Hacked, leaked, and held for ransom: The worst breaches of 2026 so far

This report summarizes a series of major 2026 cyber incidents: an alleged mass Social Security data exposure, destructive attacks on energy and water infrastructure attributed to nation-states, an Iranian-attributed destructive wipe at medical tech firm Stryker, broad supply-chain compromises of open-source tooling affecting Big Tech, large extortion and data-theft campaigns (Klue, ShinyHunters), a breached FBI surveillance system, widespread credential/account hijackings via abuse of Meta’s AI password-reset flow, corporate downtime (Hasbro), and numerous exposures of passports and driver’s licenses — collectively illustrating high-impact, large-scale, and varied cyber threats to governments, critical infrastructure, businesses, and individuals.