-party service provider breach exposed customer names, physical addresses, phone numbers, and email addresses from past transactions.
What it means: Canadian luxury customers now face targeted phishing and marketing fraud tied to their purchase history and personal contact details.
Feb 2026
HighFeb 2026
700Credit
Financial · Undisclosed records
Largest North American provider of credit checks and identity verification for automotive businesses suffered massive breach between July and October 2025.
What it means: Used car buyers and dealers across the continent lost control of credit and identity verification records used during transactions.
Feb 2026
CriticalJan 2026
Illinois Department of Human Services
Healthcare · Hundreds of thousands records
Human error resulted in sensitive health information being uploaded to an unprotected public website and left accessible for over three years before discovery.
What it means: Hundreds of thousands of Illinoisans had deeply personal health data exposed to anyone with an internet connection for an extended period.
Jan 2026
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 9, by the category we filed each one under.