The Great Unraveling: Anatomy of the 2026 Data Breach Epidemic

July 21, 2026


2026 has been a heavy year for data breaches, and many of the biggest stories share one method: an attacker phones or tricks a person, borrows a trusted login or integration, and quietly exports data from a cloud service. The earlier version of this story called it an “epidemic” and a “collapse” of privacy. The incidents are real, but the numbers in it were often mixed up, and one case was not a hacker breach at all.

This rewrite checks each incident against company notices, breach-notification data from Have I Been Pwned (HIBP) and reputable reporting. The key habit is to read figures by source: what the company says, what independent analysis of leaked files shows, and what the attackers claim are often three different numbers.

Quick summary

  • ShinyHunters is behind most of the corporate cases: Charter, Odido, Carnival, DentaQuest and 7-Eleven. The method is voice phishing or social engineering, then access to a cloud account such as Salesforce.
  • Numbers differ by source. Charter’s leaked file held 4.9 million unique accounts per HIBP, versus 13 million individuals estimated by Cybernews and 42 million claimed by the attackers.
  • Third parties: Vimeo and LastPass were hit through vendors (Anodot and Klue). JDownloader’s own website was tampered with.
  • Humanitarian data: The UN World Food Programme confirmed a breach of its Gaza registration app, covering roughly 600,000 households.
  • Trump Mobile and LexisNexis were exposed through ordinary web and cloud mistakes.
  • Social Security data and DOGE: This is a dispute over access in 2025, backed by court filings and whistleblower claims. It is not a confirmed external hack, and I could not verify the “500 million” figure.

The ShinyHunters pattern

ShinyHunters is an extortion group that, according to BleepingComputer, has run social-engineering campaigns for more than a year against employees’ single sign-on accounts at Microsoft Entra, Okta and Google. After taking one account, it pulls data from connected software-as-a-service (SaaS) tools such as Salesforce. The group publishes data when a company refuses to pay. The FBI has warned that paying doesn’t guarantee deletion.

Charter Communications

The group told BleepingComputer it breached Charter on April 1 by phoning an employee and getting their Microsoft Entra account, then exported data from Salesforce. Charter confirmed an incident on May 26 and said sensitive customer data (CPNI) wasn’t taken. After a May 27 deadline passed, the data was published.

The headline numbers conflict. ShinyHunters claimed about 42 million records, which exceeds Charter’s customer base, and Cybernews said duplicates likely inflated it. HIBP found 4.9 million unique accounts, with names, emails, job titles, phone numbers and addresses. Cybernews estimated at least 13 million individuals, per TechRepublic. The earlier text called 13 million “independently confirmed.” It was a single outlet’s estimate. I removed the “27,000 employees” figure, which I could not source. The CPNI dispute is unresolved: Charter denies it and the attackers claim otherwise.

Odido (Netherlands)

Odido said attackers got into its customer contact system on the weekend of February 7–8, 2026 and that 6.2 million customers’ data was taken. The company’s CEO said the attackers impersonated IT staff by phone in two intrusions, as NL Times reported. Stolen data included names, addresses, phone numbers, emails, IBAN bank account numbers, dates of birth and ID document details.

ShinyHunters demanded more than €1 million, then published the first batch of about 680,000 individual records, including roughly 275,000 IBANs, per NL Times. The group claimed larger numbers; I treat them as claims. On July 13, Dutch police said there were strong indications that Dutch nationals were involved, and released a recording of a Dutch-speaking caller. The earlier text said attackers bypassed multi-factor authentication through phishing emails. The company’s own account describes phone-based impersonation, so I removed the MFA claim.

Carnival Corporation

Carnival’s notice to Maine put the total at 5,995,277 people. The company said its security team spotted unauthorized activity on April 14 after an employee was deceived by social engineering. BleepingComputer reported a breach date of April 10. HIBP analyzed the leaked file and counted about 7.5 million unique emails, tied to Holland America’s Mariner Society loyalty program, as Help Net Security reported. HIBP listed names, dates of birth, genders, emails and loyalty status.

The earlier text said government ID numbers were exposed. I could not confirm that: Carnival’s notification doesn’t list fields, and HIBP did not list IDs. The 8.7 million records and “terabytes” are ShinyHunters’ claims. Carnival’s earlier incidents in 2019 to 2021 are on the record.

