Major Data Breaches Hit U.S. Agencies and Companies in 2026

A series of cyberattacks in 2026 exposed personal records and disrupted operations at U.S. government agencies and private companies. The incidents involved alleged unauthorized access to Social Security data, attacks on energy and water infrastructure, and breaches at medical, education, and technology firms.

TechCrunch reported that after the Department of Government Efficiency accessed Social Security Administration systems, questions remain about the handling of personal records. Court filings indicate an agreement was signed with an outside group to examine voter fraud claims.

Cyberattacks attributed in part to Russian actors targeted energy grids and water treatment facilities in Poland, Sweden, and Norway. Iranian government hackers were linked to a March breach at medical device maker Stryker that wiped employee devices and affected first-quarter earnings.

Education technology company Instructure confirmed a breach of its Canvas platform that exposed data for over 30 million students and staff. The same group later defaced login screens during final exams, and the company paid a ransom after initially resisting.

Open source security tools from Aqua Security, Bitwarden, and Checkmarx were compromised, leading to credential theft at downstream customers including OpenAI and Vercel. The FBI declared a major cyber incident in April after one of its surveillance systems was breached, exposing phone numbers of surveillance targets. Hasbro experienced weeks of operational downtime following a separate breach.