Quick answer: Most major cyberattacks of the last decade came down to a handful of basic failures: software that was not patched, stolen passwords used on accounts without multifactor authentication (MFA), attacks through suppliers and software updates, and people tricked by social engineering. In 2026 attackers went further, wiping tens of thousands of devices at Stryker, shutting down Boston Scientific’s global network, targeting US water systems and abusing an AI chatbot to hijack Instagram accounts. This guide covers both data breaches and disruptive attacks from 2014 to 2026, what caused them and what every organization can do differently, with a source for every case.
Last updated: October 2026.
Major cyberattacks and data breaches, newest first
Click an organization to jump to the full explanation and sources.
| When | Organization | What happened | Type of attack |
|---|---|---|---|
| October–November 2026 | European supermarkets | Attackers switched internet-exposed fridge and freezer controllers to defrost overnight, spoiling food at up to 700 stores in France and then more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. | Sabotage of operational technology |
| August 2026 | Boston Scientific | A cyberattack cut off the medical device maker’s global network. Shipping and new orders stopped and recovery took about two weeks. | Outage |
| July–August 2026 | US water systems | Iran-linked hackers called CyberAv3ngers targeted more than 100 water facilities in at least a dozen states, disrupting controls at over 30 systems in Minnesota. | Critical infrastructure |
| May 2026 | Instructure (Canvas) | ShinyHunters stole data on more than 30 million students and staff, then defaced the Canvas login page during final exams. The company paid the ransom. | Data theft and extortion |
| March–May 2026 | Open-source developer tools | Attackers hid malicious code in tools such as the Trivy scanner and npm packages. Stolen credentials led to breaches at OpenAI, Vercel and an EU cyber agency. | Supply chain |
| March 2026 | Stryker | A pro-Iran group called Handala broke in and remotely wiped tens of thousands of employee devices, disrupting operations for days. | Wiper (destructive) |
| March 2026 | Hasbro | Hackers inside the toymaker’s systems kept it largely offline for weeks and forced it to delay a filing with the SEC. | Outage |
| Early 2026 | Instagram (Meta) | Attackers tricked Meta’s AI support chatbot into sending password reset codes to them and hijacked tens of thousands of accounts. | AI account takeover |
| September 2025 | European airports (Collins Aerospace) | An attack on shared check-in software stopped electronic check-in at Heathrow, Brussels and Berlin, causing delays and cancellations. | Supplier outage |
| August–September 2025 | Jaguar Land Rover | The carmaker shut down its IT systems after an attack. Car production stopped for weeks and suppliers sent workers home. | Production shutdown |
| April 2025 | Marks & Spencer | The retailer paused online orders for weeks after an attack linked to Scattered Spider. Customer data was stolen and profits took a hit of about £300 million. | Ransomware |
| August 2024 | WordPress sites (LiteSpeed Cache) | A flaw in a popular WordPress plugin let anyone make themselves an administrator on more than 5 million sites until it was patched. | Vulnerability |
| June 2024 | PHP servers (CVE-2024-4577) | A critical flaw in PHP on Windows servers was used within days to install ransomware on servers that had not been updated. | Unpatched software |
| April–July 2024 | Snowflake customers (Ticketmaster, AT&T) | Criminals used old stolen passwords to log in to about 165 companies’ cloud data accounts that had no MFA, and stole huge amounts of customer data. | Stolen passwords |
| February 2024 | Change Healthcare | Ransomware gang ALPHV/BlackCat got in through a remote portal with no MFA. US pharmacies and claims were disrupted and about 192.7 million people were affected. | Ransomware |
| February 2024 | Arup (Hong Kong office) | A finance employee joined a video call with deepfakes of senior colleagues, including the CFO, and transferred about $25 million to criminals. | Deepfake fraud |
| May–June 2023 | MOVEit Transfer | The Cl0p gang used an unknown flaw in file transfer software to steal data from hundreds of organizations. | Zero-day data theft |
| September 2022 | Uber | A hacker used a contractor’s stolen password and kept sending login prompts until one was approved, then accessed internal tools. | MFA fatigue |
