Cyber Attacks 2026: 40 Public-Company Attacks, 612 Health Breaches and a 136-Day Wait for Victims
Cyber attacks 2026, counted from primary filings: from January 1 to October 29, 40 public companies disclosed a new cyber attack in an SEC Form 8-K, healthcare organizations reported 612 breaches of 500 or more records to HHS through October 8 (86% hacking), and the largest single incident, at DentaQuest, affected between 15.0 million and 27.4 million people. Investors heard within a median 8 days. Victims waited a median 136.
This ledger is built the other way round from a news roundup: every incident below links to the document where the victim organization or its regulator reported it. We pulled every 2026 Form 8-K on SEC EDGAR that discloses a cyber incident, the HHS Office for Civil Rights breach portal, the breach lists published by the Washington, Indiana, Massachusetts and California attorneys general, and every CISA joint cybersecurity advisory released this year. Where a document names an attack type or a vendor, we record it. Where it does not, we say so.
How many cyber attacks were disclosed each month in 2026?
No official body counts all cyber attacks, so the honest answer is a set of counts, one per disclosure channel. From January to September, HHS breaches ranged from 50 to 79 a month, while Massachusetts notices rose from 148 in January to 214 in September. The public-company series peaked in July with 9 8-K attack disclosures; HHS peaked in July with 79 breaches. October is partial in every series (shaded).
SEC: first 8-K about a new incident, by filing date. HHS: breach submission date, records through October 8. California: date posted by the attorney general. Massachusetts: date reported to the Office of Consumer Affairs and Business Regulation, through October 27. Hover a bar for the exact figure.
Against the same window of 2025, the HHS count is slightly lower (612 vs 637) while hacking incidents are flat (525 vs 522); people affected fell from 135.8 million to 87.6 million. Our healthcare data breach report has the full HHS history back to 2009.
The 2026 cyber attack timeline, month by month
SEC 8-K disclosure (links to the filing) breach notice covering 1 million+ people CISA joint advisory
0 8-K attack disclosures · 67 HHS breaches · 54 California notices · 148 Massachusetts notices
- Insightin Health 1.9 million people: Hacking/IT incident (HHS); Ransomware (WA AG), vendor involved.
1 8-K attack disclosures · 72 HHS breaches · 44 California notices · 161 Massachusetts notices
- UFP Technologies 24 Feb, Item 1.05: Detected suspicious activity; certain data appear to have been stolen or destroyed and files were exfiltrated; billing and label making affected.
- TriZetto Provider Solutions 3.4 million people: Hacking/IT incident (HHS); Unauthorized access (WA AG), vendor involved.
- QualDerm Partners 3.0 million people: Hacking/IT incident (HHS); Ransomware (WA AG).
4 8-K attack disclosures · 78 HHS breaches · 45 California notices · 185 Massachusetts notices
- Stryker 11 Mar, Item 8.01: Global disruption to its Microsoft environment; a later update says the threat actor used a malicious file to hide its activity. Amended under Item 1.05 on April 9 as material to Q1 results.
- Trio-Tech International 20 Mar, Item 1.05: Ransomware encrypted files at a Singapore subsidiary; data was disclosed without authorization on March 18.
- Heritage Financial 23 Mar, Item 8.01: Files exfiltrated from an internal file share server; customer systems not affected.
- CareCloud 27 Mar, Item 1.05: An unauthorized third party disrupted one of six electronic health record environments for about 8 hours.
- CareCloud 3.8 million people: Hacking/IT incident (HHS); Unauthorized access (WA AG); Unauthorized access (SEC), vendor involved.
- Nacogdoches Memorial Hospital 2.5 million people: Hacking/IT incident (HHS).
- Navia Benefit Solutions 2.2 million people: Hacking/IT incident (HHS); Cyberattack (WA AG), vendor involved.
- New York City Health and Hospitals 1.8 million people: Hacking/IT incident (HHS).
- Kaplan North America 1.4 million people: Ransomware (WA AG).
6 8-K attack disclosures · 50 HHS breaches · 42 California notices · 181 Massachusetts notices
- Hasbro 1 Apr, Item 8.01: Unauthorized access to the network; systems taken offline and business continuity plans used for orders and shipping.
