2026 Data Breaches: Cybersecurity Incidents Explained

AssuranceAmerica

Malicious activity targeting a single employee, which yielded credentials used to access and copy files. No threat group has claimed the incident, and no public source reports a ransom demand.

Neither a driver's license number nor a Tax ID can be reset. That is what separates this breach from a payment card exposure, where reissuing the card ends the problem. Insurers collect government identity documents because underwriting requires them, so minimization is the first question: how long does a closed claims file need a license number in readable form? Everything retained past that point should be tokenized. One employee will eventually click, and tokenization decides what that click costs.

Ernst & Young

Unauthorized access to a third-party IT service management platform used for internal support workflows. EY has not named the vendor or the initial access method. ShinyHunters claimed responsibility on July 27 and set a July 31 deadline for EY to make contact, telling reporters that credentials obtained in a supply-chain compromise also gave it access to EY's Jira, GitHub, and Azure environments. EY has not confirmed the group's involvement or the broader access claim. The deadline passed without publication, and as of August 4, the group has stated that further releases are being prepared.

A help desk platform is a data store that nobody inventories as one. Its purpose is workflow, so it gets classified as an operational tool while quietly accumulating whatever employees attach to tickets. An inventory that says tax filings live in the tax systems is not wrong, only incomplete, and that gap is where this data sat. The exposure compounds through the supply chain: financial institutions gave the data to EY, EY moved it into a vendor platform, and the people whose Social Security numbers were taken had no relationship with either. Discovery must scan where data drifted, not where policy says it lives.

Craneware

Unauthorized access to a subset of the company's data environment. Craneware has not disclosed the vector, the threat actor, or the duration of access, and external specialists confirmed no residual indicators of compromise.

This entry belongs in the report for the same reason the NAIC breach did last month: concentration, not severity. A hospital can harden its own endpoints, train its own staff, and patch its own systems. But none of that addresses the risk with the vendor that processes its billing. Where healthcare organizations retain control is in what they hand over and in what form. Sending tokenized identifiers to a revenue analytics platform preserves the analytics while removing identity data from the vendor's blast radius.

Abbott

ShinyHunters says it gained access through a vishing campaign against several employees in mid-June, compromising a corporate Microsoft Entra single sign-on account and taking data from connected applications. Abbott has not confirmed the vector or named the group. The group's original publication deadline of July 18 was extended to July 21 after contact was made, and as of August 4 no data has been published.

Due diligence prices an acquisition's revenue with far more rigor than it maps the acquisition's data. A company closing a deal inherits every archive, every legacy database, and every retention practice the target ever had. It inherits them on day one, while integration runs for quarters. The separate legacy environment Abbott describes is the environment an attacker reached. Automated discovery across an acquired estate belongs in the first 30 days after close, not in the integration backlog, because regulated data is a liability from the moment the papers are signed.

NYC Health + Hospitals

The health system says the actor may have gained access to its systems due to a security breach at a third-party vendor. It detected the activity on February 2, 2026.

Every downstream control arrives too late for a fingerprint. Cards get reissued, and passwords rotated, but a palm print is permanent, and the people in this breach carry that exposure for life. So, the question is not how to protect it. It is why a hospital system held it in a form that could be copied, which makes this minimization before encryption. Biometric identifiers belong in storage as irreversible templates, retained only as long as the access-control purpose lasts. A breach you have closed is not finished while the stolen data remains readable.

One Medical (Amazon)

Unauthorized access to a third-party archival file storage platform; ShinyHunters claimed responsibility, though One Medical has not named the group.

Legacy systems are healthcare security’s most common blind spot, and this is a clean example. The exposed data belonged to a practice acquired five years ago, parked in an archive that likely received less protection than the live record, yet it still contained clinical records on elderly patients, data with permanent identifiers, and a real risk of Medicare fraud. The fix is twofold: automated discovery that surfaces forgotten and migrated data, and persistent encryption so an archive breach yields unreadable files. Data you have stopped using is still your responsibility.

National Association of Insurance Commissioners (NAIC)

Unauthorized access to the NAIC’s PeopleSoft system; ShinyHunters claimed responsibility. The intrusion fits the group’s broader 2026 Oracle PeopleSoft zero-day campaign.

This is a systemic-risk breach, not a consumer-records one: a single aggregator consolidated filings and identifiers from across the entire U.S. insurance industry, so a single intrusion exposed thousands of insurers at once. It is the sector’s version of the vendor problem: sensitive data funneled into shared platforms whose security becomes everyone’s. The lesson holds even after NAIC’s clarification that most of the data was already public, because the risk was never the sensitivity of any one filing; it was the concentration. Encryption and tokenization at rest, plus strict access governance, would have meant that reaching the system did not equal reading its contents.

