By Ehtijad Ali
Updated: October 2026
Reading time: about 13 minutes
Data breaches have become a normal part of the online world. But some breaches are much bigger than others.
In 2026, several companies and organizations reported breaches affecting millions of people. Some involved healthcare records. Others involved schools, insurance data, customer information, or large technology platforms.
The biggest data breaches 2026 list also shows something important: many of the largest incidents were not caused by one simple problem. Attackers often found a weak account, a vulnerable system, a third-party service, or a way into a company that held data for many other organizations.
This guide looks at the largest reported breaches of 2026, what information was exposed, and what these incidents have in common. The goal is not to scare you. It is to help you understand where your personal information can be at risk.
Key takeaways:
- The biggest number in 2026 (275 million, linked to Canvas) is a claim made by the attackers. It has not been proven.
- Six of the ten breaches on this list involved health or medical information.
- Many attacks started with a tricked employee, a stolen login, or a weak outside company.
- If a company tells you that you were affected, read the notice, change reused passwords, and turn on two-factor authentication.
What is in this guide?
What is a data breach? (In simple words)
A data breach happens when someone gets into information they are not allowed to see. Think of it like a stranger getting the key to a locked filing cabinet full of names, addresses, and health records.
The company is the one that gets broken into. But the information inside belongs to real people, like you and your family.
Here are a few words you will see in this guide:
- Attacker or hacker: the person or group trying to break in.
- Vendor: an outside company that does a job for another company, like billing or storing files.
- Social engineering: tricking a person into giving away a password or access, often with a fake call, text, or email.
- Ransomware: harmful software that locks a company’s computers until the company pays money.
- Two-factor authentication (2FA): a second check after your password, like a code sent to your phone.
The biggest data breaches of 2026
The table below ranks major 2026 breach reports by the number of people listed as affected in public breach records. Dates refer to when the breach was reported or publicly disclosed, not always the date when the attack started.
| Rank | Organization | People affected | Reported |
|---|---|---|---|
| 1 | Instructure / Canvas | 275 million* | May 2026 |
| 2 | DentaQuest | 15 million | July 2026 |
| 3 | Aesto Health | 9.54 million | July 2026 |
| 4 | AssuranceAmerica | 6.99 million | June 2026 |
| 5 | Carnival Corporation | 5.99 million | May 2026 |
| 6 | Lumexa Imaging | 5.83 million | May 2026 |
| 7 | AdaptHealth | 4.12 million | August 2026 |
| 8 | Unlimited Technology Systems | 3.84 million | July 2026 |
| 9 | Medtronic | 3.83 million | June 2026 |
| 10 | CareCloud | 3.76 million | July 2026 |
*The 275 million Canvas number is not independently confirmed. It came from the attackers’ claim and was carried in a Wisconsin breach listing as a reported figure. Privacy Rights Clearinghouse says the figure remains unverified.
The other figures come from public regulatory filings and breach notices. The ranking can change as companies update their investigations or regulators receive new filings.
Why breach numbers can be different
There is no single worldwide list that gives the final number for every data breach.
A company may first report a small number and later find more affected records. A state attorney general may receive a different number. A federal regulator may also list another number.
The Canvas incident is a good example. Wisconsin’s breach page lists 275 million users as the reported number, but Privacy Rights Clearinghouse says this came from the attackers’ claim and has not been independently verified. Instructure has said Canvas serves more than 30 million users.
That is why a good breach report should tell readers where a number came from instead of treating every number as a confirmed fact.
1. Instructure Canvas — 275 million reported
The Canvas data breach became one of the biggest security stories of 2026.
Canvas is a learning platform used by schools, colleges, and universities. Instructure said it noticed someone using its systems without permission on April 29, 2026. Another attack happened on May 7.
The company said the affected information included usernames, email addresses, course names, enrollment information, and messages. It said there was no evidence that passwords, dates of birth, government identifiers, or financial information were exposed.
The attackers claimed they had data connected to about 275 million people across thousands of schools. That number has not been independently confirmed, so it should be treated carefully.
The incident is still important even without accepting the 275 million figure. One education platform can connect thousands of schools. A weakness in one central system can therefore reach many organizations at the same time.
2. DentaQuest — 15 million
DentaQuest reported a healthcare data breach affecting 15 million people. The incident was submitted to the U.S. Department of Health and Human Services in July 2026.
The U.S. Department of Health and Human Services (HHS) breach record lists the incident as a hacking or IT incident involving a network server.
Reports about the incident say the exposed information could include names, addresses, Social Security numbers, member identification numbers, Medicare or Medicaid numbers, provider information, and health information.
This is a serious type of breach because health information can stay useful to criminals for a long time. A password can be changed. Your medical history or identity information cannot be changed so easily.
