Biggest Data Breaches of 2026: Major Hacks, Leaks and Ransomware Attacks So Far

Cybersecurity has become one of the defining issues of 2026. Digital attacks are no longer isolated incidents affecting a handful of organizations—they have become a global security challenge impacting governments, businesses, healthcare providers, schools, critical infrastructure, and millions of ordinary people.

The first half of the year has seen a sharp increase in ransomware campaigns, destructive malware, attacks against public utilities, supply chain compromises, and massive data breaches involving some of the world’s largest organizations. Nation-state cyber operations have also intensified as geopolitical conflicts increasingly extend into cyberspace, where hackers target infrastructure that supports everyday life.

From allegations involving sensitive government databases to attacks on hospitals, educational platforms, enterprise software providers, and consumer services, the scale and sophistication of recent cyber incidents demonstrate how deeply connected digital security has become to national security and public trust.

Below is a look at several of the most significant cybersecurity incidents reported during 2026 and why they continue to draw attention.

Questions Continue Over DOGE’s Access to U.S. Social Security Data
One of the most controversial cybersecurity stories of the year revolves around the Department of Government Efficiency (DOGE), the government initiative associated with Elon Musk that became involved in restructuring multiple federal agencies.

Following DOGE’s work inside the Social Security Administration, ongoing court cases continue to examine how sensitive government information may have been handled. Among the most serious allegations raised by a whistleblower is the claim that a live copy of the Social Security database was transferred to an unsecured third-party server.

If accurate, the database could have contained Social Security numbers and personal information belonging to the vast majority of living Americans, making it one of the most significant potential government data exposure incidents ever reported.

Court documents indicate that officials remain uncertain about exactly what information was stored on the external server. Legal filings have also described agreements involving an outside political advocacy organization connected to investigations into alleged voter fraud.

Members of Congress investigating the incident have warned that, if the allegations are confirmed, the exposure could represent one of the largest data breaches in United States history.

Critical Infrastructure Remains a Growing Target
Critical infrastructure has become an increasingly preferred target for cyber attackers in 2026.

Across Europe, multiple incidents involving energy providers, power facilities, dams, and water treatment systems have highlighted the risks associated with attacks on operational technology. Several incidents have reportedly been linked to groups believed to have ties to Russia, continuing a broader pattern of cyber activity amid geopolitical tensions.

Late last year, destructive malware targeted Poland’s energy infrastructure. Similar incidents affected facilities, including a thermal power plant in Sweden and a dam in Norway. During 2026, Poland again experienced cyberattacks targeting water treatment operations, reinforcing concerns that civilian infrastructure remains vulnerable during periods of international conflict.

Security officials have also expressed concern that tensions involving Iran, Israel, and the United States may increase the likelihood of cyberattacks against American infrastructure. Water utilities remain a particular concern because many smaller operators continue to face resource limitations in cybersecurity.

Iranian Hackers Linked to Destructive Attack on Stryker
Medical technology company Stryker experienced one of the year’s most disruptive cyber incidents after attackers allegedly linked to Iranian intelligence infiltrated its systems in March.

Rather than focusing solely on intelligence gathering, the attackers reportedly deployed destructive capabilities to remotely erase tens of thousands of employees’ devices. The incident significantly disrupted business operations and required days of recovery efforts before systems could be restored.

U.S. officials attributed the operation to a hacking group associated with Iranian intelligence services. Analysts noted that the attack represented a shift toward more destructive cyber operations instead of traditional espionage-focused campaigns.

The disruption ultimately affected Stryker’s business performance, with the company acknowledging a measurable impact on first-quarter financial results.

Klue Breach Spreads Risk Across Hundreds of Organizations
Competitive intelligence platform Klue suffered one of the broadest enterprise breaches reported during 2026.

The incident affected nearly 200 customer organizations, including several well-known cybersecurity companies. According to the company, attackers associated with the Icarus extortion group gained access using credentials created during a limited pilot program several years earlier that had apparently never been fully retired.

Once inside the environment, attackers reportedly obtained customers’ cloud service credentials, enabling further data theft and subsequent extortion attempts against multiple organizations.

Although cybersecurity experts and governments consistently discourage ransomware payments, Klue informed customers that it had reached an arrangement intended to prevent the publication of the stolen information. Reports surrounding the incident suggested that another criminal group also possessed portions of the compromised customer data, further complicating response efforts for affected organizations.

ShinyHunters Continued High-Profile Campaigns
The ShinyHunters cybercrime group remained among the most active threat actors throughout 2026.

Instead of relying primarily on sophisticated software vulnerabilities, the group continued to use voice phishing to persuade company employees and IT support personnel to grant unauthorized access to systems.

