Security data breaches are one of the biggest challenges organizations face today. Every year, companies deal with data leaks, ransomware attacks, or unauthorized access to sensitive information, often because of preventable mistakes in their software or infrastructure.
The cost and frequency of these incidents continue to rise. IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a breach at $4.99 million, up 12% from the prior year.
Staying informed is the first step to staying secure. That’s why we created this updated tracker of major security data breaches to serve as a central place where you can find verified incidents, learn what went wrong, and see how these real-world examples can help you strengthen your own data security practices.
This tracker only includes security data breaches that meet at least one of these criteria:
Where an affected organization has not confirmed a threat actor’s number, we label the figure as “claimed” or “reported” rather than presenting it as verified. We also distinguish between the date an intrusion occurred and the date it was publicly disclosed.
We hope this tracker makes it easier for teams to see how breaches happen and, more importantly, what steps they can take to prevent them.
Below is an updated list of security data breaches and major cyber incidents. Each item includes when the breach was disclosed, the organization and industry affected, the type of attack, and a link to a credible source for full details.
Instructure (Canvas) — May 2026: Cyberattack and extortion; full scope not confirmed
Instructure confirmed that an attacker accessed data including names, email addresses, student ID numbers, and messages. The company did not publicly confirm the total population affected; the threat actor claimed data tied to nearly 9,000 schools, while reporting placed the number of affected students and staff above 30 million. Passwords, dates of birth, government identifiers, and financial data were not believed to be involved. Sources: Instructure, Reuters, and TechCrunch.
Under Armour — January 2026: Customer dataset published; approximately 72 million email addresses reported
A dataset linked to a late-2025 intrusion appeared online in January 2026. Under Armour said it was investigating and found no evidence that passwords or payment information were involved. Have I Been Pwned reported approximately 72 million exposed email addresses, with some records also containing names, birth dates, genders, ZIP codes, and purchase information. Sources: AP and Have I Been Pwned.
Conduent — February 2026 update: Ransomware-related breach; at least 25 million people reported affected
The underlying cyberattack disrupted Conduent in January 2025, but state breach filings reported in February 2026 expanded the known impact to at least 25 million people. Exposed data varied by person and may have included Social Security numbers, medical information, and health insurance information. Source: TechCrunch.
AssuranceAmerica — July 2026: Compromised employee credentials; 6,998,886 people affected
The U.S. auto insurer said an attacker targeted an employee and used compromised credentials to enter its systems in March. Stolen information included names, contact details, driver’s license numbers, and insurance policy, vehicle, and claims information. The affected-person count comes from state breach filings. Sources: TechCrunch and BleepingComputer.
Odido — February 2026: Unauthorized access and extortion; approximately 6.2 million customers affected
Attackers accessed a customer contact system belonging to the Dutch telecom provider and stole data that included names, contact information, dates of birth, bank account numbers, and identification details. Odido later confirmed that the attackers began publishing data after the company declined to negotiate. Sources: Odido and Reuters.
Carnival Corporation — May 2026: Data theft and extortion; nearly 6 million people affected
Carnival disclosed a breach affecting data associated with nearly 6 million people. The incident was linked in reporting to the same ShinyHunters social-engineering and extortion campaign that targeted several large organizations in 2026. Source: BleepingComputer.
Origin Energy — July 2026: Unauthorized customer-data access; approximately 900,000 current and former customers affected
The Australian energy provider said information belonging to approximately 900,000 people was accessed. Depending on the customer, the data may have included contact and account information, dates of birth, and partial payment or bank account details. Source: Origin Energy.
| Disclosed | Organization | Industry | Reported scope | Type of attack | What happened | Source |
| July 2026 | UK Department for Education and Police National Legal Database | Government | More than 740,000 records reported | Unauthorized access and extortion | Attackers stole contact and organizational data from government systems. Authorities said the affected Department for Education data was limited mainly to customer-service information. | The Guardian |
| June 2026 | Klue and downstream customers | Technology/market intelligence | Close to 200 organizations reported affected | Third-party compromise | An old credential was used to access Klue, and exposed cloud-service keys allowed attackers to target customer environments. | TechCrunch |
| May 2026 | Charter Communications | Telecommunications | 40 million records claimed; not confirmed by Charter | Social engineering and cloud-account compromise | Charter confirmed an incident, while the threat actor claimed it used voice phishing to reach a cloud environment and steal consumer and business data. Charter disputed that sensitive personal or customer network information was taken. | TechRadar |
| March 2026 | Stryker | Medical technology | Tens of thousands of employee devices reportedly disrupted | Destructive cyberattack | Iranian government hackers were reported to have remotely wiped employee devices, causing operational disruption. | TechCrunch |
| February 2026 | Canada Goose | Retail | More than 600,000 customer records claimed | Third-party data leak claim | ShinyHunters published data it attributed to Canada Goose. The company said the information appeared to relate to past transactions and that it found no evidence of a recent breach of its own systems. | The Record |
Several incidents in the previous draft were assigned to 2025 even though they occurred or were disclosed in 2024. The corrected 2025 list is below.