- Bitcoin Depot 8 Apr, Item 1.05: Attacker took control of settlement-account credentials and moved about 50.9 bitcoin (about $3.67 million).
- RCI Hospitality 13 Apr, Item 8.01: An insecure direct object reference flaw on a web server exposed contractor personal data.
- ADT 24 Apr, Item 8.01: Unauthorized access to certain cloud-based environments; limited customer and prospect data accessed.
- Itron 24 Apr, Item 8.01: Unauthorized third party gained access to certain systems; a May update found limited access to customer-hosted systems.
- Medtronic 27 Apr, Item 7.01: Unauthorized third party accessed data in certain IT systems; no product or patient-safety impact identified.
- Medtronic 3.8 million people: Cyberattack (WA AG); Unauthorized access, data stolen (SEC).
- CISA AA26-097A 7 Apr: Iranian-affiliated actors disrupt internet-exposed PLCs across U.S. critical infrastructure.
- CISA AA26-113A 23 Apr: China-nexus covert networks of compromised devices.
4 8-K attack disclosures · 66 HHS breaches · 46 California notices · 206 Massachusetts notices
- SailPoint 8 May, Item 7.01: Unauthorized access to a subset of GitHub repositories through a third-party application vulnerability.
- West Pharmaceutical Services 11 May, Item 1.05: Data exfiltrated and certain systems encrypted; systems taken offline globally.
- The Oncology Institute 22 May, Item 1.05: A software vendor’s incident reached company systems holding patient data; first disclosed as a vendor incident in November 2025.
- Orrstown Financial Services 29 May, Item 8.01: A vendor’s incident exposed sensitive personal information of certain customers.
- Carnival 6.0 million people: Unauthorized access (WA AG).
- Lumexa Imaging 5.8 million people: Hacking/IT incident (HHS); Cyberattack (WA AG).
- Strategic Education 1.5 million people: Cyberattack (WA AG).
5 8-K attack disclosures · 70 HHS breaches · 42 California notices · 188 Massachusetts notices
- Evertec 9 Jun, Item 8.01: Unauthorized party obtained financial institution clients’ transaction records and card numbers through a third-party support platform.
- Popular 9 Jun, Item 8.01: Customer debit card numbers exposed in the Evertec incident; Popular’s own systems were not accessed.
- iRhythm 15 Jun, Item 1.05: Data taken from third-party-hosted business applications through social engineering; the threat actor demanded payment.
- 8×8 23 Jun, Item 1.05: Threat actor exploited a third-party integration connected to Salesforce and exfiltrated customer contact and sales data.
- River Financial 25 Jun, Item 1.05: Threat actor entered on or about June 16; ransomware deployed across parts of the server environment.
- iRhythm Technologies 8.2 million people: Hacking/IT incident (HHS); Phishing (WA AG); Social engineering, extortion (SEC), vendor involved.
- AssuranceAmerica Managing General Agency 7.0 million people: Phishing (WA AG).
- Xsolis 2.5 million people: Hacking/IT incident (HHS); Unauthorized access (WA AG), vendor involved.
- MCBS 1.3 million people: Hacking/IT incident (HHS), vendor involved.
9 8-K attack disclosures · 79 HHS breaches · 49 California notices · 201 Massachusetts notices
- AdaptHealth 2 Jul, Item 1.05: A social engineering attack compromised a user session; data, including a password file, exfiltrated from cloud business applications.
- Navient 2 Jul, Item 1.05: Ransomware attack on a law firm serving Navient exposed borrower names, birth dates, addresses and Social Security numbers.
- SR Bancorp 10 Jul, Item 8.01: An unauthorized actor acquired files containing bank customer data from its audit firm’s servers.
- Coca-Cola (fairlife) 16 Jul, Item 8.01: Unauthorized access to fairlife systems, including production systems, in connection with a ransomware event.
- Clover Health 17 Jul, Item 8.01: Threat actor gained access to three employee accounts through social engineering.
- Five Below 22 Jul, Item 8.01: Social engineering gave access to one employee computer; files exfiltrated.
