Hacked, Leaked, and Held for Ransom

Cybersecurity has become a front-and-center concern in 2026, with hacks and breaches targeting sensitive data, critical infrastructure, and even the nation's most secure systems.

A Year of Digital Attacks and Hybrid Warfare

If anything, 2026 has made clear that cybersecurity is no longer a background concern — it's front and center, woven into almost every major story of the year. Yes, wars are still raging, the climate keeps worsening, and we're seemingly one dodgy sneeze away from the next global pandemic.

But running beneath all of it is a digital current that touches everything: wars being fought on digital fronts as well as physical ones, governments weaponizing citizens' own data against them, botnets quietly undermining democratic institutions, nation-state hackers targeting civilian infrastructure from power grids to water systems, and ransomware gangs holding companies and institutions hostage for massive payouts. The attacks are getting bolder, more destructive, and harder to contain.

DOGE's Social Security Database Exposure

A year on, after operatives with the Elon Musk-led band of government destroyers known as the Department of Government Efficiency (or DOGE) swept through and dismantled federal agencies from the inside out, we're still learning about the data lapses that happened under their watch.

After DOGE entered the Social Security Administration, it remains unclear as to what happened with some of the nation's most sensitive data, as lawsuits battle on in federal court. The most alarming whistleblower's claim is that DOGE uploaded a live copy of the Social Security database to an unsecured third-party server, leading to a scramble to understand what was stored in it. This database allegedly contained the Social Security numbers and associated personal information of most living Americans.

Europe's Energy and Water Supply Hacks

A rash of cyberattacks across Europe targeting civilian energy and water supplies, like power plants and water dams, has set a troubling trend of late. Several hacks attributed to (or at least in part blamed on) Russia have risked real-world harm to communities and populations.

Poland's energy grid was targeted with computer-destroying malware at the tail end of last year, as well as a Swedish thermal plant and a Norwegian dam that spilled swimming pools' worth of water. Hackers targeted Poland again earlier this year, this time its water treatment plants, showing that Russia's hybrid war antagonism continues to extend beyond the digital realm.

Iranian Hackers Target U.S. Infrastructure

Now, thanks to the recent war between the U.S. and Israel against Iran, there are warnings that Iranian hackers are targeting critical infrastructure in the United States. This includes privately owned water utilities, which remain a soft target for hackers, often lacking basic cybersecurity protections.

Stryker Medical Tech Company Breach

Speaking of Iran, a cyberattack on a U.S. medical tech company, Stryker, in March saw Iranian hackers break in and remotely wipe tens of thousands of employee devices in one fell swoop, causing widespread disruption to the company's operations for several days.

The breach was a marked shift in Iranian hacking tactics at a time of ongoing war in the Middle East, with Iran moving from its typical focus of espionage and hack-and-leak operations in aid of the country's political gains, toward actively causing destructive hacks in apparent retaliation for the war. The U.S. government attributed the hacking group behind the breach to an arm of Iranian intelligence. The breach ended up having a material impact on Stryker's first-quarter earnings after regaining control of its systems.

Klue Data Breach

Market research provider Klue was at the center of a mass data breach that affected close to 200 companies, of which several were cybersecurity giants such as Jamf, HackerOne and LastPass. It was one of the broadest data breaches of the year, affecting a multitude of Klue's customers, less than a year after the company laid off half of its staff in favor of doubling down on AI.

Klue admitted that the extortion gang, dubbed Icarus, broke into its systems using a credential that it issued in 2022 for a limited pilot, implying that the company had around four years to decommission the credential before it was stolen and used to break into its systems. In the data breach, Klue exposed the keys to its customers' cloud services, allowing the hackers to break in and steal those stores of data to extort those companies for a ransom.

ShinyHunters Continue to Hack and Deface

The ShinyHunters continued their hacking campaigns, targeting dozens of companies with simple but highly effective voice phishing techniques. The English-speaking hackers are adept at tricking companies into turning over access to their internal systems by pretending to be IT support, or conversely, an employee who forgot their password.

Few companies know better the toll a hack from the ShinyHunters can have than education tech giant Instructure. The hackers breached the company's flagship learning management system Canvas to steal private data and personal information belonging to over 30 million students and staff. When the company didn't pay the hackers' ransom, the hackers broke in — again — and defaced the school's login screens for Canvas, used by students to access their exam and coursework material. This second hack happened during school finals, disrupting exams for students across the United States. Instructure eventually paid the ransom, despite efforts by the FBI to dissuade the company from paying.

Open Source Developer Hacks

A series of ongoing, concurrent, and occasionally overlapping attacks on open source developers have resulted in massive hacks targeting big tech companies and their customers.

Some of the biggest names in security, including Aqua Security's Trivy tool, Bitwarden, and Checkmarx, alongside other major open source projects, were compromised this year, allowing the hackers to steal passwords, credentials, and other sensitive tokens from the computers of anyone who installed a backdoored copy of the software, or their pre-installed software auto-updated to download the malware.

FBI-Declared Major Cyber Incident

The U.S. Federal Bureau of Investigation was forced to declare a "major cyber incident" in April, prompting a legally required disclosure with Congress, after identifying that one of its surveillance systems was compromised. According to reports, the breach potentially exposed phone numbers of targets under surveillance by federal agents.

Chinese spies were accused of the breach of the unclassified network, which held sensitive information about the surveillance targets of wiretaps and other communication intercepts, such as pen register returns. By notifying lawmakers, the breach is likely to have met a bar of causing "demonstrable harm" to U.S. national security.

Instagram Account Hijackings

When is a hack not quite a hack? When you simply ask for access and get it. That was what happened with thousands of Instagram accounts that were hijacked in early 2026 as people abused Meta's AI chatbot to reset account passwords.

The account hijackings, first reported by 404 Media, happened over the course of several months and were only noticed after news of the exploit began to leak online. Here's how the attack worked: People would open a chat with Meta's AI chatbot and pretend that they had been locked out of an account. By requesting the chatbot to send a password reset code to an email address of the attacker's choosing, the attacker gained access to their victim's account.

Hasbro's Security Incident

Toymaker giant Hasbro is the latest example of what happens when a large corporation is hit by a security incident and isn't prepared for it. Weeks after discovering hackers in its systems in late March, the 103-year-old company remained largely offline, its website unavailable, and unable to serve its customers.

The company, which owns big name brands such as Transformers, Peppa Pig, and Dungeons & Dragons, has said little about the incident itself, what data was taken (if any), and whether it paid the hackers. But the disruption alone is likely to affect the company's financials, which it was forced to delay, as the company scrambled to handle the incident.

Identity Document Exposures

Over the past few months alone, there has been an uptick in major data exposures involving people's sensitive government-issued identity documents, including passport and driver license scans left exposed to the web. From a hotel check-in system and a money transfer app to a prison payphone provider and a U.K. visa service, these services exposed over two million people's personal documents that can be easily misused. Many were caused by simple security lapses that were easily avoidable with basic cybersecurity practices.