Headlines focus on the biggest names. The useful part is what the incidents have in common.

Details of many incidents are based on company statements, attacker claims, and press reports, and can change as investigations continue.

Incidents widely reported in 2026

Security-industry reviews of the year so far point to incidents involving organizations such as Canvas (the education platform), Canadian telecom provider Telus, Charter Communications, Nike, Stryker, and Match Group. Several of the largest claims came from an extortion group known as ShinyHunters, which claimed to have stolen large volumes of data from a range of victims. In Telus’s case, the claim was made in March 2026, and public claims by attackers aren’t always confirmed.

Recurring themes

1. Third parties are the entry point. Many breaches began at a supplier, service provider, or software package rather than the victim’s own network.

2. Stolen credentials and tokens. Infostealer malware, phishing, and compromised accounts keep opening doors, and single sign-on or OAuth tokens can be abused when stolen.

3. Data theft and extortion, not just encryption. Attackers increasingly steal data and threaten to publish it, even when they don’t lock systems.

4. Software supply chain attacks. Compromised open-source packages and developer tools exposed many organizations at once.

5. Education, healthcare, and critical services are heavily targeted because downtime is costly.

Lessons for your business

1. Know your suppliers. List which vendors hold your data or have access to your systems, and ask how they secure it.

2. Protect identity. Enforce MFA, use Conditional Access, and watch for unusual sign-ins.

3. Limit what third-party apps can access. Review OAuth permissions and remove unused integrations.

4. Prepare for data-theft extortion. Know what data you hold, encrypt it, and rehearse your response.

5. Back up, and keep backups out of reach.

6. Detect faster. Monitoring and managed detection shorten the time attackers stay inside.

7. Have an incident plan that includes legal duties, such as Quebec’s Law 25 reporting obligations.

The takeaway

Attackers pick the easiest path. Fix the basics first.

Sources:
https://www.staysafeonline.org/articles/canvas-data-breach
https://www.ctvnews.ca/vancouver/article/telus-accounts-accessed-in-data-security-incident-company-says/
https://haveibeenpwned.com/Breach/Charter
https://www.reuters.com/sustainability/boards-policy-regulation/nike-says-it-is-investigating-possible-data-breach-2026-01-26/
https://www.reuters.com/technology/stryker-says-cyberattack-its-network-contained-2026-03-17/
https://www.reuters.com/business/bumble-match-panera-bread-crunchbase-hit-by-cyberattacks-bloomberg-news-reports-2026-01-29/

DBR Soft can review your exposure to these common attack paths. Contact us for more information.