Key Takeaways:

• Several major cyber incidents and breach claims in 2026 point to a more complicated risk environment for businesses, schools, healthcare technology companies, law firms and consumer platforms.
• Some events are confirmed company disclosed incidents, while others remain claims by threat actors or allegations in lawsuits.
• The pattern is clear: attackers are targeting software flaws, cloud identity systems, employee workflows, exposed credentials and third party data environments.
• Business leaders should treat cybersecurity as a continuity, governance and operational risk, not just a technical issue.

Cybersecurity stories can sound repetitive until they affect something people depend on every day.

A school platform goes down during finals. A medical technology company has to explain a global disruption to its Microsoft environment. A telecom provider confirms a breach after a threat actor makes public claims. A law firm faces litigation tied to sensitive information. A broadband company investigates claims that customer data was stolen. A researcher finds a massive exposed database of usernames and passwords.

Different industries. Different fact patterns. Same uncomfortable lesson.

Cyber risk in 2026 is no longer just about whether a company has a firewall or antivirus software. It is about how the business operates when identity systems, cloud platforms, employee processes, vendors and data stores are all part of the attack surface.

That is the part many organizations still underestimate.

One of the more visible education sector incidents involved Instructure’s Canvas platform. Instructure said it detected unauthorized activity in Canvas on April 29, 2026, revoked the unauthorized party’s access, began an investigation and engaged outside forensic experts. The company also said a second Canvas vulnerability was exploited on May 7, which led it to temporarily take Canvas offline.

That detail matters. Canvas is not just another application. For many schools and universities, it is part of the daily operating layer. It carries assignments, communications, grades, course materials and workflows that students and faculty rely on. When a platform like that is disrupted, the effect can go far beyond IT. It can affect teaching, testing, scheduling and confidence in the systems that support education.

Instructure stated, “On April 29, 2026, we detected unauthorized activity in Canvas.” That is a simple sentence, but it speaks to a larger issue. Digital platforms used by schools now hold data and operational importance that make them attractive targets. Education leaders may need to think about these systems less like websites and more like critical infrastructure.

The healthcare technology sector has also seen disruption. Stryker said that on March 11, 2026, it experienced a cybersecurity attack that resulted in a global disruption to its Microsoft environment. The company said it activated its incident response plan, launched an investigation and worked with external advisors and cybersecurity experts. Stryker also said it had “no indication of ransomware or malware” and believed the incident was contained.

That language is important because it avoids jumping to conclusions. Not every cyberattack is ransomware. Not every disruption means product safety is affected. But for a medical technology company, the business continuity question is immediate. Can orders be processed? Can manufacturing continue? Can distribution recover? Can customers keep receiving support?

In Stryker’s case, the incident was described as affecting its internal Microsoft environment, while connected products were said not to be impacted. Even so, the event is a reminder that cyberattacks can disrupt operations even when the attacker is not directly targeting patient facing products.

Telecom has been another area of concern. Charter Communications confirmed a data breach after ShinyHunters claimed responsibility and threatened to leak data. Public reporting says ShinyHunters claimed access through a voice phishing attack that compromised a Microsoft Entra account and allegedly enabled access to Salesforce data. Charter confirmed a breach but disputed parts of the threat actor’s claims, including the nature and sensitivity of the information involved.

That distinction matters. Threat actor claims are not the same as verified facts. Criminal groups have incentives to exaggerate. Companies also have incentives to limit reputational harm while investigations are ongoing. The responsible way to look at an incident like this is to separate what is confirmed from what is alleged.

Still, the possible attack path deserves attention. Voice phishing is not exotic. It is not a zero day exploit. It is human manipulation aimed at identity and access systems. As companies move more data into cloud applications and SaaS platforms, attackers increasingly look for ways to compromise the people and processes that guard those systems.

This is one reason cloud identity has become such a critical security issue. A compromised account can be more damaging than a compromised device if it opens the door to customer records, support systems, business applications or administrative controls.

The legal sector has also been under pressure. Reuters reported in May 2026 that Wiley Rein was hit with a class action lawsuit over a data breach allegedly tied to Chinese hackers. According to the report, the complaint said the breach occurred between July 2024 and June 2025 and involved Microsoft 365 email accounts. Victims were reportedly notified in March 2026.