| December 2021 | Log4Shell (Log4j) | A critical flaw in a logging library built into countless applications let attackers run code on servers with a single line of text. | Vulnerable component |
| May 2021 | Colonial Pipeline | DarkSide ransomware got in through a VPN password without MFA. The largest US East Coast fuel pipeline shut down and a $4.4 million ransom was paid. | Ransomware |
| December 2020 | SolarWinds | Russian state hackers hid a backdoor in software updates installed by thousands of organizations, including US government agencies. | Supply chain |
| May 2019 | Canva | A hacker accessed the design platform’s user database and claimed data on about 139 million users. Passwords were strongly protected. | Data breach |
| June 2017 | NotPetya (Maersk, Merck and others) | Destructive malware spread from a hijacked accounting software update and wiped company networks worldwide, causing over $10 billion in damage. | Wiper (destructive) |
| May 2017 | WannaCry (NHS and others) | A self-spreading ransomware worm hit unpatched Windows computers worldwide and disrupted at least 81 NHS trusts. | Ransomware worm |
| May–July 2017 | Equifax | Hackers used an unpatched web software flaw to steal data on about 147 million people, including Social Security numbers. | Data breach |
| 2014–2018 | Marriott / Starwood | Attackers hid inside Starwood’s systems for four years, exposing hundreds of millions of guest records including passport details. | Data breach |
| 2013–2014 | Yahoo | Every one of Yahoo’s roughly 3 billion accounts was affected across two breaches, and the company was fined for disclosing them late. | Data breach |
Check your own exposure: take the free Cybersecurity Readiness Assessment to see which of these weaknesses apply to you.
Not just data breaches: the main types of cyberattack
A data breach is only one kind of cyberattack. Many of the most damaging attacks steal nothing at all. They stop a business from operating.
| Type of attack | What the attacker does | Recent example |
|---|---|---|
| Data breach and extortion | Steals data and threatens to publish it | Instructure (Canvas), 2026 |
| Ransomware outage | Encrypts systems so the business cannot operate | Change Healthcare, 2024; Boston Scientific, 2026 |
| Wiper (destructive) attack | Permanently destroys data and devices | NotPetya, 2017; Stryker, 2026 |
| Supply chain attack | Compromises a trusted supplier or software update | SolarWinds, 2020; open-source tools, 2026 |
| Critical infrastructure attack | Tampers with industrial and utility systems | US water systems, 2026 |
| Third-party service disruption | Takes down a shared platform used by many companies | Airport check-in systems (Collins Aerospace), 2025 |
| AI-assisted account takeover | Tricks automated systems into handing over access | Instagram AI chatbot abuse, 2026 |
The biggest cyberattacks of 2025 and 2026
Stryker: devices wiped (March 2026)
A pro-Iran hacktivist group called Handala, which the US government linked to Iranian intelligence, broke into the medical technology company Stryker and remotely wiped tens of thousands of employee devices. Operations were disrupted for several days, and the company said the attack had a material impact on its quarterly earnings.
Lesson: protect device management and admin consoles with phishing-resistant MFA, because whoever controls them can wipe every device at once. Source: TechCrunch.
Read the full story: Stryker Cyber Attack: How Hackers Wiped Thousands of Devices →
Instructure (Canvas): students’ data stolen and exams disrupted (2026)
The ShinyHunters group stole data on more than 30 million students and staff from Instructure, maker of the Canvas learning platform used by schools and universities. In May 2026 the attackers defaced the Canvas login page during final exams, disrupting exams across the United States. Instructure eventually paid the ransom.
Lesson: schools and education technology providers are prime targets; they need strong access controls and a plan to keep teaching when a platform goes down. Source: TechCrunch.
Read the full story: Instructure Canvas Data Breach: 30 Million Students and Staff Affected →
Boston Scientific: global network cut off (August 2026)
A cyberattack cut off Boston Scientific’s global network, halting shipping and new orders and disrupting manufacturing. Immediate recovery took about two weeks.