3. Aesto Health — 9.54 million
Aesto Health reported a breach affecting 9,540,683 people. The company works with healthcare organizations and stores or handles large amounts of patient information.
The incident involved part of Aesto’s Amazon Web Services environment. The reported information could include names, Social Security numbers, dates of birth, driver’s license information, financial information, medical records, claims, billing information, and health insurance information.
This is a good example of why cloud security matters. A cloud service can be safe when it is set up correctly, but a weak account, bad permission, or other security problem can still give an attacker access to sensitive information.
4. AssuranceAmerica — 6.99 million
AssuranceAmerica reported a data breach affecting about 6,998,886 people.
The breach was reported to state regulators in June 2026. The large number shows another common problem with modern data security: companies can hold information about millions of customers in one system.
When attackers reach that system, the number of affected people can grow very quickly.
5. Carnival Corporation — 5.99 million
Carnival Corporation reported that a cybersecurity incident in April 2026 affected personal information belonging to millions of people.
Carnival’s own notice says an attacker used social engineering to trick an employee and gain access to part of the company’s IT system.
The company said the affected information could include names, addresses, email addresses, phone numbers, dates of birth, and government identification numbers such as driver’s license or passport numbers.
This data breach shows that attackers do not always need to break through a complicated technical wall. Sometimes they try to trick a person who already has access.
6. Lumexa Imaging — 5.83 million
Lumexa Imaging reported a healthcare data breach affecting 5,830,949 people in May 2026.
The incident was listed by HHS as a hacking or IT incident involving a network server.
Healthcare companies are attractive targets because they often hold several types of sensitive information in the same place. Patient names, contact details, insurance information, medical records, and other personal data can all be valuable to criminals.
7. AdaptHealth — 4.12 million
AdaptHealth reported a breach affecting 4,115,802 people.
The attackers reportedly tricked their way into a logged-in account at an outside contractor. This trick is called social engineering. The exposed information may have included names, contact information, demographic information (such as age or gender), health insurance information, and health information.
This is important because the security of a company is not only about its own employees and computers. A contractor may also have access to its data.
8. Unlimited Technology Systems — about 3.84 million
Unlimited Technology Systems was linked to a ransomware attack and data breach that affected about 3.8 million people.
The information involved could include names, addresses, dates of birth, Social Security numbers, government ID information, medical information, and health insurance information.
The incident shows why ransomware gangs remain a major problem. A ransomware attack can stop systems from working while attackers also try to steal information and demand money.
9. Medtronic — about 3.83 million
Medtronic reported a data breach in 2026 involving unauthorized access to certain corporate IT systems.
The company said the incident did not affect its products, patient safety, manufacturing and distribution operations, or financial reporting systems.
Medtronic said it was working to identify personal information that may have been accessed and would notify affected people as needed.
This is a useful reminder that a data breach does not always mean that every system owned by a company was hacked. A company can have separate systems for different jobs.
10. CareCloud — about 3.76 million
CareCloud’s data breach became much larger as the company and regulators reviewed the affected data.
The HHS breach record lists 3,756,469 affected people. The incident involved unauthorized access to one of CareCloud’s cloud environments.
The exposed information may have included names, addresses, Social Security numbers, driver’s license information, dates of birth, health insurance information, medical information, and some financial information.
The lesson is simple: the first number reported after a breach is not always the final number.
The three problems behind many of the biggest breaches
When you look at the biggest data breaches 2026 together, three patterns stand out.
1. Weak access and stolen accounts
Attackers often do not need to guess their way into a system. They may steal an account, trick an employee, or abuse an account that already has access.
The Carnival breach is one clear example. The company said social engineering was used to trick an employee.
Attackers can also steal logins without guessing anything. Some use infostealer malware to grab saved passwords from an infected computer. Others steal login cookies through session hijacking, which can let them skip a password and even 2FA.
The Canvas incident also shows why account security matters. Federal Student Aid urged education organizations to use multi-factor authentication (a second login check, like 2FA) across school systems, cloud services, vendors, and identity providers.
2. One weak vendor can affect many companies
This may be the biggest lesson from the year.
A healthcare provider may use one company for billing. A school may use one platform for learning. A business may use another company for storage or customer support.
If that vendor is breached, the attack can spread across many customers without the attacker breaking into each customer separately.
This is often called a supply chain risk. The more companies connected to one service, the more damage one successful attack can cause.
3. Large databases are valuable targets
Big companies collect a lot of information because their services need it.
Healthcare companies may have medical records and insurance information. Schools may have student records and messages. Insurance companies may have identity and financial information.
That creates a simple problem: one successful attack can expose information belonging to millions of people.
Why healthcare and education keep appearing
Healthcare and education stand out in the 2026 breach numbers because both sectors hold large amounts of personal information.
