2026's Worst Breaches So Far: Ransom Cartels and Record Patch Loads

A Year Defined by Extortion at Scale

Nine months into 2026, the dominant pattern in cybersecurity isn't a single mega-breach — it's a business model. Ransomware crews have shifted almost entirely toward theft-and-leak extortion, and their targeting has grown more strategic: hit one vendor, a school district's login page, a state DMV's identity pipeline, and the blast radius lands on tens or hundreds of millions of people downstream. The result is a year of hacked systems, leaked archives, and ransom notes that reads less like a crime blotter and more like a failing grade for the entire ecosystem's assumptions about trust12.

The scale is measurable. The Identity Theft Resource Center counted the Instructure Canvas breach alone as generating roughly 275 million victim notices — about 58% of all U.S. breach notifications in the first half of 2026, making it the largest single event of the year so far1420. And the year's patch pipeline has been equally relentless: Microsoft's September Patch Tuesday shipped a record-shattering update, with tallies ranging from 966 to 996 vulnerabilities depending on how CVEs are counted across the release, including two Windows zero-days already being exploited in the wild1458.

The Breaches That Defined 2026

Canvas and the ShinyHunters campaign. The extortion group ShinyHunters sits at the center of the year's most consequential incident. Attackers exploited a support-ticket vulnerability in Instructure's Canvas learning management system — detected April 29, disclosed in May — and used malicious connected applications plus bulk extraction through Canvas APIs to claim roughly 3.65 terabytes of data covering some 275 million students, teachers, and staff1220. Two weeks later the group came back through a second flaw and defaced Canvas login pages at universities including Harvard, Columbia, Princeton, and Georgetown with ransom demands, during final exams20. Instructure said in May it had reached an agreement with the "unauthorized actor" and that the stolen data had been destroyed; reports of a roughly $10 million ransom payment remain unverified, and state attorneys general and class actions are pending14. The same crew has been linked to breaches at Charter (~40 million records), Carnival (at least 6 million customer records, with Carnival confirming 5,995,277 people affected), Match Group, Madison Square Garden Entertainment — where roughly 45GB published after a missed June 15 deadline included data from MSG's facial-recognition surveillance apparatus — 7-Eleven, and ADT12131520.

IDScan and the identity-document pile. A breach at IDScan, an identity document verification company, threatens to touch almost every driver in North America: attackers advertised a dark-web search engine listing photos of some 150 million U.S. and Canadian drivers, with data siphoned over the course of about a year and held hostage for ransom1112.

Healthcare keeps bleeding. DentaQuest's breach — the largest confirmed healthcare incident of the year — stole health data on roughly 15 million people, while CareCloud, a host for electronic patient records, lost sensitive medical information for at least 3.7 million1116. The University of Mississippi Medical Center took a different kind of hit in February: ransomware shut down all 35 clinics, forcing staff back to paper charts and delaying surgeries17.

The supply chain as a weapon. Some of 2026's most alarming intrusions targeted the security industry itself. Compromises hit open-source and commercial tooling — including Aqua Security's Trivy, Bitwarden, and Checkmarx — planting backdoors that stole passwords, credentials, and tokens from anyone who installed or auto-updated the poisoned software, with downstream victims reportedly including OpenAI and Vercel1112. Market-research firm Klue illustrates the same amplification effect in miniature: a single old credential exposed the keys to its customers' cloud environments, letting hackers steal data from close to 200 downstream companies, including cybersecurity giants Jamf, HackerOne, and LastPass — all less than a year after Klue laid off half its staff to chase AI12.

Government targets. Both the FBI and the ATF confirmed "major cyber incidents" tied to surveillance systems, with a ransomware gang taking credit for breaching an ATF system containing "targets of ATF investigations"1112. Nevada fared somewhat better: ransomware traced to a May malware download from a spoofed website forced 60-plus agencies offline in August, but the state refused to pay, restored services within 28 days, recovered about 90% of affected data, and spent roughly $1.5 million doing so15.

The Patch-and-Exploit Spiral

The breach headlines and the patching calendar are two views of the same problem. September's Microsoft release was a record: 972 to 996 vulnerabilities depending on the count, with 113–119 rated Critical and dozens of remote code execution flaws across Office, Exchange, SharePoint, Windows DHCP Server, and Hyper-V158. Two Windows zero-days were already under attack: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack (the first Update Stack weakness ever flagged as a zero-day), and CVE-2026-85880, a heap buffer overflow in Windows ALPC — the first ALPC zero-day patched in nearly four years168.

That followed a year of relentless zero-day traffic. July's Patch Tuesday fixed a record 570–622 flaws, including two actively exploited zero-days in Active Directory Federation Services and SharePoint Server, plus a publicly disclosed BitLocker bypass31. August added 415–421 CVEs with another exploited zero-day, a use-after-free in the afd.sys kernel driver — the fourth afd.sys zero-day since 2022, with one predecessor reportedly used by North Korea's Lazarus group27. And within hours of September's release, a researcher published a proof-of-concept exploit dubbed ShieldCrash claiming Microsoft's earlier Defender patch was incomplete, while Adobe raced to fix a max-severity StyleSmuggler zero-day in Commerce, Google patched an exploited Chrome V8 flaw, and Citrix confirmed a NetScaler zero-day under active attack147.

Coverage of the September numbers diverges on volume — CrowdStrike counted 972, SecurityWeek 974, BleepingComputer 966, eSecurityPlanet "nearly 1,000" — but every outlet agrees on what matters: both zero-days are elevation-of-privilege bugs that assume attackers already have a foothold, which means they function as force multipliers for the phishing and credential-theft campaigns driving the year's breaches1468.

Where Reporting Diverges — and What to Believe

The sources also disagree in instructive ways on breach attribution and scale. On Canvas, figures range from "over 30 million" people to 275 million victim notices; the lower number reflects directly affected accounts, while the higher reflects ITRC's notice count across thousands of school districts — the 275 million figure is itself flagged as unverified1214][20. Under Armour's numbers similarly shifted from a November 2025 Everest ransomware claim to 72.7 million records surfacing in Have I Been Pwned in January, when the extortion apparently failed1417[20. ADT's 5.5 million figure came from HIBP rather than the company itself, and Foxconn has not confirmed Nitrogen's 8TB claim1516. The consistent lesson: ransomware gangs inflate, victims minimize, and independent analysts land somewhere in between — which is precisely why PowerSchool's earlier paid-for-deletion agreement resurfacing as renewed district-by-district extortion is the year's most important cautionary tale about paying ransoms20.

The Reading That Matters

Commit to this interpretation: 2026 is the year the trust hierarchy inverted. Attackers stopped needing to breach 200 companies when one vendor's stale credential — Klue's — would hand them the keys to all of them12. They stopped needing a novel exploit when a support-ticket flaw plus API access would extract 275 million education records, and when the software-updating mechanism itself — Windows Update Stack, auto-updating developer tools — became the attack surface126. Meanwhile the patch queue doubled: September's release was more than twice August's volume, with defenders openly noting that most IT teams cannot test and deploy everything immediately17.

The practical response writes itself from the coverage: patch the exploited zero-days before anything else, treat vendor access as privileged access, stop assuming ransom payments buy deletion, and assume that any system holding identity documents — a DMV, an ID checker, a school's LMS — is a strategic target. The alternative is ending up in next year's version of this list, leaked, listed, and holding a ransom note121520.