Lesson: manufacturers need offline procedures for orders and shipping, and tested plans to rebuild systems quickly. Sources: TechCrunch, CSIS.
Read the full story: Boston Scientific Cyber Attack: Global Network Cut Off →
Hasbro: weeks offline (March 2026)
Hackers were discovered inside toymaker Hasbro’s systems in late March 2026. Its website was unavailable for weeks and the company had to delay a quarterly filing with the SEC before confirming in May that the attackers were gone.
Lesson: a long outage hurts revenue and reporting, not just IT. Plan for business continuity, not only data protection. Source: TechCrunch.
Read the full story: Hasbro Cyber Attack: Weeks Offline and a Delayed SEC Filing →
US water systems targeted (July–August 2026)
Iran-linked hackers known as CyberAv3ngers targeted water systems in at least a dozen US states, affecting more than 100 facilities, and disrupted operational technology at more than 30 municipal water systems in Minnesota.
Lesson: industrial systems must never be exposed to the internet with default passwords. Source: CSIS Significant Cyber Incidents.
Read the full story: US Water Systems Cyber Attacks: Iran-Linked Hackers Target Utilities →
Open-source software supply chain attacks (2026)
Attackers backdoored widely used developer tools and packages, including security scanners, to steal passwords and access tokens. The stolen credentials then enabled breaches further down the chain, including at OpenAI, Vercel and an EU cyber agency.
Lesson: treat developer tools and packages as part of your attack surface: pin versions, check updates and rotate tokens after any compromise. Source: TechCrunch.
Instagram accounts hijacked through an AI chatbot (2026)
Attackers posed as account owners and persuaded Meta’s AI support chatbot to send password reset codes to email addresses they controlled. Tens of thousands of accounts were taken over before the method was blocked.
Lesson: AI assistants that can change account settings need the same identity checks as human support staff. Source: TechCrunch.
European airports: check-in systems down (September 2025)
A cyberattack on Collins Aerospace’s MUSE passenger processing software disrupted electronic check-in and baggage drop at airports including London Heathrow, Brussels and Berlin, forcing staff back to manual check-in and causing delays and cancellations. Reports cited ENISA, the EU cybersecurity agency, as describing it as ransomware.
Lesson: when many organizations share one supplier, one attack can stop an entire sector. Keep manual fallbacks. Source: Acronis Threat Research Unit.
Read the full story: Airport Cyber Attack: How the Collins Aerospace Outage Hit Europe →
Breaches caused by unpatched software
Equifax (2017)
Attackers exploited a known vulnerability in the Apache Struts web framework on an Equifax online dispute portal, months after a patch was available. They stole names, dates of birth and Social Security numbers of about 147 million people. Equifax agreed to pay at least $575 million, and up to $700 million, in a settlement with the FTC, the CFPB and US states.
Lesson: keep an inventory of internet-facing software and patch critical flaws quickly. Source: FTC.
WannaCry (2017)
The WannaCry ransomware spread automatically between Windows computers using a vulnerability that Microsoft had already patched. In the UK, it disrupted at least 81 NHS trusts, forcing thousands of appointments and operations to be cancelled. The UK National Audit Office concluded that basic IT security practices could have prevented much of the damage.
Lesson: patch operating systems, retire unsupported systems and segment networks so one infection cannot spread everywhere. Source: National Audit Office.
PHP servers: CVE-2024-4577 (2024)
In June 2024 a critical flaw was disclosed in PHP running in CGI mode on Windows servers, including default XAMPP installations. Within days, criminals were exploiting it to plant web shells and deploy the TellYouThePass ransomware on servers that had not been updated to PHP 8.3.8, 8.2.20 or 8.1.29. Hundreds of thousands of PHP servers were exposed to the internet.
Lesson: websites are business systems too. Keep PHP, your CMS and plugins on supported, patched versions. Sources: NIST NVD, Help Net Security.
Read the full story: PHP CVE-2024-4577: How a PHP Flaw Led to Mass Server Hacks →
WordPress: LiteSpeed Cache plugin (2024)
In August 2024 researchers disclosed a critical flaw in the LiteSpeed Cache plugin, installed on more than five million WordPress sites. An unauthenticated attacker could make themselves an administrator and take over the site. The fix arrived in version 6.4.