- Analog Devices 29 Jul, Item 8.01: Unauthorized access to certain systems; files exfiltrated; operations not interrupted.
- HealthStream 29 Jul, Item 8.01: Unauthorized third party accessed part of the corporate file server; no evidence of encryption.
- Amgen 31 Jul, Item 1.05: Data, including patient health information, exfiltrated from cloud environments hosted by third-party providers.
- DentaQuest 27.4 million people: Hacking/IT incident (HHS); Phishing (WA AG).
- Aesto 9.5 million people: Hacking/IT incident (HHS); Unauthorized access (WA AG), vendor involved.
- AdaptHealth 4.1 million people: Hacking/IT incident (HHS); Cyberattack (WA AG); Social engineering, data stolen (SEC).
- Unlimited Technology Systems 3.8 million people: Hacking/IT incident (HHS); Ransomware (WA AG), vendor involved.
- CISA AA26-194A 13 Jul: Russian FSB Center 16 actors exploit poorly configured network devices.
- CISA AA26-204A 23 Jul: Russian state-supported phishing campaign against Zimbra Collaboration Suite users.
5 8-K attack disclosures · 52 HHS breaches · 50 California notices · 200 Massachusetts notices
- IEH Corp 6 Aug, Item 8.01: Phishing link to a fake Microsoft login led to a compromised Microsoft 365 mailbox.
- Levi Strauss 7 Aug, Item 8.01: Social engineering enabled access to three employees’ computers; corporate information exfiltrated.
- Nutex Health 24 Aug, Item 8.01: Data exfiltrated from company servers; the third party threatened to post it. Moved to Item 1.05 on August 31.
- Boston Scientific 26 Aug, Item 8.01: Global disruption to operations; filed under Item 1.05 on September 8 as likely material to Q3 and full-year results.
- McKesson 28 Aug, Item 7.01: Cybersecurity incident affecting information systems; investigation in early stages at filing.
- Heights Finance Holdings 4.1 million people: Not stated in the Indiana list.
- Baylor Genetics 2.8 million people: Hacking/IT incident (HHS); Ransomware (WA AG).
- CISA AA26-222A 10 Aug: #StopRansomware: Gunra ransomware-as-a-service.
- CISA AA26-231A 19 Aug: Active threat to Siemens S7 series PLCs.
5 8-K attack disclosures · 62 HHS breaches · 55 California notices · 214 Massachusetts notices
- Park Dental Partners 1 Sep, Item 1.05: Unauthorized access to its network; patient health information confirmed acquired in an October update.
- NovoCure 1 Sep, Item 8.01: Unauthorized access to some information systems at a subsidiary; limited patient and staff data exposed.
- Veradigm 8 Sep, Item 8.01: Credentials stolen from a vendor’s environment were used to download patient personal data through a company API.
- CenterPoint Energy 14 Sep, Item 8.01: After an online claim, the company confirmed an unauthorized third party obtained customer data through an external-facing system.
- Astrana Health 23 Sep, Item 1.05: Threat actors impersonated staff and spoofed the main phone number to obtain access.
- CISA AA26-251A 8 Sep: China-based AI companies run industrial-scale distillation campaigns against U.S. AI models.
1 8-K attack disclosures · 16 HHS breaches · 53 California notices · 176 Massachusetts notices (partial)
- Quest Diagnostics 22 Oct, Item 8.01: Unauthorized access to the Quanum LSM ordering and results system; certain patient records accessed.
- CISA AA26-281A 8 Oct: Chinese government-linked actors (Integrity Technology Group) combine botnets and hands-on hacking to steal data.
- CISA AA26-293A 20 Oct: #StopRansomware: SafePay ransomware.
Breach notices are placed in the month of their earliest 2026 public record (HHS submission, Indiana consumer notice, Washington AG notice or SEC filing). Many describe intrusions that began in 2025. Sources for each large notice are in the table below.
