Biggest Data Breaches of 2026 So Far: Are You Affected, and What to Do

The biggest data breaches of 2026 so far hit an insurer that covers dental care for millions of Americans (15 million people), a health-records company (9.5 million), Denmark's national population register (about 8.8 million), a cruise line (almost 6 million) and the Pentagon's personnel agency (about 3 million). Here's what most coverage misses: very few of this year's big breaches took passwords. They took names, Social Security numbers, health details and driver's license numbers, things you can't change the way you change a password. And the headline numbers are often the hackers' own boasts: the gang behind the Charter Communications breach claimed about 40 million records, but the stolen file held 4.9 million unique email addresses. You can check whether you're affected in five minutes, and the strongest protections, a credit freeze, unique passwords and passkeys, cost nothing. This page lists each major breach with what leaked and the one step that matters for it.

The letter on Jake's counter came from his internet provider: "We are writing to inform you of a security incident that may have involved your personal information." Jake runs a phone repair shop and has seen plenty of hacked phones, but this was his own data. He put the letter under his tea mug and felt vaguely doomed. His friend Ethan, a developer, had a different reaction: "Good. Now you know. The people in real trouble are the ones whose data is in the same file and who never read the letter."

New to this? A data breach means someone got into a company's systems and copied information about its customers or staff. It doesn't mean your accounts were broken into, but the stolen details make scams aimed at you more convincing.

The biggest data breaches of 2026 at a glance

These are the year's largest breaches that affect ordinary people, largest first. "Confirmed" means the company, a regulator or a breach-notification filing gave the number; where only the attackers have given one, the table says so.

Two more are big but still unclear. A whistleblower alleged in March that a copy of the Social Security Administration's database, which holds records on most living Americans, was placed on an unsecured outside server; the agency has said it's unsure what was on it, and lawsuits are under way. And Oracle Health's breach of older Cerner hospital systems, which happened in early 2025, was put at nearly 20 million people this month, based on a state filing; Oracle hasn't given its own number.

Jake: "My provider's letter said 'may have involved'. Does that mean it might not be me?"

Ethan: "It means they're being careful. If you got the letter, assume your details are in the file and act on it. It's fifteen minutes of work."

Why the numbers in headlines are so often wrong

Most of this year's largest breaches were the work of extortion gangs, ShinyHunters above all. Their business is pressure: they post a big number on their leak site to scare the company into paying, and that number often makes the first headlines. The confirmed count arrives weeks later, from the company's legal filings, and is usually smaller, sometimes much smaller.

Neither side is lying about everything. Leak files often repeat the same person across several records, which inflates the attackers' counts, and companies count people they must legally notify, which can leave out contacts they can't identify. For you, the number doesn't change the advice. If you're a customer, assume you're in it, and take the step for the kind of data that leaked.

The 2026 attacks also shared a method. At Carnival, someone tricked an employee into giving access. At Charter, the gang says it phoned an employee in a voice-phishing call, got into that person's work account, and exported customer records from the company's sales system. Nobody "hacked" these the way films show it; they talked their way in.

Health and insurance breaches: the ones to take most seriously

Health data is the hardest kind to protect after a leak, because you can't change your medical history or your Medicare number the way you change a password. 2026 has been a heavy year for it:

• DentaQuest, a dental benefits company, had intruders in its network from May 17 to May 20. It has confirmed at least 15 million people, the largest healthcare breach of 2026 so far, and an independent analysis put the possible total above 23.4 million. Social Security, Medicaid and Medicare numbers were among the data, and the company is offering 24 months of free credit monitoring.
• Aesto Health, which moves and archives patient records for doctors' offices, found an intruder in its Amazon Web Services (AWS) cloud environment on December 18, 2025, after data was taken from December 2 onward. It reported 9,540,683 people affected across at least two dozen provider clients, so the letter may come from your doctor's office rather than from Aesto.
• CareCloud, which hosts electronic patient records for medical practices, confirmed 3.7 million patients in August.
• Oracle Health's older Cerner systems were breached in early 2025; this month's figure of nearly 20 million comes from a state filing, not from Oracle.