Every breach is different, but the same problems tend to show up more often than others. Here are common ways real-world security data breaches happen and why they’re still so hard to stop.
One of the biggest culprits behind data exposure is cloud misconfiguration. Leaving a storage bucket or API open to the public (whether on AWS, Azure, or another platform) can give anyone access to sensitive data with just a few clicks.
Ransomware attacks traditionally encrypt systems and demand payment to restore access. Increasingly, attackers also steal data and threaten to publish it, sometimes without deploying encryption at all. The 2026 Verizon Data Breach Investigations Report found ransomware in 48% of the breaches in its dataset.
Modern software depends on thousands of third-party tools, packages, and vendors. If even just one is breached, attackers can quickly move through the supply chain, affecting companies downstream. The 2026 Verizon DBIR found third-party involvement in 48% of breaches in its dataset, up 60% from the previous year’s dataset.
Phishing and social engineering attacks impersonate trusted people or services through email, phone calls, messages, and fake login pages. Once attackers obtain valid credentials or persuade a help desk to reset access, they can enter cloud and business systems as if they were legitimate users. Several major 2025 and 2026 incidents—including Allianz Life, Qantas, Charter, and AssuranceAmerica—show why identity verification and phishing-resistant multifactor authentication matter.
Many breaches start with known vulnerabilities that were never fixed. When software goes unpatched or updates are delayed, attackers see an opportunity to exploit those weaknesses and gain access to critical systems. Verizon’s 2026 DBIR found that vulnerability exploitation had become the leading initial access vector, accounting for 31% of breaches in its dataset.
Every breach reveals a weakness. From poor dependency management to insecure deployment pipelines, these incidents expose patterns that teams can analyze and learn from.
Open-source libraries and third-party components are being targeted more than ever. Attackers know that compromising one dependency can have a ripple effect through hundreds of applications downstream. Recent compromises involving cloud platforms, outsourced service providers, and open-source projects also show that vendor risk is not limited to code libraries. Teams need visibility into service accounts, integrations, API keys, and inherited access across their entire software supply chain.
Social engineering, compromised credentials, and misconfigured access continue to contribute to major incidents. The lesson is not simply to “train users better.” Organizations also need technical controls—such as phishing-resistant multifactor authentication, least-privilege access, short-lived credentials, and verified help-desk procedures—that limit what one mistake can expose.
It’s common for organizations moving to hybrid or multi-cloud environments to lose visibility along the way. Teams often focus on securing their applications but overlook the infrastructure-as-code settings and access permissions that quietly control who gets in. They may also retain dormant credentials, excessive privileges, or third-party integrations long after a pilot or contract ends.
Governments and industries are tightening the rules around breach disclosure and data protection. For many, late or incomplete reporting can result in fines and reputational damage. For developers and security teams, tracking these patterns isn’t just about awareness; it’s about action. The more we understand how a breach happened, the better we can design systems to prevent it.
Security data breaches often start long before the attack itself. They’re often the result of weak processes, limited visibility, or unclear accountability within an organization.
When organizations grow quickly or rely on multiple cloud platforms, it becomes harder to track every system, dependency, machine identity, integration, or user account, leaving blind spots for attackers to target.
Many organizations focus on fixing breaches after they happen, but without a proactive approach like continuous code scanning or automated vulnerability management, risks can go undetected until it’s too late.
Even when vulnerabilities are identified, it’s common for updates to lag behind production schedules. The longer a known flaw remains unpatched, the greater the chance it will be exploited.
When development and security teams work in silos, information gets lost. Misaligned priorities can delay fixes, weaken defenses, and increase the risk of exposure.
Manual reviews and testing can’t always keep pace with today’s fast release cycles. Without automation, mistakes (like a missed configuration or outdated dependency) can slip through and lead to security issues.
Preventing security data breaches starts with being proactive. Here are six key practices every organization should adopt to build security into every stage of the software development lifecycle:
Adopting a shift-left approach means bringing security into development from the very start instead of waiting until the end of the release cycle. Use tools like Static Application Security Testing (SAST) to analyze code as it’s written, catching vulnerabilities when they’re easier and less expensive to fix.
