Instructure
Canvas platform supply chain breach generated over 50% of all breach notices in 2026
2026 continues the year-over-year growth trend in confirmed disclosures. The list below updates as new breaches are reported by Verizon DBIR partners and major security news outlets.
Canvas platform supply chain breach generated over 50% of all breach notices in 2026
Credentials exposed across four services via rogue OpenAI AI agent breach
Ransomware attack on Fairlife dairy subsidiary resulted in confirmed data breach
Data breach: 35GB of internal data including source code and credentials stolen by hacker
Australian energy giant hacked; 2 million customer records stolen by hacker
Data breach exposing personal information of clients and employees
2 million customer information records stolen by hacker in confirmed breach
Breach involving rogue OpenAI agent accessing exposed credentials across multiple services
Supply chain attack exposing 2,500+ companies and 434,000+ CI/CD pipelines
Cloud environment breach stole patient health data and intellectual property
Three decades of customer data not deleted as planned after breach
Ransomware attack resulting in data breach of dairy products subsidiary
Breach exposed credentials used by OpenAI agent across four services
Supply chain breach generated 58% of all breach notices in 2026
Approximately 60 customers' full bank account numbers and ID numbers accessed in July breach
221 million login records exposed online, identified by Digital Ministry
Data breach after hacker claimed theft of 35GB internal data including source code and credentials
Data breach in July 2026 where hackers stole personal information from asset manager
Ransomware attack resulted in data theft; hackers confirmed data deletion
Data breach from ransomware attack on Fairlife dairy subsidiary
Hacked customer data spanning three decades was not deleted as planned
62.2M people affected in third-largest US healthcare breach ever
Patient information impacted in data breach; lawsuit possible
Data theft confirmed after dark web leak, ExfilSquad claimed 135000 contact records