The main risks after a health breach are medical identity theft, where someone gets care or prescriptions in your name, and scams that quote your real health details to sound legitimate. The defense is dull but effective: read every explanation of benefits from your insurer, and question any treatment, visit or prescription you don't recognize. If your Social Security number was in the breach too, freeze your credit as well.

Government records and ID documents

The breaches that worry security people most this year involve the records that prove who you are:

• Pentagon personnel records. Intruders used a weakness in a file-sharing system at the Defense Manpower Data Center and had access for about nine months, from October 2025 until it was found on July 16, 2026. The records, which weren't encrypted, cover about 2.8 million living and 294,000 deceased people, with Social Security numbers, dates of birth and service details. Letters went out in late September.
• Denmark's population register. The names, addresses and CPR numbers of about 8.8 million people were taken in September by misusing a private company's legitimate lookup access. The company's access was blocked and police are investigating. People with name and address protection weren't affected.
• IDScan, a company that checks IDs for businesses, confirmed a breach after hackers claimed a searchable collection of about 150 million driver's license photos from the US and Canada, taken over roughly a year.
• Smaller ID leaks added up. A hotel check-in system exposed about 1 million passports and driver's licenses, and a prison phone provider exposed more than 300,000 callers' licenses, among others.

A leaked ID photo or number can't be "changed" quickly, so the protection is about what a thief can do with it. A credit freeze stops new credit in your name, and caution with unexpected calls or messages that quote your details stops the scams that follow.

Jake: "So someone could have a picture of my license right now?"

Ethan: "Maybe. The freeze is why that matters less. A picture can't open a loan if the credit bureaus won't hand out your file."

Schools and students

The Canvas breach is the one parents asked about most. Instructure, the company behind the Canvas learning platform, detected an intrusion on April 29, 2026. It said the exposed information included names, email addresses, student ID numbers and messages between students and teachers, and that it found no evidence that passwords, dates of birth, government ID numbers or financial information were taken. Days later the same group defaced Canvas login pages during exams, some colleges had to cancel tests, and Instructure later said it had reached an agreement with the attackers. It hasn't published a count of people affected.

If your child uses Canvas, the realistic risk is phishing: messages that mention their real school, teacher or class to look genuine. Talk to them about it, and make sure their school account and personal email use different passwords.

School staff were hit too. Frontline Education, which makes software used by school districts, began notifying districts on October 1 that employees' Social Security numbers, email addresses and home addresses were taken through a flaw in a third-party application found on August 14. Affected adults get two years of free credit monitoring.

Companies you buy from

• Charter Communications (Spectrum). Customer and business records were taken in April and the breach was confirmed in May. The leaked file held 4.9 million unique email addresses, with names, addresses and phone numbers; Charter said no sensitive personal information was taken.
• Carnival. An attacker tricked an employee in April; 5,995,277 people were notified, with driver's license and passport numbers for some. Carnival is offering 24 months of credit monitoring.
• Times Car. About 6.6 million car-sharing accounts, including license details and account passwords, after an attacker had access for nearly a month. This is one of the few big 2026 breaches with passwords, so change that password and any other place you reused it.
• Southern Company. About 400,000 Georgia Power and Alabama Power customer-portal accounts, with names, contact details and the last four digits of Social Security or tax ID numbers. Affected customers get a year of free credit monitoring.
• ASOS. Attackers sent a fake notification through the ASOS app, and the retailer confirmed that names and contact details were taken from a third-party messaging platform. It hasn't said how many people, and it doesn't believe card details or passwords were involved.
• Instagram. For several months, people abused Meta's AI chatbot to have password-reset codes sent to email addresses they chose, taking over accounts; reporting put it at tens of thousands of accounts.

