8 Major Data Breaches of 2026: Millions Affected, Sensitive Data Exposed

Millions of people have been affected by major data breaches reported in 2026, including incidents involving education platforms, healthcare providers, insurance companies, and travel businesses.

The incidents reveal how attackers can exploit compromised accounts, third-party access, and weaknesses in systems holding sensitive information. In its 2026 midyear report, the Privacy Rights Clearinghouse (PRC) identified 1,969 distinct breach events from 5,429 state and federal notification filings during the first six months of the year.

Those filings represented approximately 343.1 million reported exposures, but that total includes an unverified claim that 275 million Canvas users were affected. Excluding that claim reduces the total to roughly 68 million. PRC also cautioned that these figures represent exposures of personal information, not necessarily unique individuals.

The following eight incidents illustrate what information was compromised, how many people were reportedly affected, and what businesses and consumers can learn from the disclosures.

8 major data breaches reported in 2026

These incidents were selected for their reported scale, the sensitivity of information involved, and their potential consequences. They are not a ranking of the eight largest confirmed breaches.

Figures reflect published regulatory filings and breach reports. Some filings report different totals for the same incident, and the counts should not be added together to determine the number of unique affected individuals. Some incidents began before 2026 but were disclosed during the year.

1. Instructure (Canvas): 275 million claimed, but the true total remains unverified

Education technology company Instructure, which operates the Canvas learning management system, experienced unauthorized activity involving Canvas in April and May 2026.

The Privacy Rights Clearinghouse identified a Wisconsin breach listing that recorded 275 million affected users. However, the organization determined that the figure originated from an attacker claim and had not been independently verified.

Its analysis identified approximately 18,400 affected individuals in the publicly available filings it examined, although that number does not establish the incident's full scope.

What was exposed: According to PRC's account of the incident, compromised information included usernames, email addresses, course names, enrollment information, and messages. Instructure said passwords, dates of birth, government identifiers, and financial information were not involved.

In May, Instructure acknowledged reaching an agreement with the unauthorized actor, saying it had received assurances that the information was returned and destroyed.

In a Sept. 29 update, the company said its forensic review of the affected data was complete and that it was preparing to deliver information to remaining impacted institutions. The update did not establish a verified total of 275 million affected people. As eSecurity Planet examined, the ShinyHunters extortion group targeted universities in connection with the Canvas incident.

Why it matters: Educational platforms can store information about students, educators, and institutions. Schools should review vendor access, account protections, and incident-response procedures for widely used third-party systems.

2. DentaQuest: Conflicting filings report 15 million and 27.4 million affected

DentaQuest, a dental and vision benefits administrator owned by Sun Life, disclosed a cybersecurity incident involving personal and health information.

According to 2026 regulatory filings, unauthorized individuals accessed its network between May 17 and May 20. DentaQuest discovered the activity on May 20.

The reported affected population differs substantially across filings. The U.S. Department of Health and Human Services recorded 15 million individuals on July 16, while an Indiana filing dated July 17 listed 27.4 million. A Texas filing also reported 15 million.

The available records do not explain the discrepancy, so neither figure should be treated as a reconciled nationwide total. The incident ranks among the largest healthcare-related breaches reported in 2026.

What was exposed: Breach-notification records identified names, addresses, Social Security numbers, member identification numbers, Medicaid and Medicare numbers, and dental or vision health information. The latter included provider names, diagnoses, treatment information, and billing details.

The specific information involved varied by individual.

Why it matters: Healthcare and insurance information can pose long-term privacy and identity theft risks. Affected individuals should review their notifications and take appropriate precautions based on the specific information involved.

3. Aesto Health: More than 9.5 million people affected

Aesto Health, a healthcare data migration and archiving provider, reported a breach affecting approximately 9.54 million individuals.

According to Aesto's incident notice, unauthorized access occurred between approximately Dec. 2 and Dec. 18, 2025. The company subsequently investigated the information involved and confirmed potential exposure of patient records in May 2026.

