The Most Impactful Cybersecurity Breaches of 2026

The hacking collective ShinyHunters dominated headlines this year, notably compromising the edtech giant Instructure. The breach exposed the personal data of 275 million users, including students and staff across 9,000 schools. Despite claims of remediation, the group struck the platform a second time, forcing institutions to disrupt academic schedules. ShinyHunters also targeted Rockstar Games, though the developer characterized the incident as a third-party compromise of corporate assets rather than sensitive user information.

Data management firm Conduent faced a massive exposure affecting 25 million people in Texas and Oregon, leaking Social Security numbers and medical records. Meanwhile, AI integration proved to be a double-edged sword; hackers exploited Meta’s Instagram support chatbot to hijack high-profile accounts by manipulating the automated password reset process. On the mobile front, the DarkSword spyware highlighted the fragility of iOS 18, allowing attackers to siphon personal data—from iMessages to location history—simply by luring targets to infected websites. Finally, the rise of low-cost tools like WeedHack, available for just $5 per month, has democratized cyber-harassment, enabling teenagers to deploy sophisticated surveillance and data-theft malware against peers under the guise of gaming software.