Healthcare organizations can store names, addresses, dates of birth, Social Security numbers, medical records, insurance details, and billing information.
Education systems can store names, email addresses, student records, enrollment details, course information, and messages.
The 2026 Canvas incident shows how a technology platform can connect thousands of schools. Privacy Rights Clearinghouse found that education accounted for 90 reported breach events in the first half of 2026, but the Canvas incident made the education total much larger because of the huge unverified number attached to that single event.
Healthcare also continues to see large incidents. HHS records show many 2026 healthcare breaches involving hacking or IT incidents, including several involving millions of people.
In other words, attackers are not only looking for famous companies. They are looking for places where large amounts of useful information are stored.
What data was actually exposed?
A data breach does not always mean that your password was stolen.
Each data breach can expose different information. In the major 2026 breaches, the reported data included:
- Names
- Email addresses
- Home addresses
- Phone numbers
- Dates of birth
- Social Security numbers
- Driver’s license information
- Passport or government ID information
- Health insurance information
- Medical records
- Student and enrollment information
- Messages and account information
- Some financial information
The type of exposed information matters. An email address may lead to more spam and phishing. A Social Security number or medical record can create a much bigger long-term risk.
That is why you should read the actual breach notice if a company tells you that you were affected.
Wondering what criminals do with this information after a breach? We explain it step by step in what hackers do with stolen data.
What should you do if you may be affected?
Do not panic when you hear about a data breach at a company you use.
First, check whether you were actually affected. If you receive a notice from a company, read it carefully and check which information was involved.
You can also check whether your email address appears in known breaches using our guide to checking if your email was in a data breach.
1. Change reused passwords
If the breached company says your password was exposed, change it immediately. If you used the same password somewhere else, change it there too.
2. Turn on two-factor authentication
Two-factor authentication adds another step after your password. It can stop an attacker even when the attacker knows your password.
3. Watch for fake emails
Criminals may use news about a real breach to send fake messages. They may ask you to click a link or enter your password.
Do not rush. Open the company’s real website yourself instead of clicking a strange link in an email.
4. Watch your financial accounts
If financial information was involved, watch your bank, card, and shopping accounts for activity you do not recognize.
5. Keep the breach notice
Save the company’s data breach notice. It may contain instructions about credit monitoring, identity protection, contact information, or other support.
6. Get help if someone uses your identity
If someone opens accounts or makes purchases in your name, act quickly. In the United States, the government website IdentityTheft.gov gives a free, step-by-step recovery plan.
Questions about the biggest data breaches 2026
What is the biggest data breach in 2026?
The Canvas incident has the largest reported number attached to a 2026 breach: 275 million. However, that number came from the attackers’ claim and has not been independently confirmed. Instructure has said Canvas serves more than 30 million users.
What are the biggest healthcare data breaches in 2026?
Among the largest healthcare breach reports in 2026 are DentaQuest at 15 million people and Aesto Health at about 9.54 million. Lumexa Imaging, AdaptHealth, Unlimited Technology Systems, and CareCloud also reported breaches affecting millions.
Why are healthcare data breaches so serious?
Healthcare records can contain many types of personal information in one place. This can include identity information, insurance information, medical records, and billing information.
Does a data breach mean my account was hacked?
Not always. A company can lose your information without an attacker logging into your personal account. Check the company’s notice to see what information was involved and what action it recommends.
How can I check if my email was in a data breach?
You can use a trusted breach-checking service such as Have I Been Pwned. Our step-by-step email breach check guide shows you how. You should never give an unknown website your password just to check whether your email was exposed.
Sources and research
We used public breach records, company notices, government information, and security reporting to build this list. Breach numbers can change when investigations are updated.
- Privacy Rights Clearinghouse — 2026 Midyear Data Breach Report
- U.S. HHS — Healthcare Breach Portal
- Instructure — Canvas Security Incident Updates
- Carnival Corporation — Data Breach Notice
- Federal Student Aid — Canvas Security Alert
- Medtronic — Company Information
- TechCrunch — Worst Hacks and Breaches of 2026
For more simple cybersecurity terms, visit our dark web and cybersecurity glossary. You can also read our dark web timeline to see how major security events have changed over time.
Stolen breach data often ends up for sale on the dark web. To see how investigators fight back, read how police catch dark web criminals.
The short version
The biggest data breaches of 2026 show one clear problem: too much important information is often connected to too few systems.
A weak employee account can open a door. A weak vendor can expose many customers. A vulnerable cloud system can expose millions of records.
For everyday users, the best protection is simple. Use a different password for every important account. Turn on two-factor authentication. Keep your email account protected. Watch for fake breach emails. And check your email if you think your information may have been exposed.
A breach may happen to a company, but the information belongs to real people. Knowing what happened is the first step toward protecting yourself.
Comments