DentaQuest and 7-Eleven

DentaQuest confirmed on June 2 unauthorized access to part of its network after ShinyHunters listed 234 GB. HIBP found 2.6 million accounts, with names, contacts, dates of birth, government IDs and health-insurance details. About 66% were already in HIBP from other breaches, per BleepingComputer. DentaQuest hasn’t confirmed those exact numbers.

7-Eleven found unauthorized access on April 8. On May 1 it said that franchise-application documents were involved, per Help Net Security. HIBP counted about 185,000 people. ShinyHunters claimed over 600,000 records from Salesforce and published 9.4 GB. 7-Eleven has not confirmed the group’s technical claims.

Third parties and download sites

Vimeo and the Anodot campaign

Vimeo disclosed on April 27 that attackers reached its Snowflake and BigQuery data through Anodot, an analytics vendor, and the company disabled all Anodot credentials. HIBP found 119,200 email addresses, some with names. Vimeo said video content, login credentials and payment cards weren’t exposed, per BleepingComputer. This was one of at least a dozen companies hit through the same vendor, and ShinyHunters later leaked a 106 GB archive, teiss reported.

LastPass and Klue

LastPass said on June 23 that an attacker obtained OAuth tokens held by Klue, a market-intelligence vendor, and used them to read customer data in LastPass’s Salesforce. LastPass said customer vaults weren’t touched and that exposed data included names, contact details and support-case information, per BleepingComputer. Credit went to the Icarus group, though ReliaQuest noted ShinyHunters also claimed the Klue breach, so attribution is muddled. Salesforce temporarily disabled the Klue integration.

JDownloader’s website

This was a malware-distribution incident, not a data breach in the same sense. JDownloader’s developers said attackers exploited an unpatched flaw in the site’s content-management system and replaced the Windows “Download Alternative Installer” links and the Linux shell-installer link from May 6 to 7. Other downloads, including macOS and in-app updates, were not affected, per BleepingComputer. Analysts reported a Python remote-access trojan on Windows. I removed the earlier text’s detailed claims (specific packers, a rootkit, and a list of 50 blocked security programs) because I could not match them to a source. Anyone who ran those installers should treat the machine as compromised and reinstall the system, as incident responders advise. The legitimate installer is signed by AppWork GmbH.

Humanitarian data: the World Food Programme

The WFP said its self-registration application for Palestine was breached on May 14, 2026. It told The New Humanitarian that roughly 600,000 households in Gaza were affected, with names, ID numbers, mobile numbers and neighborhood-level location data exposed. It told people via Telegram on May 31, per The Register, 17 days after detection. WFP said the breach was limited to this application and did not affect its global SCOPE system.

Two things need labeling. “Largest humanitarian-data breach in history” is a claim by the advocacy group Skyline International, not an established ranking. And a whistleblower told reporters that an outside expert had flagged vulnerabilities two days before the breach, which WFP has not publicly addressed in the sources I found. Update: The New Humanitarian reported on July 29 that WFP was reopening the app after security improvements, with questions still open. I removed the earlier text’s political commentary, as the facts of the breach stand on their own: sensitive data about people who depend on aid and the question of how it was protected.

Ordinary mistakes

Trump Mobile

A researcher who identified himself as Louis told The Register that website order pages returned customer records in a way that allowed looping through them. Columbia’s Jonathan Soma reviewed the code and counted 27,224 entries, and told The Guardian the site likely created a record every time someone reached checkout, even without a purchase. The company said payment, banking, Social Security and call data weren’t affected, as TechRadar noted. So “27,000 people” overstates it; the real number of individuals is smaller. I found no evidence that criminals used the data.

LexisNexis Legal & Professional

Attackers calling themselves FulcrumSec said they got in on February 24 through React2Shell (CVE-2025-55182) in an unpatched React app, then used an overly permissive cloud role to reach databases and stored secrets. LexisNexis confirmed the breach on March 4. It says the data was legacy, from before 2020, and didn’t include Social Security numbers, financial data or active passwords. FulcrumSec claimed 2.04 GB, 3.9 million records, 21,042 customer accounts and data on more than 100 users with .gov emails, as SC Media summarized. Those figures are the attackers’ claims. The earlier text filed this under “the government’s own failure.” LexisNexis is a private company.

