From a massive DOGE data breach and the hacking of critical energy and water systems to the hack of an FBI surveillance system, here are the most damaging security incidents and data breaches of 2026.

The cybersecurity company is nearing a $300 million round led by Evolution Equity Partners.

An Israeli cybersecurity firm said Iran’s government is behind Ababil of Minab, a fake hacktivist persona that has claimed a series of data breaches after the start of the war in Iran.

The data breach included names, dates of birth, postal addresses, and Social Security numbers, according to a state government listing.

The New York public healthcare system said hackers stole personal and medical data, and scans of biometrics — including fingerprints — in one of the largest recorded breaches of 2026.

The open source project said hackers stole its codebase and threatened to publish its source code if the company did not pay.

The cybercrime group ShinyHunters claimed to have hacked Instructure again, defacing the login pages of several Instructure customer schools with an extortion message.

Braintrust, a startup that makes an “operating system for engineers building AI software,” notified customers that hackers broke into one of its Amazon cloud environments, and is asking customers to rotate their API keys.

The data breach at education tech giant Instructure includes students' private data, according to a sample of the allegedly stolen data seen by TechCrunch.

The security bug is now fixed, but the patient who found it said it was challenging to alert the software company about the issue.

The American technology giant provides water and energy monitoring and utility meters to hundreds of millions of homes and businesses.

The app and website hosting company has found evidence of a second compromise of customer accounts after expanding its initial investigation following a breach in early April.

TechCrunch has confirmed that Delve was the compliance company that performed the security certifications for Context AI, the AI agent training startup that last week disclosed a security incident.

The cosmetics retailer, which counts 41 million customers in its membership data, declined to provide an accurate total number of customers affected.

Vercel blamed its breach on an earlier hack at Context AI, which allowed hackers to hijack a Vercel employee's account to steal customer data.

The travel giant notified customers that their personal data, including names, email addresses, and phone numbers, may have been accessed in a security incident.

The data breach at Anodot, which affects customers like Rockstar Games, is the latest hack aimed at stealing data from a large number of corporate giants.

The pcTattletale founder escapes a custodial sentence following the first successful prosecution of a spyware maker in the U.S. in over a decade.

Blockchain trackers put the cryptocurrency heist in the hundreds of millions of dollars and is already on track to be the largest crypto theft in 2026 so far.