Aesto began notifying affected healthcare-provider clients on June 26, 2026. Those organizations were responsible for determining and carrying out applicable patient notifications.

As eSecurity Planet reported, the incident affected information belonging to patients of healthcare organizations that used Aesto's services.

What was exposed: Potentially affected information included names, dates of birth, medical records, health insurance information, driver's license numbers, financial account information, and other government identifiers. Social Security numbers were potentially involved for a limited number of individuals.

The specific information varied by person.

Why it matters: Healthcare organizations frequently rely on vendors to manage sensitive records. The breach demonstrates why vendor access controls, data retention policies, and clearly defined notification responsibilities are essential.

4. AssuranceAmerica: Nearly 7 million drivers affected

Insurance provider AssuranceAmerica reported a breach affecting 6,998,886 individuals, according to the Privacy Rights Clearinghouse's midyear analysis.

The company discovered suspicious activity involving its systems in March 2026 and subsequently investigated unauthorized access to files containing customer information.

As detailed in eSecurity Planet's coverage of the AssuranceAmerica breach, nearly 7 million drivers were affected.

What was exposed: Breach-notification reporting identified names, contact information, driver's license numbers, insurance policy and account information, vehicle details, and claims-related records. The information involved varied by individual.

Why it matters: Driver's license and insurance information can be used to commit identity fraud and impersonation. Affected individuals should review official notifications to determine whether additional identity monitoring or other protective measures are warranted.

For insurance providers, the incident reinforces the importance of restricting access to customer records and detecting suspicious activity involving sensitive databases.

5. Carnival Corporation: Approximately 6 million customers affected

Carnival Corporation disclosed a cybersecurity incident involving the personal information of approximately 6 million people.

According to Carnival's breach notice, the company identified unauthorized activity involving an employee account on April 14, 2026.

The attacker used social engineering to deceive an employee and gain access to company systems. Carnival determined on April 22 that personal information had been copied.

The Texas attorney general's office subsequently announced an investigation, reporting that the breach affected an estimated 6 million people, including more than 800,000 Texans. As eSecurity Planet previously noted, the incident affected customers across the company's travel business.

What was exposed: Carnival identified names, addresses, email addresses, telephone numbers, dates of birth, and government-issued identification numbers, including driver's license and passport numbers.

The company emphasized that the information involved varied by individual. Its May notice also stated that its analysis of affected records was continuing.

Why it matters: Travel-related personal information may help criminals create convincing phishing messages or impersonation attempts. Customers should be cautious of unexpected communications concerning reservations, identity verification, or breach compensation.

6. AdaptHealth: More than 4.1 million people affected

Healthcare services provider AdaptHealth reported a breach affecting 4,115,802 individuals, according to the U.S. Department of Health and Human Services' breach database.

In its August 14 notification, the company said unauthorized access occurred on June 5, 2026. AdaptHealth discovered the incident on June 15.

An earlier SEC filing described a social engineering attack that compromised a third-party contractor's user session.

What was exposed: Potentially affected information included names, contact information, demographic details, health insurance information, and medical records.

AdaptHealth said Social Security numbers, bank account information, and payment card information were not included in the affected systems.

Why it matters: Compromised third-party access can pose risks to healthcare organizations even when their employees' accounts remain secure.

Security teams should review contractor privileges, authentication controls, and monitoring of systems that store sensitive patient information.

7. Medtronic: More than 3.8 million people affected

Medical technology company Medtronic experienced unauthorized access to certain corporate IT systems in April 2026.

The Privacy Rights Clearinghouse's 2026 midyear report lists 3,834,294 affected individuals for the incident. PRC's count reflects the largest reported figure among the filings it examined, rather than a nationwide total independently announced by Medtronic.

In its June 29 statement, the company confirmed that it had begun contacting individuals whose information may have been affected.

