The most damaging cyberattacks and data breaches of 2026 so far

Questions linger over DOGE’s massive Social Security data swipe

More than a year after agents from the Elon Musk‑led Department of Government Efficiency (DOGE) dismantled federal agencies, uncertainty remains about the fate of highly sensitive Social Security data. A whistleblower alleges that DOGE uploaded a live copy of the entire Social Security database to an unsecured third‑party server, an act that could expose the Social Security numbers of nearly every American. The Social Security Administration has not confirmed what was stored on the server but disclosed that DOGE entered an agreement with an outside political advocacy group under the pretext of investigating alleged voter fraud, a claim repeatedly made by former President Trump without evidence. Two senior House Democrats investigating the matter warned the exposure “could very well be the largest data breach in our nation’s history.” Ongoing lawsuits aim to uncover the full scope of the incident.

Hackers target U.S. water systems and European energy grids to sow chaos

A wave of attacks across Europe has hit civilian energy and water infrastructure, including power plants, a Swedish thermal facility, a Norwegian dam that spilled entire swimming pools’ worth of water, and Poland’s electricity grid, which was infected with computer‑destroying malware late last year. Russian actors are suspected of orchestrating some of these incidents, including a recent assault on Polish water treatment plants. Meanwhile, in the United States, Iranian hackers have exploited the ongoing conflict with Iran to strike more than a hundred water providers this summer, according to CISA. Many of these utilities lack robust cybersecurity funding, making them attractive soft targets for disruption.

Klue breach exposes cloud keys of dozens of major customers

Market research firm Klue suffered a breach that compromised data belonging to roughly 200 clients, among them cybersecurity leaders Jamf, HackerOne, and LastPass. The breach occurred less than a year after Klue laid off half of its staff while shifting focus toward artificial intelligence. The intrusion was traced to a credential originally issued in 2022 for a limited pilot program, which remained active for years before being stolen. Hackers used the stolen key to pull cloud service credentials, then accessed and exfiltrated customer data to demand ransom. Klue informed its clients that it had negotiated a deal with the attackers to prevent public release of the stolen information, a move that strongly suggests a ransom payment was made. The attackers also disclosed that another criminal group held a portion of the same customer data and urged victims not to pay that group.

Meta’s AI chatbot exploited to hijack thousands of Instagram accounts

Early in 2026, attackers abused Meta’s AI chatbot to reset passwords on thousands of Instagram accounts. By impersonating account owners and requesting a password‑reset code be sent to a chosen email, the perpetrators gained unauthorized access. The scheme, first reported by 404 Media, affected tens of thousands of users before Meta detected and blocked the misuse. The incident highlighted a glaring flaw in Meta’s authentication flow and raised concerns about the company’s ability to protect user trust.

FBI and ATF suffer major cyber incidents, exposing surveillance data

In April the FBI declared a “major cyber incident” after an unclassified surveillance system was compromised, potentially leaking phone numbers of individuals under federal wiretap. U.S. officials attributed the breach to Chinese espionage actors. A separate “major incident” was reported by the ATF in August, when a ransomware gang claimed responsibility for breaching a system containing “targets of ATF investigations.” Both agencies were required to notify Congress, indicating the breaches met the threshold for “demonstrable harm” to national security.

The software supply chain is under attack, targeting open‑source projects and Big Tech companies

Throughout the year, attackers infiltrated widely used open‑source projects, including Aqua Security’s Trivy, Bitwarden, and Checkmarx, by planting backdoors in software updates. The compromise allowed the intruders to harvest credentials and other secrets from any user who installed the tainted code, or whose pre‑installed software auto‑updated to download the malware. The fallout extended to downstream customers such as OpenAI and Vercel, whose cloud keys were later reported stolen. The EU’s top cyber agency confirmed a major data heist linked to the same operation. By August, two suspects were apprehended in Australia.

Hundreds of millions of driver photos exposed in IDScan breach

A breach at identity verification provider IDScan exposed a searchable database of roughly 150 million driver’s license photos from the United States and Canada on the dark web, even listing the image of the reporter who first reported the breach. The company acknowledged the incident shortly after discovery, and the stolen data—collected over the preceding year—is reportedly being held for ransom. This exposure compounds a broader trend of identity document leaks, with separate incidents at hotel check‑in systems, money‑transfer apps, prison payphone services, and a U.K. visa service collectively compromising the personal records of more than two million people. Many of these breaches stemmed from simple security lapses that could have been prevented with basic cybersecurity practices.

Healthcare sector hit by massive record breaches

Multiple healthcare data incidents this year have exposed the medical information of tens of millions of Americans. Insurance provider DentaQuest suffered the largest single breach, with 15 million members’ health data stolen. CareCloud, a host of electronic patient records, lost the data of at least 3.7 million patients. A breach at billing and data firm Aesto Health, originally disclosed at the end of 2025, was later confirmed to affect roughly 9.5 million patients across dozens of provider networks.

Hasbro’s hack led to weeks of downtime

In late March, toy manufacturer Hasbro discovered intruders within its network, prompting an extended outage that left its website and customer services offline for weeks. Hasbro, owner of brands such as Transformers, Peppa Pig, and Dungeons & Dragons, disclosed little about the scope of data loss or whether a ransom was paid, but the disruption forced a delay in filing its quarterly SEC report. The company announced in May that the attackers had been evicted and recovery was underway, though the financial repercussions and operational setbacks are expected to linger.

Instructure falls victim to ShinyHunters’ disruptive hacking campaigns

Education technology leader Instructure fell victim to the ShinyHunters criminal group, which used voice‑phishing tactics to gain access to internal systems. The English‑speaking hackers breached Canvas, the company’s flagship learning management system, stealing private data and personal information of over 30 million students and staff. After Instructure refused an initial ransom demand, the hackers returned, defacing Canvas login screens during U.S. school finals and disrupting exam access. The company ultimately paid the ransom despite FBI guidance against it. ShinyHunters has also claimed breaches of Charter (≈40 million records) and Carnival (≈6 million records), among other targets in higher education, finance, and government.

Medical device makers Stryker and Boston Scientific struck with destructive attacks

In March, Iranian hackers infiltrated Stryker, a U.S. medical‑technology firm, and remotely erased tens of thousands of employee devices, causing days of operational paralysis. The incident marked a shift in Iranian cyber tactics from espionage to destructive sabotage amid ongoing conflict, and the breach materially affected Stryker’s first‑quarter earnings. In August, Boston Scientific experienced a similar fate when a cyberattack severed its global network, halting shipments and new orders. The Massachusetts‑based maker of heart implants, including pacemakers, reported that some patients were impacted by the outage. Recovery took two weeks for the immediate disruption, with longer‑term remediation continuing into September.

First published on June 8, and updated on July 7 and again on September 15.