The Worst Cyber Breaches of 2026: From Hasbro’s Downtime to Iran’s Destructive Hack

2026 has been a year where cybersecurity breaches have taken center stage, affecting everything from multinational corporations to government agencies. Here are some of the most notable hacks and data breaches that have made headlines so far this year.

Hasbro: A Major Downtime Event

In March 2026, toy giant Hasbro faced a significant security incident that left its website offline for weeks. The breach occurred when hackers gained access to the company’s systems and remained undetected for some time. Despite efforts to contain the issue, Hasbro was forced to postpone financial reporting as it worked to recover from the cyber attack.

Iranian Hackers: Wipe and Hold

In a brazen move, Iranian hackers targeted U.S.-based medical technology company Stryker in March 2026. The hackers remotely wiped tens of thousands of employee devices, causing widespread disruption for several days. This marked a shift from Iran’s typical espionage tactics to actively destructive hacks, possibly in retaliation for the ongoing war with the U.S. and Israel against Iran.

ShinyHunters: Voice Phishing on a Massive Scale

The ShinyHunters, a group of English-speaking hackers, have been making headlines with their voice phishing campaigns. In 2026, they breached the learning management system Canvas owned by education tech giant Instructure, stealing data from over 30 million users. When Instructure refused to pay the ransom, the hackers defaced the company’s login screens during finals week, disrupting exams for students across the U.S.

DOGE: A Massive Data Breach Under Scrutiny

One year after the Department of Government Efficiency (DOGE) dismantled federal agencies from within, questions remain about a massive data breach that occurred. Whistleblowers claim DOGE uploaded sensitive Social Security data to an unsecured third-party server, potentially exposing millions of Americans’ personal information. While the exact extent and impact are still unclear, it could be one of the largest data breaches in U.S. history.

Hackers Target Water Systems and Energy Grids

Europe has seen a series of cyberattacks targeting civilian energy and water supplies, often attributed to Russian actors. In 2026, Poland’s energy grid was hit with destructive malware, while Swedish thermal plants and Norwegian dams were targeted as well. More recently, warnings emerged about Iranian hackers targeting critical infrastructure in the U.S., including privately owned water utilities.

FBI Surveillance System Breached

In April 2026, the FBI had to declare a “major cyber incident” after identifying that one of its surveillance systems was compromised. The breach potentially exposed sensitive information about targets under federal wiretaps, raising concerns over national security. Chinese spies were suspected of carrying out this attack on an unclassified network.

Open Source Projects Compromised

A series of ongoing attacks on open source developers have resulted in massive hacks targeting big tech companies and their customers. Major security tools like Aqua Security’s Trivy, Bitwarden, and Checkmarx were compromised this year, allowing hackers to steal passwords and credentials from users. These breaches highlight the vulnerability of the open source ecosystem.

Millions of Passports Exposed

Over the past few months, there have been several data exposures involving sensitive government-issued identity documents like passports and driver licenses. Services such as hotel check-ins, money transfer apps, and even prison payphones exposed over two million people’s personal documents. These breaches raise concerns about the effectiveness of “know your customer” checks and age-verification laws.