Madison Square Garden Entertainment

Data-theft extortion by ShinyHunters; the company declined to pay, and the data was published. MSG has not detailed the initial intrusion vector.

The biometric angle echoes last month’s NYC Health and Hospitals breach for the same reason: a face, like a fingerprint, cannot be reissued. Data collected to control building access is now in criminal hands, and the people in it cannot reset their exposure. Before encryption even applies, there is a data-minimization lesson: biometric and behavioral profiles should not be retained by default, and where kept must be encrypted and access-governed at rest.

DentaQuest

ShinyHunters data theft and extortion; the company did not reach an agreement, and the data was published.

Medicaid IDs and enrollment records are exactly the regulated, durable data that should never sit in a form an attacker can read after exfiltration. Structured enrollment files point to large volumes of standardized, highly sensitive records, the precise case where field-level encryption and tokenization pay off. A benefits administrator is also a concentration point, holding data for states, insurers, and millions of members, so its posture becomes theirs. Encrypting the fields that carry Medicaid IDs would have changed what the leak was worth.

Novo Nordisk

Unauthorized access via an exposed high-privilege developer credential (a GitHub personal access token), followed by lateral movement using credentials found in repositories. Attributed to the claimant group FulcrumSec; no ransomware was involved.

This is the month’s most instructive breach because it shows data-centric protection working and failing in the same incident. Because the trial data was pseudonymized, Novo Nordisk could credibly tell patients the records could not be tied back to them, de-identification doing exactly what it is designed to do. Everything not protected that way, the healthcare professional contact details, the source code, the AI models, left fully usable. The entry point cuts the other way: one developer token and credentials left in repositories were enough, which is why secrets management and non-human-identity inventory now matter. Protect and minimize the data, and a breach becomes a disclosure you can manage rather than one that defines you.

NYC Health + Hospitals

Compromised unnamed third-party vendor; specific access vector not disclosed.

A stolen password can be changed, a Social Security number can be flagged, a credit card can be reissued. A stolen fingerprint cannot. Biometric exposure is permanent, which makes it the clearest possible case for protecting the data at rest rather than relying on the network around it. The breach also illustrates the vendor problem in its starkest form: the organization that hardened its own systems was compromised through one it did not run. Automated data discovery that flags where biometric and regulated data lives, combined with persistent encryption on that data, would have meant the exfiltrated files were unreadable to the attacker regardless of which vendor opened the door.

Instructure (Canvas)

ShinyHunters’ extortion attack via a vulnerability in the Free-For-Teacher account program.

This is the breach that proves paying the ransom is not the same as protecting the data. Instructure paid and received a promise, but 275 million students and staff still had their information copied by a criminal group, and the inclusion of private messages makes this far more dangerous than a name-and-email leak. The “contained by May 6, defaced on May 7” sequence is a reminder that an organization’s belief that an incident is over is not evidence that it is. The durable defense is not negotiation after the fact, it is rendering exfiltrated data useless before it leaves: persistent encryption on student records and message stores, scoped access, and discovery that surfaces unverified account programs before an attacker finds them first.

Charter Communications (Spectrum)

Voice phishing (vishing) compromise of an employee’s Microsoft Entra account, used to access the Salesforce CRM instance.

A single phone call gave an attacker a path into a CRM holding millions of customer records, which is the entire ShinyHunters playbook in one sentence. The gap between Charter’s “only sales tools” framing and the 4.9 million records confirmed in the wild is instructive: from a customer’s standpoint, the question is not how limited the breach felt internally, but whether the exposed data fuels phishing and fraud, and here it does. CRM platforms concentrate exactly the kind of personal data that should never sit in plaintext. Encrypting and tokenizing sensitive fields inside the CRM, paired with monitoring for anomalous bulk export volumes, would have blunted both the theft and its aftermath.

Carnival Corporation

Social engineering of a single employee account, used to access and exfiltrate files from company systems.

One deceived employee should not be able to expose 6 million people’s passport and driver’s license numbers, and the fact that it can is an architecture problem, not just a training problem. Passport and license numbers are exactly the kind of durable identifiers that enable identity theft for years, and unlike a password, they are not something a customer can rotate. Carnival’s repeated appearances in breach databases suggest the underlying issue is structural rather than a one-time failure. Persistent encryption of customer identity data, least-privilege access that limits what any single account can access, and bulk-export controls would have turned a single phished login into a contained incident instead of a 6-million-person disclosure.

The Oncology Institute

Unauthorized third-party access to a software service vendor’s systems; no threat actor has claimed responsibility.

This breach is the quiet version of the month’s loudest theme: the breached organization did nothing visibly wrong, and its patients were still exposed because the failure occurred within a vendor’s systems. Healthcare runs on an interconnected web of billing, eligibility, and software providers, each of which becomes part of the provider’s actual attack surface the moment it is granted access to patient data. Medical records carry permanent identifiers that cannot be reissued, and a provider cannot encrypt data it has handed to a vendor in plaintext. The lesson is to push protection upstream: require that sensitive data shared with vendors is encrypted and policy-governed before it leaves your environment, and maintain a current map, through automated discovery, of which third parties hold which regulated data.