Implement Software Composition Analysis (SCA) to identify vulnerable libraries and outdated dependencies. Regularly generating and reviewing Software Bills of Materials (SBOMs) gives visibility into what’s inside your applications and where risks exist.
Audit permissions, encryption settings, and access controls on a regular basis. Enforce least-privilege principles and automate configuration checks to avoid human error. Require phishing-resistant multifactor authentication where possible, remove dormant credentials, rotate secrets, and review third-party access regularly.
Not every vulnerability carries the same risk. Combine severity data with exploit intelligence, asset criticality, exposure, and business context so teams can address the vulnerabilities most likely to be exploited first.
Security isn’t just a tooling issue; it’s a people issue too. Train developers and testers to recognize phishing attempts, sanitize inputs, and follow best practices for credential management. Give service-desk and support teams clear procedures for verifying identity before resetting credentials or multifactor authentication.
Even with defenses in place, breaches can still happen. Create an incident response plan, ensure regulatory reporting readiness for the laws and regulations that apply to your organization, and run post-incident analyses to close security gaps. Test the plan through tabletop exercises and confirm that logs, backups, ownership, and communication processes work before an incident occurs.
Preventing security data breaches requires security to be part of how software is built. Kiuwan helps organizations embed continuous testing and analysis throughout the development lifecycle.
These capabilities address application-code and software-supply-chain risk, but no single tool can prevent every breach. Organizations should combine secure development practices with identity security, cloud configuration management, monitoring, incident response, and employee awareness.
With Kiuwan, developers and security teams can find and fix vulnerabilities earlier, support compliance efforts, and reduce risk in their applications and software supply chains. Start your free Kiuwan trial.
A data security breach occurs when sensitive, protected, or confidential information is accessed, disclosed, or stolen without authorization. This can include personal data, financial records, intellectual property, or credentials. Breaches can result from cyberattacks, human error, or security misconfigurations.
Most data breaches can be traced to one or more of the following root causes:
• Phishing and social engineering that trick users or support teams into granting access
• Exploited software vulnerabilities in unpatched or outdated systems
• Misconfigured cloud services, storage, APIs, or identity permissions
• Weak, stolen, or long-lived credentials and inadequate multifactor authentication
• Third-party, vendor, and software supply-chain compromises
Understanding these causes helps teams build more resilient security practices.
The impact of a breach depends on its scope and type of data involved. Common consequences include:
• Financial loss from fines, remediation, or downtime
• Reputation damage and customer trust erosion
• Regulatory penalties under applicable privacy, security, and sector-specific requirements
• Intellectual property theft or competitive disadvantage
• Operational disruption due to system compromise or ransomware
In some cases, organizations experience long-term brand damage that far exceeds the immediate financial costs.
Prevention requires a combination of secure coding practices, proactive monitoring, strong identity controls, and incident readiness. Teams can reduce risk by:
• Using SAST to find insecure code early
• Implementing SCA to detect vulnerable open-source libraries
• Generating and maintaining SBOMs for dependency visibility
• Regularly applying risk-prioritized patches and updates
• Training employees on cybersecurity awareness and phishing prevention
• Enforcing phishing-resistant multifactor authentication and least-privilege access
• Testing incident-response plans and maintaining reliable backups
Breaches highlight the importance of building security into every stage of the development lifecycle—not just after release. Developers and QA teams play a critical role in identifying vulnerabilities before attackers exploit them. By integrating automated security testing into development and CI/CD workflows, teams can detect issues earlier and reduce the chance of introducing exploitable code or vulnerable components into production.
If a breach occurs, organizations should:
• Activate the incident-response plan and preserve evidence
• Contain the incident by isolating affected systems and revoking compromised access
• Identify and close the vulnerability or access path that caused the breach
• Determine what data and people were affected
• Notify affected individuals, regulators, insurers, and law enforcement when required
• Conduct a forensic investigation and document decisions
• Strengthen controls and test the corrective actions
A prompt, accurate, and transparent response can limit harm and help restore trust. Organizations should involve qualified legal, privacy, and incident-response professionals because notification duties vary by jurisdiction and incident.
The most important 2026 trends include:
• More exploitation of software vulnerabilities as an initial access path
• Continued growth in ransomware and data-only extortion
• Greater third-party and software supply-chain involvement
• Voice phishing and help-desk social engineering aimed at cloud accounts
• Theft of identity documents and other data that cannot be easily changed
• AI-assisted phishing and attack automation that can increase speed and scale
These trends make continuous application security testing, software-component visibility, strong identity controls, and practiced incident response essential parts of breach prevention.