The largest cyber attacks of 2026 by people affected
Ranked by the larger of the counts reported to HHS and to Indiana’s attorney general, the two 2026 sources that publish a nationwide total. 9 of the 22 incidents above 1 million people involved a vendor, and 8 of those were reported by or for HIPAA business associates, the vendors that handle patient data for providers and health plans. Where regulators disagree, both figures are shown: DentaQuest told HHS 15,000,000 and Indiana 27,400,000.
| # | Organization | People affected | First 2026 record | Cause as stated | Vendor | Sources |
|---|---|---|---|---|---|---|
| 1 | DentaQuest | 27,400,000HHS 15,000,000; Indiana 27,400,000 | Jul 16 | Hacking/IT incident (HHS); Phishing (WA AG) | No | HHS IN WA |
| 2 | AestoIndiana notice filed by Grant Co Public Hospital District #2 dba Quincy Valley Med Ctr | 9,540,683 | Jul 31 | Hacking/IT incident (HHS); Unauthorized access (WA AG) | Yes | HHS IN WA |
| 3 | iRhythm Technologies | 8,179,772 | Jun 15 | Hacking/IT incident (HHS); Phishing (WA AG); Social engineering, extortion (SEC) | Yes | HHS WA SEC |
| 4 | AssuranceAmerica Managing General Agency | 6,998,886 | Jun 17 | Phishing (WA AG) | No | IN WA |
| 5 | Carnival | 5,995,277 | May 27 | Unauthorized access (WA AG) | No | IN WA |
| 6 | Lumexa Imaging | 5,830,949 | May 15 | Hacking/IT incident (HHS); Cyberattack (WA AG) | No | HHS WA |
| 7 | Heights Finance Holdings | 4,132,834 | Aug 11 | Not stated in the Indiana list | No | IN |
| 8 | AdaptHealth | 4,115,802 | Jul 2 | Hacking/IT incident (HHS); Cyberattack (WA AG); Social engineering, data stolen (SEC) | No | HHS WA SEC |
| 9 | Unlimited Technology Systems | 3,836,316 | Jul 21 | Hacking/IT incident (HHS); Ransomware (WA AG) | Yes | HHS IN WA |
| 10 | Medtronic | 3,834,294 | Apr 27 | Cyberattack (WA AG); Unauthorized access, data stolen (SEC) | No | IN WA SEC |
| 11 | CareCloud | 3,756,469 | Mar 27 | Hacking/IT incident (HHS); Unauthorized access (WA AG); Unauthorized access (SEC) | Yes | HHS WA SEC |
| 12 | TriZetto Provider Solutions | 3,433,965 | Feb 6 | Hacking/IT incident (HHS); Unauthorized access (WA AG) | Yes | HHS IN WA |
| 13 | QualDerm Partners | 2,951,318 | Feb 22 | Hacking/IT incident (HHS); Ransomware (WA AG) | No | HHS WA |
| 14 | Baylor Genetics | 2,810,878 | Aug 14 | Hacking/IT incident (HHS); Ransomware (WA AG) | No | HHS WA |
| 15 | Xsolis | 2,523,302HHS 1,396,519; Indiana 2,523,302 | Jun 5 | Hacking/IT incident (HHS); Unauthorized access (WA AG) | Yes | HHS IN WA |
| 16 | Nacogdoches Memorial Hospital | 2,507,073HHS 2,507,073; Indiana 257,073 | Mar 12 | Hacking/IT incident (HHS) | No | HHS IN |
| 17 | Navia Benefit Solutions | 2,151,330 | Mar 18 | Hacking/IT incident (HHS); Cyberattack (WA AG) | Yes | HHS WA |
| 18 | Insightin Health | 1,949,534 | Jan 16 | Hacking/IT incident (HHS); Ransomware (WA AG) | Yes | HHS WA |
| 19 | New York City Health and Hospitals | 1,800,000 | Mar 24 | Hacking/IT incident (HHS) | No | HHS |
| 20 | Strategic Education | 1,513,518 | May 29 | Cyberattack (WA AG) | No | IN WA |
HHS = HHS OCR breach portal; IN = Indiana Attorney General 2026 year-to-date breach report; WA = Washington Attorney General breach notices; SEC = Form 8-K. “Vendor” is Yes when HHS lists a business associate or the entity is one, or an 8-K says the incident occurred at or through a third party. Counts are as reported and can be revised. One person can appear in several breaches. The 1 million+ count above is 22 after merging records that describe the same incident.