Citizens Financial Group & Frost Bank

Everest ransomware via a shared third-party vendor.

Two well-resourced banks blaming the same unnamed vendor on the same day means the vendor’s security posture became their security posture. The contrast between the datasets is instructive; Citizens’ exposure is largely to scams and profiling, while Frost’s is a near-complete identity-theft toolkit. Persistent encryption that travels with the data would have neutralized Frost’s exposure entirely; the hackers may have taken the files, but encrypted SSNs and tax records are useless without keys.

France Titres / ANTS (French Government)

Undisclosed; investigation ongoing under CNIL, Paris Prosecutor, and ANSSI.

Government identity database breaches are categorically more dangerous than commercial breaches because the data carries implicit authority. A scammer who knows a victim’s name, birthdate, and address sourced from the agency that issued their passport can run impersonations that random scraped data cannot match. Critical identity systems require data minimization, encryption that stays with the data, and continuous monitoring for anomalies in bulk exports.

Medtronic

ShinyHunters extortion attack; initial access vector not disclosed.

Medical device manufacturers carry both corporate and clinical risk surfaces, and the corporate-only framing only holds if segmentation is real. Medical records contain permanent identifiers; unlike credit cards, you cannot cancel your medical history. Persistent encryption on corporate-held customer and partner data limits what attackers can monetize, and automated discovery ensures regulated data does not drift into unprotected systems.

Adobe

Supply-chain compromise via third-party BPO; phishing followed by privilege escalation.

A single support agent being able to extract 13 million records in one query is an architectural gap, not a policy gap. The HackerOne submissions are the most damaging part; unpublished vulnerabilities could be weaponized before patches ship. Bulk export controls and DLP triggers on anomalous query volumes would have caught this. Persistent encryption on customer support data would have rendered the stolen tickets unusable after exfiltration.

Vercel (via Context.ai)

OAuth supply-chain compromise via Lumma Stealer infection at Context.ai.

One employee granting broad Workspace permissions to a third-party AI tool gave attackers an inherited trust path into Vercel. The breach was not discovered by Vercel’s security team; it was discovered when the attacker chose to monetize publicly. The OAuth graph is now the new perimeter, and most companies have no inventory of which third-party apps their employees have authorized. Tightening OAuth scope reviews and inventorying authorized third-party apps would have closed the lateral path before it was used.

Stryker

Handala gained access to the company’s Active Directory Services, using the Microsoft endpoint management tool, Microsoft Intune.

This is a unique incident. Hackers didn’t steal data; they wiped in from internal systems, which triggered operational fallout. The attack on endpoint systems wasn’t to exfiltrate or hold for ransom; it was about disruption.

When there’s a compromise to endpoints, cyber criminals can deploy software to wipe, encrypt, or exfiltrate data as well as disable security mechanisms.

While you cannot eliminate this risk, you can do these things:

• Ensure automated sensitive data discovery, so you always know where data is.
• Use policy-based protection to determine what to do with the discovered data consistently (e.g., encrypt, mask, redact, etc.).
• Enable persistent encryption that stays with data regardless of where it goes.

Aura

ShinyHunters claimed responsibility via a phishing attack.

Aura did an excellent job of responding quickly. Often, it takes weeks or even months to detect unauthorized access. Even though data stolen wasn’t sensitive, it’s still a reminder that organizations should deploy data-centric encryption, which is “sticky.” It stays with the data no matter where it goes.

Data breach resiliency strategies can reduce the effects of ransomware. Such programs involve enterprise-wide visibility of sensitive data and preemptive protections, such as encryption, masking, and redaction.

Navia

Exposed API

Perimeter defenses were insufficient to thwart unauthorized actors. They stole PII and PHI; data that should be encrypted at rest and in transit. Persistent encryption driven by enterprise-wide policies could have made a difference. The hackers may have taken the data, but with encryption, it would have been unusable.

Pathstone Family Office

ShinyHunters ransomware

Attorneys filed a class action against Pathstone, alleging inadequate cybersecurity practices and noncompliance. Those claims will have to play out in court. Pathstone has yet to issue breach notifications or public responses. Any breach indicates a gap in perimeter security; access controls likely failed. Modern encryption that stays with data could have rendered it useless to the cyber criminals.

University of Hawaiʻi

Ransomware

An unauthorized user was able to encrypt and exfiltrate data during the attack. UH said that they have no reports of hackers publishing any stolen data. They continue to investigate the root cause. This incident brings to the forefront the discussion on knowing where all sensitive data resides.

