#breaches

SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and in 2025-2026, 20 of 43 breaches abused a path with no login for MFA to protect at all.

ShinyHunters published the McKesson data after a 55.2 million dollar demand went unpaid. Have I Been Pwned counted 6.4 million unique email addresses, against the group's claim of 284 million records, which were raw rows.

Attackers exploited CVE-2026-63077 against a JetBrains-run TeamCity server to breach the Cadence cloud service, taking AWS IAM credentials, source code, and secrets from a 2024 backup. JetBrains says the server should have been patched.

Nexus, advertised on a Russian cybercrime forum, sold access to more than 153 million US and Canadian driver's licenses that its operators say they exfiltrated from IDScan.net over more than a year. The FBI opened an investigation.

ShinyHunters social-engineered McKesson employees from a lookalike domain, took their Okta credentials, and used the SSO session to reach Salesforce and Snowflake. The group claims roughly 284 million records and demanded 55 million dollars.

ShinyHunters voice-phished a RingCentral employee out of their password in July, took 623GB, and dumped 280GB after the company refused to pay. Have I Been Pwned confirmed 1.6 million accounts including names, emails, phone numbers and addresses.

Connor Riley Moucka pleaded guilty in Seattle federal court on August 6, 2026 to computer fraud, wire fraud, aggravated identity theft, and conspiracy over the 2024 Snowflake customer breaches, which reached at least 165 organizations and 100 million people.