Education technology company Instructure became one of thegroup’ss highest-profile victims after attackers compromised its Canvas learning management platform. Personal information belonging to more than 30 million students and staff members was reportedly stolen during the breach.

After ransom negotiations failed, attackers allegedly returned and defaced Canvas login pages during school examination periods, creating widespread disruption for educational institutions throughout the United States.

Eventually, Instructure reportedly chose to pay the ransom despite law enforcement recommendations against doing so.

Beyond Instructure, ShinyHunters has been linked to additional attacks targeting organizations across the telecommunications, finance, education, and government sectors, resulting in tens of millions of compromised customer records.

Software Supply Chain Attacks Continue Expanding
Open-source software ecosystems have remained under sustained attack throughout the year.

Cybercriminals increasingly targeted software developers, repositories, and widely used security tools, enabling malicious code to spread throughout enterprise environments via trusted software updates.

Several respected security and development projects, including Aqua Security’s Trivy tool, Bitwarden, Checkmarx, and additional open-source projects, were reportedly affected by supply chain compromises.

These incidents enabled attackers to capture passwords, authentication tokens, and other credentials from organizations that installed compromised software versions. Because many businesses automatically update trusted software, downstream victims included larger technology companies that relied on the affected tools.

Among organizations reportedly impacted during follow-on compromises were OpenAI and cloud hosting provider Vercel, demonstrating how a single software supply chain incident can affect thousands of downstream customers.

FBI Surveillance System Incident Raised National Security Concerns
The Federal Bureau of Investigation disclosed a significant cybersecurity incident after determining that one of its surveillance-related systems had been compromised.

The agency formally notified Congress, describing the event as a major cyber incident. Reports indicated that the affected network contained sensitive information related to surveillance operations, including telephone identifiers associated with lawful monitoring activities.

Investigators reportedly attributed the intrusion to Chinese espionage actors operating against an unclassified FBI network.

Because the compromised information related to ongoing surveillance activities, officials concluded that the breach carried potential implications for U.S. national security.

AI Chatbot Exploit Led to Instagram Account Takeovers
Artificial intelligence also entered the cybersecurity conversation after a security vulnerability in Meta’s AI chatbot was reportedly exploited to hijack Instagram accounts.

Attackers allegedly convinced the chatbot that they were legitimate account owners who had lost access to their profiles. By manipulating password recovery workflows, they reportedly redirected reset codes to attacker-controlled email addresses.

The flaw remained active for months before being identified and corrected.

The incident reportedly affected tens of thousands of Instagram accounts, raising new questions about how AI-powered customer support systems should validate user identity before authorizing sensitive account actions.

Hasbro Faced Weeks of Operational Disruption
Toy manufacturer Hasbro also experienced a major cybersecurity incident that significantly disrupted business operations.

Following the discovery of unauthorized access in its environment in late March, the company spent weeks restoring systems while portions of its online infrastructure remained unavailable.

Although Hasbro released limited technical details about the breach, the prolonged outage disrupted customer service and delayed certain business operations, including financial reporting.

Company officials later stated that attackers had been removed from company systems and recovery efforts were progressing. However, analysts expect the incident to have substantial financial consequences as the company continues to evaluate operational and recovery costs.

Sensitive Identity Documents Continue Appearing Online
Beyond ransomware and network intrusions, 2026 has also witnessed a rise in accidental exposures involving government-issued identity documents.

Several unrelated incidents exposed passport scans, driver’s licenses, and other identification records belonging to millions of individuals through misconfigured online storage systems and other preventable security failures.

Affected organizations reportedly included hospitality platforms, financial service providers, prison communications companies, and visa-related services.

These incidents have emerged as governments and private companies increasingly require identity verification through “Know Your Customer” (KYC) processes and age-verification systems. As more organizations collect digital copies of passports and driver’s licenses, cybersecurity experts continue to warn that every additional repository creates another potential target for attackers.

The growing volume of leaked identity documents also increases the risk of identity theft, financial fraud, and account takeover attacks, underscoring the importance of stronger security practices for organizations responsible for safeguarding sensitive personal information.

The Bigger Cybersecurity Picture
The cyber incidents reported during the first half of 2026 reveal an increasingly complex threat landscape. Criminal ransomware groups continue to pursue financial gain, while nation-state actors expand their operations targeting government agencies and critical infrastructure. At the same time, software supply chain attacks, cloud credential theft, AI-related security weaknesses, and accidental data exposures demonstrate that organizations face risks from multiple directions simultaneously.

As businesses, governments, and consumers become increasingly dependent on digital services, cybersecurity is no longer solely an IT responsibility. The events of 2026 illustrate that protecting sensitive information, maintaining resilient infrastructure, and strengthening cyber defences have become essential priorities for organizations worldwide as the second half of the year unfolds.