This should not be framed as a 2026 breach that began in 2026. It is more accurate to call it 2026 litigation and notification tied to earlier alleged activity. That said, it still belongs in the broader 2026 cybersecurity conversation because it shows how long the consequences of a cyber incident can last.

Law firms can be especially attractive targets because they often hold sensitive information across many clients, matters and industries. They may have personal information, financial records, medical information, privileged communications and strategic business documents. For attackers, that kind of data can be valuable. For clients, the exposure can be deeply concerning.

Then there is the credential problem.

In January 2026, Wired reported that security researcher Jeremiah Fowler found an exposed database containing 149 million usernames and passwords. The credentials reportedly included logins tied to major services such as Gmail, Facebook, banking platforms and other accounts. Fowler suspected the data had been collected using infostealer malware.

This is not the same as one company being hacked. It is potentially worse in a different way. A large credential trove becomes raw material for many future attacks. Criminals can test passwords across services, target employees, build phishing campaigns, look for reused credentials and combine the information with other leaked data.

Many businesses still treat personal password exposure as a consumer issue. That is a mistake. Employees use personal devices. They save passwords in browsers. They reuse passwords. They click on links outside of work. They may access company systems from home networks. A personal compromise can become a business compromise if identity controls are weak.

Other 2026 claims should be handled carefully. Match Group reportedly confirmed a security incident involving a limited amount of user data after ShinyHunters claimed to have stolen records from its platforms. Brightspeed has investigated claims by the Crimson Collective that it stole data on more than 1 million customers. In both cases, public reporting includes threat actor claims that may not be fully verified.

But even alleged incidents are useful warning signs. They show where attackers are focusing. They show what kinds of data criminals believe are valuable. They show how extortion groups use publicity, uncertainty and fear as part of the pressure campaign.

The larger trend is also visible in Verizon’s 2026 Data Breach Investigations Report. Verizon reported that 31 percent of breaches now start with software vulnerabilities, making vulnerability exploitation a leading initial access method in its dataset. The report also highlighted ransomware as a major factor in breaches.

That does not mean passwords no longer matter. It means attackers have more options. They can exploit software. They can trick employees. They can use stolen credentials. They can target vendors. They can abuse cloud identity. They can move from one system to another if segmentation is weak.

So what should businesses do with all of this?

Start with the basics, but take them seriously. Patch critical systems faster. Reduce unnecessary privileges. Use phishing resistant MFA where possible. Monitor Microsoft 365, Google Workspace and cloud identity systems more closely. Train employees for phone based social engineering, not just suspicious emails. Limit third party access. Review SaaS permissions. Back up systems in a way attackers cannot easily erase. Test incident response plans before a crisis hits.

Also, look at data differently. Where does it live? Who can access it? Is it isolated where needed? Is sensitive information being copied into places it does not belong? Are AI tools creating new paths for data exposure? Those questions are now part of cyber readiness.

The biggest message from 2026 so far is not that every company will be breached tomorrow. That would be too simplistic. The more useful message is that cyber resilience has become a core business discipline. Companies need to assume that attackers will probe software, identities, vendors, employees and data stores at the same time.

At Apex Technology Services, we believe the practical response starts with visibility. Know your systems. Know your access points. Know your data. Know your recovery plan. The organizations that handle the next wave of cyber risk more effectively may not be the ones that bought the most tools. They may be the ones that prepared the business to keep operating when something inevitably goes wrong.

Aside from his role as CEO of Apex Technology Services and CEO of TMC, Rich Tehrani is CEO of RT Advisors and a Registered Representative (investment banker) with and offering securities through Four Points Capital Partners LLC (Four Points) (Member FINRA/SIPC). He handles capital/debt raises as well as M&A. RT Advisors is not owned by Four Points.

The above is not an endorsement or recommendation to buy/sell any security or sector mentioned. No companies mentioned above are current or past clients of RT Advisors.

The views and opinions expressed above are those of the participants. While believed to be reliable, the information has not been independently verified for accuracy. Any broad, general statements made herein are provided for context only and should not be construed as exhaustive or universally applicable.

Portions of this article may have been developed with the assistance of artificial intelligence, which may have contributed to ideation, content generation, factual review, or editing