Lesson: turn on automatic updates for plugins and remove plugins you do not use. Sources: NIST NVD, Patchstack.
Log4Shell (2021)
A critical flaw in Log4j, an open-source logging library built into a huge number of applications, allowed attackers to run code remotely by sending a single crafted text string. Organizations struggled to find every place the library was used.
Lesson: know which open-source components your software contains, for example through a software bill of materials. Source: CISA.
Breaches caused by stolen passwords and missing MFA
Change Healthcare (2024)
Attackers from the ALPHV/BlackCat ransomware group used stolen credentials to log in to a remote access portal that did not require MFA. The attack disrupted claims processing and pharmacies across the United States, and the number of people affected was later put at about 192.7 million, the largest healthcare breach in US history.
Lesson: require MFA on every remote access point, without exception. Source: US Department of Health and Human Services.
Read the full story: Change Healthcare Ransomware Attack: The Largest US Healthcare Breach →
Snowflake customers: Ticketmaster, AT&T and others (2024)
A financially motivated group tracked by Mandiant as UNC5537 used passwords stolen by infostealer malware to log in to the Snowflake cloud data accounts of about 165 organizations. The accounts had no MFA, and some passwords were years old. Ticketmaster and AT&T were among the victims.
Lesson: enforce MFA on cloud platforms, rotate old credentials and restrict access to known networks. Source: Mandiant (Google Cloud).
Read the full story: Snowflake Data Breach: How Ticketmaster and AT&T Data Was Stolen →
Colonial Pipeline (2021)
The DarkSide ransomware group got into Colonial Pipeline’s network, and the company shut down the largest fuel pipeline on the US East Coast as a precaution, causing fuel shortages. Colonial paid a ransom, part of which US authorities later recovered.
Lesson: protect remote access with MFA and plan how to keep operating when IT systems are down. Source: CISA.
Uber (2022)
An attacker obtained a contractor’s password and then sent repeated login approval requests until one was accepted, a tactic known as MFA fatigue. The attacker then accessed internal tools. Uber linked the attacker to the Lapsus$ group.
Lesson: use phishing-resistant MFA such as passkeys or number matching, and train staff never to approve unexpected prompts. Source: Uber.
Breaches through suppliers and software updates
SolarWinds (2020)
Attackers inserted a backdoor into updates for SolarWinds Orion, an IT monitoring product. Thousands of organizations, including US government agencies, installed the trusted update. CISA ordered federal agencies to disconnect affected systems immediately.
Lesson: assess the security of critical suppliers and monitor even trusted software for unusual behavior. Source: CISA Emergency Directive 21-01.
NotPetya (2017)
Malware disguised as ransomware spread through a compromised update of a Ukrainian accounting program and then worldwide. Shipping giant Maersk, pharmaceutical company Merck and many others lost entire networks. Total damage was estimated at more than $10 billion.
Lesson: keep offline backups and a tested plan to rebuild systems from scratch. Source: WIRED.
MOVEit Transfer (2023)
The Cl0p ransomware group exploited a previously unknown flaw in MOVEit Transfer, a widely used file transfer product, to steal data from hundreds of organizations, many of which had never heard of the attackers before they demanded payment.
Lesson: limit what data sits in file transfer tools and know which suppliers hold your data. Source: CISA and FBI advisory.
Breaches involving social engineering
Marks & Spencer (2025)
A cyberattack over the Easter weekend of 2025 forced M&S to pause online orders for weeks and caused empty shelves in some stores. The company confirmed that customer data was stolen and expected a hit of about £300 million to operating profit. Reports linked the attack to the Scattered Spider group, known for tricking IT help desks.
Lesson: help desks need strict identity checks before resetting passwords or MFA. Source: BleepingComputer.
Read the full story: Marks & Spencer Cyber Attack: What Happened and What It Cost →
Jaguar Land Rover (2025)
A cyberattack starting at the end of August 2025 forced Jaguar Land Rover to shut down its IT systems and halt car production in its factories for weeks, with knock-on effects for suppliers. A criminal group calling itself Scattered Lapsus$ Hunters claimed responsibility.