What was exposed: State-level notifications identified personal information, including names, addresses, dates of birth, Social Security numbers, and medical information. The specific categories varied by individual.

Medtronic said it had no evidence that affected information had been publicly posted online.

The company also stated that it had identified no impact on medical device security, patient safety, manufacturing, distribution, or the ability of its products to deliver their intended therapy.

Why it matters: A breach involving a medical technology company can raise concerns about device safety. However, unauthorized access to corporate information systems does not automatically mean medical devices were compromised.

Security teams and healthcare organizations should distinguish confirmed exposure of personal information from unverified operational or product security risks.

8. TriZetto Provider Solutions: More than 3.4 million reported affected

TriZetto Provider Solutions, a healthcare technology company owned by Cognizant, disclosed a breach involving insurance eligibility verification records.

The Privacy Rights Clearinghouse's 2026 midyear report lists 3,433,965 affected individuals for the incident, based on regulatory reporting from the first half of 2026.

That figure also appears in February 2026 reporting to the U.S. Department of Health and Human Services. It represents the population reported in those records, not necessarily a definitive count of every individual potentially affected.

According to TechTarget's examination of major healthcare breaches, TriZetto discovered suspicious activity in October 2025. Investigators identified unauthorized access to insurance eligibility transaction records dating back to November 2024.

The breach subsequently prompted litigation. eSecurity Planet examined the class-action lawsuits against Cognizant stemming from the incident.

What was exposed: Potentially affected information included names, addresses, Social Security numbers, dates of birth, health insurer names, insurance member information, and other demographic and health insurance details.

The specific information involved varied by individual.

Why it matters: Insurance eligibility records can combine sensitive personal identifiers with healthcare-related information, creating risks of identity theft and fraudulent activity.

The incident also demonstrates the importance of detecting unauthorized access quickly, particularly when sensitive records may remain accessible for an extended period.

What these major data breaches mean for businesses and consumers

Although the incidents span different industries, they illustrate recurring cybersecurity risks, including compromised accounts, social engineering, third-party access, and large collections of sensitive information.

For businesses, the consequences of a breach can extend beyond immediate response costs to regulatory investigations, litigation, customer distrust, and operational disruption.

For consumers, the risks depend on the information compromised. Exposed contact details can increase the risk of phishing, while compromised Social Security numbers or healthcare information may require more extensive protective measures.

What security teams should do

Organizations should use these incidents to reassess how they protect sensitive information, particularly when it is handled by external vendors.

• Strengthen identity controls. Enforce appropriate multifactor authentication, restrict privileged access, and monitor suspicious sessions involving employees and contractors.
• Review vendor security. Identify external organizations with access to sensitive records and verify their safeguards, incident response capabilities, and notification obligations.
• Limit unnecessary data exposure. Minimize retention, restrict access to sensitive systems, and apply appropriate protections to stored information.
• Test incident-response procedures. Ensure teams can identify compromised records, contain unauthorized access, and promptly notify affected individuals.

What affected individuals should do

Anyone who receives a breach notification should verify it through the company's official channels and review the specific information identified as compromised.

If credentials were exposed, changing passwords and enabling multifactor authentication are appropriate first steps. Individuals whose Social Security numbers or other sensitive identifiers were compromised may also consider a credit freeze or additional identity monitoring.

Unexpected emails, calls, or text messages referencing a breach should be treated cautiously. Criminals can exploit public reporting about security incidents to create convincing phishing attempts.

Ultimately, the scale of a breach tells only part of the story. The sensitivity of the information exposed, the duration of unauthorized access, and the speed of an organization's response all influence the potential consequences.

For businesses and security teams, the lasting lesson from these incidents is that preventing unauthorized access remains essential, but limiting the information an attacker can access after gaining entry is equally important.

More cybersecurity tips: For practical steps organizations can take to reduce their exposure, read eSecurity Planet’s guide to preventing data breaches, which covers data protection, incident response planning, and security training.