The year is only half over, yet 2026 is already full of data breaches, hacks, and cyber security incidents.
So let’s take a look back at the biggest cybersecurity breaches of 2026 so far. Mashable has selected six of the most impactful incidents. There are probably lessons you can learn to protect yourself throughout the year.
Here they are, in no particular order.
Grand Theft Auto VI fans and Rockstar Games
GTA 6the most anticipated video game of the last decade, will finally be released this year. And cruel characters are like that it just directs its followers and even game developer.
It’s fake GTA 6 pre order websites, fake GTA 6 mobile apps, and fake sites copying official game download platforms since developer Rockstar Games confirmed the game’s launch in late 2026.
It’s unclear how many users have been affected, but it’s apparently growing, as hackers will continue to target Grand Theft Auto players until the game is released and probably after that.
Even Rockstar games are not safe. Earlier this year, the now infamous ShinyHunters hacker group announced that they had breached the game developer’s networks. ShinyHackers demanded a ransom not to release the data they had stolen.
Rockstar downplayed the seriousness of the data breach, saying the breach occurred at a third-party provider. It also emerged that the data contained business assets rather than private user information.
Order data breach
Edtech giant Instructure, the company behind the popular Learning Management System (LMS) Canvas, fell victim to what was not an easy the biggest breach of the year until now.
The Instructure breach was also carried out by ShinyHunters, a hacking group that has gained notoriety as the cause of such massive data breaches. The data stolen in this breach included usernames, email addresses, student IDs, and private messages exchanged on the platform, which was used by 275 million users at nearly 9,000 schools worldwide. These users include students, teachers, and school staff.
To make matters worse, ShinyHunters have breached Instructure’s platforms and just one week after the company demanded that it fix security issues related to the original data breach. However, this time, ShinyHunters has defaced the login pages of certain schools.
The data breach forced some schools to postpone final exams and assignments, as Instructure took its platforms offline to deal with cybersecurity incidents.
ShinyHunters are well-known for breaching the law and demanding ransom for not releasing data. It turns out that Instructure he made a deal with ShinyHunters to prevent its users’ data from being disseminated. It’s certainly a worrying result that doesn’t bode well for how severe future data breaches could be.
Appropriate data breach
Conduent is a data management company whose clients include many large corporations, healthcare providers, and government agencies. So, where there is a data breach at the organization that handles sensitive data for Humana and Blue Cross and Blue Shield of Texas, just to name a few, there is cause for concern.
Earlier this year, at least 25 million people in two states were affected by a data breach at Conduent. It was reported that 15 million people were affected in Texas, which is a small population of more than 31 million residents. Reports say more than 10 million people were affected in Oregon.
According to Conduent, unauthorized parties “obtained certain files containing personally identifiable information, which came into our possession as a result of the services we provide to your current and former health plan.”
Mashable Light Speed
This data included usernames, Social Security numbers, medical information, and health insurance information.
That’s a major cybersecurity incident involving some of the most sensitive user data that could be discovered.
Meta AI supports Instagram vulnerability
The most recent incident on this list completely sums up the many unsolved cases Cybersecurity issues with AI.
Meta has released a powerful AI support chatbot for Instagram. Hackers realized that they could simply ask the AI chatbot to send a password reset link for any Instagram account to the hacker’s email address. Meta AI support complied with the requests simply because the hacker claimed to be the account owner and needed the chatbot to send a password reset link to a new email address.
Malicious actors have been stealing the most followed Instagram accounts in this way and selling them on the online black market.
Meta eventually fixed the issue, but affected users were still locked out of their accounts for some time.
This may not have been the biggest, most widespread hack on our list. But the method used to steal these Instagram accounts is certainly a rapidly growing tool in the hackers’ arsenal. We’re going to see a lot of bad actors fooling AI-powered systems with ease in the near future.
DarkSword spyware
What if a hacker could steal a smartphone’s data without actually visiting a website?
The DarkSword spyware, which can do just that, had Google and many other cybersecurity companies sounding alarm bells earlier this year.
Google Threat Intelligence Group and cybersecurity companies Watch out again Verify published their findings in March, showing how malicious actors were exploiting vulnerabilities in Apple’s iPhone to extract data from the phone after the group visited an infected website.
Call logs, contacts, iMessage and WhatsApp data, email, calendars, notes, photos, screenshots, location history, web browser history, signed-in account credentials, device keys, SIM card information, Find My Phone settings, WiFi passwords, iCloud content, and more were all able to be extracted from a malicious actor using DarkSword.
About 25 percent of all iPhones are still running some version of iOS 18, the iPhone operating system that was the subject of the attack. This meant that there were hundreds of millions of iOS devices on which DarkSword could be installed.
According to reports, Russian hacker groups are already deploying spyware “to completely disable devices.”
To make matters worse, the DarkSword soon arrived released into the wild shortly after cybersecurity companies warned about it.
Apple does release updates and important information for users who were vulnerable to spyware. However, the existence of this exploit shows how easy it is for bad actors to attack.
WeedHack
Talking about how easy it is to get robbed, WeedHack it might be a perfect example of how accessible it is to be an attacker, too.
The latest report from McAfee Labs described a new hacking tool offered as a $5-a-month service to novice attackers who may not have the technical knowledge to run a campaign themselves.
WeedHack is a malware that is used under the guise of a Minecraft client or mod. Once a device is infected, an attacker can collect system information, search for files on the infected device, take screenshots of the target’s system, and steal cookies and passwords from the target’s web browser. And that’s the free version.
For $5 a month, an attacker can also get webcam access to an infected device, key logging capabilities, screen sharing and keyboard and mouse access, file management features for uploading and downloading files, and more.
Perhaps the most concerning revelation, however, was how WeedHack was used.
McAfee Labs discovered the Telegram channel of WeedHack customers and found that it was being used mostly by teenagers and young adults who were using the malware to exploit other young people, threaten, harass, and spy on victims.
Malware-as-a-service has been around before, but WeedHack seems to usher in something that goes beyond your typical internet security issues.
Articles
Best Cybersecurity of 2026