Lesson: manufacturers need plans to keep production and suppliers running during a long IT outage. Source: Channel 4 News.
Read the full story: Jaguar Land Rover Cyber Attack: How Car Production Stopped →
Large data breaches and slow detection
Yahoo (2014)
Hackers stole data from more than 500 million Yahoo user accounts in 2014. In 2018 the US Securities and Exchange Commission fined Yahoo’s successor company $35 million for failing to tell investors about the breach for about two years.
Lesson: have a disclosure process; hiding a breach creates a second, legal problem. Source: SEC.
Marriott and Starwood (2014–2020)
Attackers were inside the Starwood hotel group’s systems from 2014 and were only discovered in 2018, after Marriott had acquired the company. Across this and other incidents, the FTC said more than 344 million customers worldwide were affected, including passport and payment card details.
Lesson: check the security of any company you acquire, and monitor for intruders who are already inside. Source: FTC.
Canva (2019)
In May 2019 the design platform Canva detected an attack on its user database. The hacker behind it claimed data on about 139 million users, including usernames, email addresses and, for some users, passwords protected with the bcrypt hashing algorithm. Canva reported the incident to authorities and urged users to change their passwords.
Lesson: strong password hashing limited the damage; fast detection and clear user communication matter. Source: ZDNet.
The patterns behind almost every breach
- Unpatched software on servers, websites and plugins. See what a zero-day exploit is.
- Stolen passwords on accounts without MFA, often taken by infostealer malware.
- Suppliers and software updates used as a back door. See supply chain attack vectors.
- Social engineering of staff and help desks. See social engineering attacks and how to prevent them.
- Slow detection and weak recovery, which turn an intrusion into a crisis. See incident response strategies.
What your organization should do now
- Turn on MFA for email, remote access, cloud platforms and admin accounts.
- Patch internet-facing systems first, including websites, PHP versions and plugins. CISA’s Known Exploited Vulnerabilities catalog shows what attackers are using now.
- Keep offline or immutable backups and test restoring them. See our guide to managed cloud backup.
- Verify every password reset, MFA reset and payment change through a second channel.
- List your critical suppliers and the data they hold.
- Write and practise an incident response plan.
For the full checklist, certifications and metrics, read Is Your Business Cybersecurity-Proof? and learn about ransomware.
Frequently asked questions
What were the biggest cyberattacks of 2026?
Notable 2026 attacks include the wiping of tens of thousands of devices at Stryker, the theft of data on more than 30 million students and staff from Instructure’s Canvas platform, a global network outage at Boston Scientific, weeks of disruption at Hasbro and attacks on more than 100 US water facilities.
Are all cyberattacks data breaches?
No. Many attacks steal no data at all. Ransomware outages, wiper attacks and attacks on industrial systems stop a business from operating, which can cost more than a data breach.
What is the biggest data breach in history?
By number of accounts, the Yahoo breaches are among the largest ever recorded. In healthcare, the 2024 Change Healthcare breach, affecting about 192.7 million people, is the largest in US history.
What is the most common cause of major cyberattacks?
Stolen credentials on accounts without multifactor authentication and unpatched software are behind a large share of major incidents, followed by social engineering and supplier compromises.
When was Canva hacked?
Canva detected the attack on 24 May 2019. The hacker claimed data on about 139 million users, and Canva urged users to change their passwords.
Can small businesses learn from big breaches?
Yes. The same basic failures, such as missing MFA, unpatched websites and weak backups, cause most breaches at small businesses too, and they are inexpensive to fix.
Conclusion
From Yahoo in 2014 to Stryker and Boston Scientific in 2026, the biggest cyberattacks were rarely caused by unstoppable, sophisticated techniques. They succeeded because of missing patches, passwords without MFA, trusted suppliers and people who were tricked. Fix those basics, practise your response and you remove most of the risk that brought down far larger organizations. Start with the free readiness check.