Social Security data and DOGE

This is the one case that was not a conventional breach, and it is best told as a documented dispute. In a January 2026 court filing, the Justice Department said Department of Government Efficiency (DOGE) staff at the Social Security Administration (SSA) shared data through an unapproved third-party server, which SSA said was Cloudflare. It also said an employee signed a “voter data agreement” with an advocacy group on March 24, 2025, as The Register and Nextgov reported. SSA said it had not yet seen evidence that SSA data was shared with the group, and referred two employees under the Hatch Act.

Former SSA chief data officer Charles Borges alleged in an August 2025 whistleblower complaint that DOGE associates put a live copy of the Numident database on a vulnerable cloud environment, as FedScoop reported. A separate whistleblower told the Washington Post a former DOGE engineer put data from Numident and the Master Death File on a thumb drive; that is an allegation, and the SSA inspector general said on March 6 it was reviewing such claims, per OPB. The earlier text’s “500 million Americans” isn’t supported by what I found: Numident covers records for roughly 300 million or more people. And the dates matter: the access described happened in 2025, and the admissions came in 2026. No source I found shows that outside hackers obtained the data.

Claim check

Incident Company or official figure Independent or other estimate Attackers’ claim
CharterNot given4.9M accounts (HIBP); 13M individuals (Cybernews)42M records
Odido6.2M customers680,000 individuals in first leak (RTL)More than 10M customers
Carnival5,995,277 people (Maine filing)7.5M emails (HIBP)8.7M records
DentaQuestNot confirmed2.6M accounts (HIBP)234 GB
7-ElevenFranchise documentsAbout 185,000 (HIBP)600,000+ records
VimeoEmails, metadata119,200 emails (HIBP)106 GB leaked
WFP GazaAbout 600,000 householdsPerson count not disclosedNone found
Trump MobileNot stated27,224 entries (Soma)None
LexisNexisLegacy, pre-2020 dataNot independently verified2.04 GB, 3.9M records

My take

I haven’t investigated any of these incidents myself. These views come from the reports and breach data.

  • The dull part is the important part. A phone call and a trusted login got ShinyHunters into several of the biggest names. Stronger technology doesn’t help if the help desk or an employee will hand over access.
  • Vendors are the hidden perimeter. Vimeo and LastPass lost data through a partner’s stored tokens, which they could not control. That makes token hygiene a company’s own job.
  • One criticism of the “epidemic” framing: the original blends crime, a vendor incident, a website flaw and a political dispute, with numbers from three sources side by side. A clearer story would separate them.

What this means for you

  • Assume your contact data is out there. Check your email on Have I Been Pwned, and treat calls, texts and emails mentioning your telecom, cruise line or insurer with suspicion.
  • Use a password manager, unique passwords and a passkey or authenticator app. Your vault in a password manager wasn’t touched in the LastPass case, but reused passwords are still the biggest risk elsewhere.
  • If you run IT: require verification (for example, a call-back to a known number) before resetting credentials or MFA, use phishing-resistant MFA for administrators, and review which third-party apps hold OAuth tokens to your cloud accounts. Revoke and rotate any you don’t need.
  • Limit what a single account can export. Restrict bulk exports from CRM systems, apply least privilege to cloud roles, and alert on large data pulls.
  • Download software from the project’s signed releases. After a site compromise, check the code-signing certificate, and reinstall the OS if you ran a tampered installer.
  • Don’t keep what you don’t need. Odido’s breach included people who left years earlier, and authorities are examining whether data was retained too long.

FAQ

How many people were affected by the Charter breach?

It depends on the source: 4.9 million unique accounts per HIBP, at least 13 million individuals per a Cybernews estimate, and 42 million records per the attackers. Charter didn’t publish a figure in the sources I found.

Was the Social Security database stolen by hackers?

I found no evidence of that. The documented dispute involves DOGE staff using an unapproved server and a voter-data agreement, plus whistleblower allegations that remain under review.

Is paying ShinyHunters a safe way to get data deleted?

No. The FBI has warned that payment doesn’t guarantee deletion or stop further extortion.

Sources

Tags

You Might Like

Show more
Hacking Stories & Breaches

Post a Comment

0Comments

Post a Comment (0)
Share to other apps
Copy Post Link