The breached files were part of a subset and were collected between 1993 and 2007. This was likely old data that UH may no longer have needed to keep. It could have been “forgotten data,” which carries risk. Having policies in place to delete or remove old data would have potentially prevented this.

BridgePay

Ransomware

Ransomware continues to be a risk for any organization. Proactively securing data against it is your best approach. Key components of a proactive data security program include automated data discovery and protection. Discovery is a critical first step since you must know where all sensitive information is to protect it.

Using policy-driven protection controls enables you to define them centrally and apply them consistently across your enterprise. You can also ensure secure data exchange with certificate-free, modern encryption.

University of Mississippi Medical Center

Ransomware

Healthcare remains an attractive target for ransomware. Few are ready, as almost 40% of organizations facing an incident took a month or more to recover.

Data breach resiliency strategies can reduce the effects of ransomware. Such programs involve enterprise-wide visibility of sensitive data and preemptive protections, such as encryption, masking, and redaction.

Marquis Health

Ransomware breach on SonicWall cloud backup hack

The source of the breach was Marquis’s cybersecurity partner, SonicWall, as alleged in their lawsuit. Marquis’s investigation found that the attacker leveraged configuration data extracted from SonicWall’s cloud backup infrastructure tied to an API code change.

Marquis also stated its firewall was up to date and had other security controls in place, including MFA.

This incident underscores the importance of auditing partners that support technology, networks, or other infrastructure. Additionally, companies must take steps to ensure exfiltrated data isn’t usable by encrypting, masking, or redacting it properly and consistently.

Substack

Unauthorized third-party access

Since the hacker had limited account access, there was no PII or PHI breached. However, this incident serves as a warning against depending too much on perimeter controls as the last line of defense. Unfortunately, weaknesses are common here. The best way to bolster defenses is with data-centric protections that are always present. When data has persistent protection, if stolen, data is typically unusable.

CarGurus

ShinyHunters claimed responsibility via social engineering.

Employees can be a weak link in cybersecurity. While training helps, hackers have become very sophisticated in their social engineering attacks. As such, you can’t always count on employees to recognize and report phishing.

To further safeguard data against such a breach, persistent, modern encryption should be part of a data protection program. When it is, it never leaves the data, so anything hackers steal won’t be of value if they can’t decrypt it.

Illinois and Minnesota Department of Human Services

In Illinois, an error caused patient data to be publicly viewable. In Minnesota, the culprit was unauthorized access to data that was outside the scope of employee work assignments.

It's imperative for every organization to have complete visibility of where sensitive data resides. Automated discovery provides this visibility enterprise-wide and centralized, policy-based protection ensures consistent security of data. For four years, the data of Illinois residents was available online. Having an always-up-to-date inventory with data-centric protection can prevent such exposure.

Identity access control (IAC) plays a key role in thwarting unauthorized access, but relying on it as the last line of defense has shortcomings. IAC doesn't truly protect your critical data and sensitive data can be exposed if data moves or credentials are compromised. Protecting data through encryption, masking, or redaction secures data at rest and in motion and ensures that exfiltrated data is useless to bad actors.

Ledger and Global-e

The company identified unusual activity in its cloud systems and moved to secure it. They did not disclose the root cause.

Companies should adopt persistent encryption and protection across all environments. With such a proactive strategy in place, organizations can protect across the enterprise. When security is data-centric, it reduces the effect of breaches.

Cloud-Sharing Sites

Stolen credentials and lack of multi-factor authentication

Cloud exposure has been a risk component for many years. MFA has become mandatory in many regulations. Will this alone be enough to reduce unauthorized access? No, but enterprise-wide data encryption, redaction, and masking limit the fallout of such an attack.

Nike

Not defined, but threat intelligence firms have suggested a connection to supply chain infrastructure.

This data breach involves corporate data versus customer data. Investigators did not find personal identifiers. However, the leak of IP and other trade secrets could have been of value to competitors.

Organizations should enforce security controls and cybersecurity best practices with supply chain vendors. Additionally, security embedded into data follows it wherever it goes.

Crunchbase

Social engineering campaign using voice phishing techniques

Social engineering, especially deepfakes, is much more sophisticated than ever before. They are emerging as a key way for hackers to compromise credentials. While you can't eliminate all breach risk, you can take proactive steps to minimize the impact. Examples include:

• Identifying older files and enforcing data retention policies
• Using encryption mechanisms that stay with data
• Applying data discovery and classification solutions to build an inventory of sensitive information

Match Group

According to ShinyHunters dark web leak site, it cited AppsFlyer as the entry point. AppsFlyer is a marketing analytics company for apps.

It appears this is another third-party system failure. Data sharing for analytics is essential to any business but carries risk. Secure data exchange, internally or externally, with modern encryption allows for access while safeguarding data.