The 6 biggest cybersecurity breaches of 2026 so far

The biggest cybersecurity breaches of 2026 so far include Rockstar Games and GTA 6 scams, Instructure's Canvas breach affecting 275 million users, Conduent's health-data leak covering at least 25 million people, Meta's Instagram AI reset flaw, the DarkSword iPhone spyware, and the WeedHack malware-for-hire tool. Halfway through the year, these incidents show hackers are moving faster than many defences.

Key Takeaways

• ShinyHunters dominated 2026 headlines, hitting Rockstar Games and Instructure's Canvas platform used by 275 million students and staff.
• Healthcare data broker Conduent exposed sensitive records for at least 25 million people across Texas and Oregon alone.
• AI support bots and cheap malware subscriptions are lowering the bar for attackers targeting everyday users.
• Zero-click spyware like DarkSword put hundreds of millions of iPhones at risk before Apple patched iOS 18.
• Fake GTA 6 pre-order sites show blockbuster launches remain a magnet for scams long before release day.

Remember when a data breach meant a stolen laptop or a clumsy phishing email? In 2026, the playbook looks different. Ransomware crews re-hit the same victims, AI chatbots hand over password resets, and teenagers rent spyware for five dollars a month. As we track how digital threats have evolved over the years, this year's six most impactful incidents read like a warning shot for the rest of the calendar.

Mashable's mid-year roundup highlights six breaches and scams that stand out not just for scale, but for what they reveal about where cybercrime is heading next.

Which companies suffered the biggest cybersecurity breaches in 2026?

Rockstar Games and Grand Theft Auto VI fans. With GTA 6 set for a late-2026 launch, scammers have flooded the web with fake pre-order sites, mobile apps, and download pages mimicking legitimate platforms. The headcount of victims is still unclear, but the scam volume is climbing as release day nears.

Rockstar itself was not spared. The ShinyHunters collective claimed it breached the developer's networks and demanded ransom. Rockstar said the incident hit a third-party provider and involved corporate assets rather than player data, but the episode underscored that even guarded studios are in the crosshairs.

Instructure and Canvas. Edtech giant Instructure, maker of the Canvas learning management system, suffered one of the year's largest confirmed breaches. ShinyHunters stole names, email addresses, student IDs, and private messages tied to roughly 275 million users across nearly 9,000 schools worldwide.

One week after Instructure said it had fixed the original flaw, ShinyHunters struck again and defaced login pages at specific schools. Some institutions postponed finals while platforms went offline. Reports indicate Instructure eventually negotiated with the group to stop wider data release—a outcome that worries security experts about future ransom dynamics.

Conduent. The data-management firm serves major corporations, healthcare providers, and state agencies. A breach earlier this year hit at least 25 million people in two states alone: about 15 million in Texas and more than 10 million in Oregon. Clients include Humana and Blue Cross Blue Shield of Texas.

Conduent said unauthorized parties obtained files with names, Social Security numbers, medical information, and health insurance details—among the most sensitive categories of personal data regulators track.

How is AI changing the way hackers break in?

Meta's Instagram AI support flaw may be the clearest example. Meta rolled out an AI-powered support chatbot for Instagram, and attackers quickly learned they could ask it to send a password-reset link to any email they controlled. The bot complied when told the requester owned the account.

Threat actors used the trick to hijack high-follower Instagram accounts and sell them on black-market forums. Meta patched the vulnerability, but affected creators remained locked out for a stretch. The incident was not the widest breach on the list, yet it signals a fast-growing tactic: fooling automated systems that lack human judgment.

That pattern mirrors a broader shift from the brute-force hacks of earlier eras to social engineering at machine speed—something our nostalgia lens keeps returning to as "then" phishing gives way to "now" prompt injection.

Why are phones and games still prime targets in 2026?

DarkSword spyware showed how little interaction a victim needs. In March, Google's Threat Intelligence Group plus firms Lookout and iVerify documented malware that could fully compromise an iPhone after a user simply visited an infected website. Stolen data spanned call logs, contacts, iMessage and WhatsApp threads, email, photos, location history, Wi-Fi passwords, iCloud content, and more.

Nearly 25 percent of iPhones were still running iOS 18 versions vulnerable to the exploit, potentially exposing hundreds of millions of devices. Researchers linked Russian hacker groups to active deployments, and DarkSword soon leaked into the wild after public warnings. Apple issued updates, but the episode proved zero-click attacks are no longer theoretical.

WeedHack flipped the attacker side of the equation. A McAfee Labs report described malware disguised as a Minecraft client or mod. The free tier steals system information, browser cookies, and passwords; a five-dollar monthly subscription adds webcam access, keylogging, remote screen control, and file uploads.

McAfee found a Telegram channel where customers—largely teenagers and young adults—used WeedHack to cyberbully peers. Malware-as-a-service is not new, but packaging it for minors marks a disturbing turn from corporate espionage toward playground harassment.

What should you do before the second half of 2026?

None of these incidents share a single fix, but the through-line is clear: verify links before you click, treat AI support tools as untrusted until proven otherwise, patch mobile operating systems promptly, and assume blockbuster game hype will spawn fakes. Schools, insurers, and social platforms are still paying ransoms and scrambling after repeat hits—behaviour that emboldens the same groups to try again.

Half a year in, the biggest cybersecurity breaches of 2026 already span education, healthcare, gaming, social media, and the devices in your pocket. The second half will test whether lessons from the first six months actually stick—or whether 2026 joins the long list of years we look back on and wish we had acted sooner.