The Biggest Data Breaches of 2026 (So Far)

Halfway through 2026, the year has already produced some of the largest data breaches ever recorded — hundreds of millions of accounts exposed across schools, retailers, airlines, hospitals, and government contractors. The numbers below are as reported by mid-2026; some come from company confirmations and others from the attackers' own claims, so figures can shift as investigations close. But the pattern is unmistakable, and the lesson at the end is the same one it always is.

New to the topic? Start with our plain-language explainer: What is a data breach?

2026 is shaping up to be a record year

Two things define the 2026 breach landscape. First, extortion crews — groups like ShinyHunters and Scattered Lapsus$ Hunters — have industrialized the playbook: steal a giant dataset, threaten to publish it, demand payment. Second, almost every mega-breach traces back to data sitting on a cloud platform or a third-party vendor, not on the victims' own devices. When that one server falls, millions of people are exposed at once.

Instructure (Canvas) — the largest education breach on record

The biggest single incident of 2026 hit Instructure, maker of the Canvas learning platform used by schools and universities worldwide. The extortion group ShinyHunters claimed roughly 275 million records — about 3.65 terabytes of data spanning nearly 9,000 institutions. What makes it especially serious is the type of data: not just names and emails, but private messages between students and staff. It is now considered the largest breach the education sector has ever seen.

Conduent — tens of millions of Americans

Conduent, a business-services and government contractor, disclosed in early 2026 that a breach affected at least 25 million Americans. The intrusion actually began in late 2024 and ran into early 2025 — but its full scale only became clear more than a year later. Texas officials described it as among the largest breaches in US history. It is a textbook example of third-party risk: most of those 25 million people had never heard of Conduent, yet their data was in its systems.

Retail, travel, and healthcare were all hit hard

2026's biggest breaches stretched across every sector:

• Coupang — South Korea's largest online retailer reported a breach affecting almost 34 million customers; its CEO resigned in the aftermath.
• Qantas — the airline confirmed more than 5 million customers had names, emails, and frequent-flyer numbers leaked by Scattered Lapsus$ Hunters after a ransom deadline passed.
• Under Armour — a dataset tied to as many as 72 million accounts surfaced on a hacker forum and was measured by the breach-notification service Have I Been Pwned.
• NYC Health + Hospitals — about 1.8 million people had medical and financial data taken, including biometric fingerprints and palm prints.

A single extortion crew, ShinyHunters, was also linked to a wave of corporate thefts in 2026, claiming millions of records from Medtronic, ADT, and Carnival, among others.

The common thread: your data lives on someone else's server

Look past the brand names and every one of these breaches has the same root cause. Your information was sitting in a centralized database — a cloud service, a vendor, a contractor — and you had no control over how it was secured. You did nothing wrong, and there was nothing you personally could have done to prevent it. That is the uncomfortable reality of a world where almost every app and service uploads your data by default.

The more places your personal information is stored, the more breaches you are automatically exposed to. Reducing that footprint is one of the few things genuinely within your control.

What you can actually do

• Check your exposure. Search your email on a reputable breach-notification service to see which leaks already include you.
• Use a password manager and a unique password for every account, so one breach can't unlock the others.
• Turn on two-factor authentication everywhere it is offered.
• Freeze your credit if financial or identity data was exposed.
• Upload less. Prefer tools that keep your data on your device instead of sending it to a server you don't control.

That last point is the structural fix. Data that never leaves your phone cannot be in next year's breach list.

Data breaches in 2026 are bigger and more frequent than ever, and the trend is not slowing down. You can't control how a contractor secures its servers — but you can control how much of your life depends on those servers in the first place. The smaller your digital footprint, the shorter your name appears on lists like this one.