Here are the Worst 5 Data Breaches of the Past Year and How to Protect Yourself

October is Cybersecurity Awareness Month, so it’s putting a spotlight on the growing financial threat of data breaches. Stolen personal information can lead to identity theft, fraud, and financial losses long after an attack ends. 

Over the past year, major breaches have exposed sensitive data belonging to millions, including Social Security numbers, driver’s license information, financial accounts, healthcare records, and other personal information. The Identity Theft Resource Center reported more than 471 million victim notices in the first half of 2026 alone, surpassing the total for all of 2025. Also last year, 18 million U.S. consumers experienced identity fraud, resulting in $27.3 billion (about $84 per person in the United States) in losses. 

Cybersecurity expert Michael Scheumack, chief innovation officer at identity protection company IdentityIQ, said consumers should view a breach as something that can have a lasting impact with long-term financial risks and privacy concerns. 

“When personal information is stolen, the financial risk can continue long after the breach,” Scheumack said. “Criminals can use exposed data to open accounts, commit fraud, and target victims with increasingly convincing scams.” 

Here are five of the largest breaches reported over the past year and steps consumers can take to protect themselves.

1. Instructure (Canvas) — 275 Million People Reportedly Affected

In April 2026, hackers breached Instructure, the company behind Canvas. The hacker group, ShinyHunters, claimed the breach exposed data tied to nearly 9,000 schools and 275 million people, making it one of the largest reported breaches of the year. The data reportedly included names, email addresses, student IDs, course information, and messages. 

Instructure later reached an agreement with the hackers, who returned the stolen data and provided confirmation that the remaining copies had been deleted. The company acknowledged it could not guarantee that the data was permanently erased. 

What to do: Be cautious of unexpected messages referencing school or Canvas accounts, especially requests for passwords, account verification or other sensitive information. 

2. IDScan: 153 MillionDriver’s Licenses and Identity Documents

IDScan confirmed in September 2026 that hackers stole sensitive identity data from its cloud environment, including full names, driver’s license numbers, and numbers from other government-issued IDs. The breach has been linked to a larger cache reportedly containing information on more than 153 million people in the U.S. and Canada. 

What to do: Watch for unexpected calls, texts, and emails requesting identity verification. Monitor your credit and financial accounts and consider a credit freeze or fraud alert if your information was exposed.

3. Conduent: 62.5 million People

A ransomware attack on government services contractor Conduent exposed personal information belonging to more than 62.5 million people (about twice the population of California), including names, Social Security numbers, dates of birth, addresses, health insurance information, and medical data. 

The combination of personal, financial, and health information creates an ongoing risk of identity theft, account fraud, and targeted scams. 

What to do: Monitor your credit and financial accounts, consider a credit freeze or fraud alert, and be cautious of unexpected messages requesting personal information.

4. Aflac: 22.65 million People

Aflac’s June 2025 security incident exposed personal information associated with approximately 22.65 million people (about the population of New York), including names, contact information, claims and health information, Social Security numbers, and other personal data. The company said it contained the incident within hours. 

The combination of health and identity data could give criminals multiple ways to target victims with identity theft, financial fraud, and convincing scams. 

What to do: Monitor your credit reports and financial accounts regularly, use strong and unique passwords, enable multifactor authentication, and be cautious of unexpected messages requesting personal or financial information. 

5. DentaQuest: 15 million People

DentaQuest reported a cybersecurity incident in July 2026 that affected about 15 million people. The company said unauthorized individuals accessed its network between May 17 and May 20, 2026. Exposed information included personal identification information and dental, vision, and health information, including provider names, diagnoses, treatments, and billing information. 

The breach illustrates why healthcare information can be particularly valuable to criminals. Medical and insurance information can be used for identity fraud, targeted scams, and other forms of financial crime. 

What to do: If you received a DentaQuest notification, follow the instructions provided and take advantage of any identity monitoring offered. Even if you were not affected, review medical bills, insurance statements, and credit reports for unfamiliar activity. 

Other Major Data Breaches in the Last Year 

Data breaches involving Carnival Corporation and identity protection company Aura also made headlines in the last year. 

Carnival Corporation: A reported data breach, confirmed by the company in May 2026, affected nearly 6 million cruise passengers, exposing information that reportedly included passport numbers, birth dates, and home addresses. Criminals can use these details for identity fraud and targeted phishing scams.  

Read Carnival Data Breach 2026: What Was Stolen and What to Do for steps consumers can take to protect their information. 

Aura: The identity theft protection company Aura announced a data breach linked to the hacker group ShinyHunters in March 2026. More than 900,000 records were accessed. Depending on what information was exposed, affected consumers could face phishing attempts, account takeover risks, and identity fraud.  

Learn more in Aura Data Breach 2026: What Happened and What You Should Do. 

How to Protect Yourself After a Data Breach 

Consumers cannot prevent a company from being hacked, but they can make their stolen information harder to monetize. 

Use unique passwords. Never reuse the same password across financial, email, or other important accounts. A password manager can generate and store strong, unique credentials. 

Turn on multifactor authentication. MFA provides an additional verification step if a password is compromised. 

Use top-rated identity theft protection. Choose a trusted identity theft protection service that monitors your credit and identity for new accounts, suspicious activity and other warning signs. 

Watch for breach-related scams. Criminals often use information from a breach to make phishing messages more convincing. Never provide sensitive information simply because someone knows details about you. 

Consider a credit freeze. A freeze can restrict access to your credit file and make it harder for criminals to open new accounts in your name. 

Act quickly when something looks wrong. The sooner fraudulent activity is identified, the sooner you can take steps to limit potential financial damage. 

Scheumack said the most important shift is moving from reacting to identity theft to actively monitoring signs of misuse of personal information. 

“You don’t have to wait for fraud to show up on your bank statement before taking action,” he said. “The financial impact can grow quickly, so knowing what is happening with your identity and credit gives you a chance to stop a problem before it becomes a bigger loss.” 

Cybersecurity Awareness Month is a good time to review passwords, enable MFA, and take a closer look at credit and identity monitoring. A breach may be outside your control. What happens after your information is exposed is not. 

Data Breach and Identity Theft FAQs 

Here are answers to frequently asked questions about keeping your identity safe after a data breach: 

What should I do if my information was exposed in a data breach? 

Read the company’s breach notification carefully, determine what information was exposed, and take the recommended protective steps. Monitor credit reports and financial accounts for signs of suspicious activity. 

Should I freeze my credit after a data breach? 

A credit freeze can be a useful step when sensitive information such as a Social Security number has been exposed. It restricts access to your credit file and can make it more difficult for someone to open a new account in your name. 

Can hackers use information from a data breach to steal money? 

Yes. Stolen personal information can be used to open fraudulent accounts, impersonate legitimate companies, conduct social engineering attacks, or other forms of financial fraud. 

How can I protect myself from phishing after a data breach? 

Be skeptical of unexpected messages referencing a recent breach. Don’t click on links or provide personal information through unsolicited emails, texts, or calls. Contact the organization directly using a trusted website or phone number to verify the request. 

Is Identity Theft Protection Necessary After a Data Breach? 

Top-rated identity theft protection is essential after a data breach. Comprehensive identity theft protection can monitor personal information for suspicious activity and other signs of fraud. This broader protection can help detect identity theft earlier and give consumers more time to act and prevent growing financial losses.