Find out in five minutes whether you're affected

You don't have to wait for a letter. This takes about five minutes, and it's worth doing even if you think you're fine:

1. Go to haveibeenpwned.com and enter each email address you use, including old ones. It lists every known breach that included that address. It's free and doesn't need an account.
2. Open your password manager or your browser's saved passwords; Chrome, Edge and Safari all flag passwords that have appeared in leaks.
3. Look through your email for notices from any company in the table above, including your doctor's office or insurer, since health breaches often arrive through them.
4. In the US, get your free credit reports at annualcreditreport.com and look for accounts you didn't open.
5. Write down which breaches you're in and what leaked in each. That decides the steps below.

Jake: "Four breaches. That's a lot."

Ethan: "It's normal. Mine says six. What matters is what leaked in each, not how many there are."

What to do, by what was leaked

Match the step to the data, not to the company. This table is the core of this page:

Three habits protect you against the breaches you'll never hear about:

1. A different password for every site, kept in a password manager, so one leak never opens your other accounts.
2. Passkeys or an authenticator app instead of text-message codes wherever a site offers them; our guide to what MFA is explains the options in plain English.
3. A credit freeze you leave on, lifting it only for the day you apply for a loan or a card.

Paid identity-protection subscriptions are mostly monitoring: they tell you after something happens. A credit freeze prevents it, for free. If a breach letter offers free monitoring, accept it, but don't pay for what a freeze already does.

About the "16 billion passwords" headline

You may have seen that 16 billion passwords leaked. That number didn't come from one hack of Google or Apple. It described huge collections of logins gathered over years by malware on infected home computers, then recycled and repackaged. Our explainer on the 16 billion passwords story covers what it really was. The practical lesson is the same as above: unique passwords and two-step verification make a leaked password useless to anyone else.

That headline dates from June 2025, but collections like it keep resurfacing with new totals, so expect the next one. If one of your passwords turns up in such a collection, malware on a device you used probably captured it, not a hacked company. Change that password, and scan the computer or phone you typed it on.

For small businesses and developers: the pattern behind 2026's breaches

If you run a business or build software, 2026's breaches share a pattern you can defend against, and most of it is about the cloud accounts and credentials behind your systems:

• People, not code, were the way in. Carnival and Charter were breached by attackers who talked an employee into giving access. Require phishing-resistant sign-in, such as passkeys or security keys, for staff accounts, and teach your team that IT never asks for codes by phone.
• Old credentials stayed valid. One marketing-research company, Klue, was breached through a credential issued in 2022 for a limited pilot, and attackers used the cloud keys it held to reach close to 200 of its customers. Delete keys you no longer use, and rotate the rest; if one ever leaks, our first 30 minutes after a leaked AWS access key guide is the checklist.
• Developer tools were poisoned. Backdoored versions of popular security and developer tools stole passwords, tokens and cloud keys from the developers who installed them, and reached companies including OpenAI and Vercel. Keep secrets out of code and environment files with a tool like AWS Secrets Manager.
• Intruders sat unnoticed. At the Pentagon agency the intruders had nine months; at Aesto Health they spent more than two weeks inside its cloud environment. Turn on activity logging, such as AWS CloudTrail, and an alarm for unusual activity, such as Amazon GuardDuty, so the next intruder is found in hours, not months.
• Databases were left open. Researchers found about 16,000 databases left readable on the web by apps built on the Supabase platform, many of them quickly built apps. That's a setup mistake, not a break-in, and the fix is to restrict access on every table before anyone else can reach the app.

Jake: "Does any of that apply to a repair shop?"

Ethan: "Two bits do. Use a password manager and passkeys for the shop's accounts, and never read a sign-in code to someone who phones you. That covers the way most of these started."

Data breaches of 2026: frequently asked questions

Jake did the five-minute check: four breaches, one with his Social Security number. He froze his credit at all three bureaus that evening, switched his email to an authenticator app, and moved the shop's passwords into a password manager. The letter went from under the tea mug to the recycling bin. "So the letter wasn't the bad news," he said. "Not reading it would have been." Ethan said that was exactly it.

Revision note. Rewritten October 14, 2026, with every breach of the year so far in one table and the confirmed numbers in place of attackers' claims. "Forewarned is forearmed," says the old proverb; a breach letter is the warning, and the freeze is the arm.