Two patterns stand out. First, the vendor breaches are large because one vendor serves many clients: the Aesto record appears in Indiana’s list under a hospital district (Quincy Valley Medical Center) with the identical 9,540,683 total. Second, many of 2026’s largest notices describe 2025 intrusions. 51% of the 2026 notices in Indiana’s list give a breach date before 2026. For the consumer-data side of these incidents, see our data breach statistics for 2026, built from Have I Been Pwned.
Which sectors reported the most cyber attacks in 2026?
Public companies, 8-K attack disclosures
40 companies, sector assigned from the filing and SEC industry code.
Washington notices from cyberattacks or unauthorized access
Dark segment: ransomware. 157 notices filed in 2026 through Oct 13, each affecting 500+ Washington residents.
Healthcare is overrepresented in the public record because HIPAA requires health organizations to report breaches affecting 500 or more people to HHS, which posts them. In the HHS file, 450 of the 612 2026 breaches were reported by providers, 91 by business associates and 71 by health plans. Among public companies, banks and other financial firms filed the most 8-K attack disclosures (8), and medical device makers had the most disruptive ones: Stryker and Boston Scientific both reported global operational disruption and both later judged the incident material. Massachusetts, which lists every notice regardless of size, recorded 1,860 notices through October 27, led by financial services firms (282), health care (260) and banks and credit unions (192).
What types of cyber attacks dominated 2026?
Washington: type of cyberattack
107 notices the AG classed as cyberattacks. A further 50 were classed as unauthorized access.
SEC 8-Ks: how the filing describes it
One category per filing, from the company’s own words.
Ransomware is the single most common named attack type, at 60% of Washington’s 2026 cyberattack notices; our ransomware statistics for 2026 track the leak-site side of the same trend. Public-company filings tell a different story because they describe the entry point. 7 of the 40 8-Ks name social engineering or phishing, including iRhythm, AdaptHealth, Clover Health, Five Below, Levi Strauss and Astrana Health, where attackers impersonated staff and spoofed the company’s main phone number. Only 5 say systems were encrypted. HHS does not break hacking down further: 85.8% of its 2026 breaches are simply “Hacking/IT Incident”.
How long did it take to disclose a 2026 cyber attack?
Public companies move fastest because the SEC rule gives four business days from a materiality decision. Across the 31 2026 filings that state a detection date, the median gap to the first 8-K was 8 days; the longest was 36. Consumer notices are slower by an order of magnitude. In Indiana’s list, the median gap between the breach and the notice was 136 days, and 36% of notices took more than six months. Washington’s notices arrived a median 99.5 days after the organization learned of the breach, and 142 days after the breach began. Our tracker of every SEC Item 1.05 filing covers the material-incident subset back to 2023.
Every public-company cyber attack disclosed on Form 8-K in 2026
40 companies filed a first 8-K about a new cyber attack between January 1 and October 29. 17 of them reported under Item 1.05 (material incident) at some point, including Stryker, Boston Scientific and Nutex Health, which first filed under Item 8.01. The rest used Item 8.01 or 7.01; Item 1.05 is for incidents a company has determined to be material. One further Item 1.05 filing, CB Financial Services, described internal handling of customer data in an unauthorized AI tool rather than an attack, so it is excluded from the attack counts.
| Company | First 8-K (2026) | Detected | Item 1.05 | Sector | Attack as described | Vendor or third party |
|---|---|---|---|---|---|---|
| UFP Technologies | 02-24 | 02-14 | Yes | Medical devices | Unauthorized access, data stolen | None stated |
| Stryker | 03-11 | 03-11 | Yes | Medical devices | Disruptive intrusion | None stated |
| Trio-Tech International | 03-20 | 03-11 | Yes | Manufacturing | Ransomware | None stated |
| Heritage Financial | 03-23 | 03-02 | No | Banking and finance | Unauthorized access, data stolen | None stated |
| CareCloud | 03-27 | 03-16 | Yes | Health IT and services | Unauthorized access | None stated |
| Hasbro | 04-01 | 03-28 | No | Consumer products and retail | Unauthorized access | None stated |
| Bitcoin Depot | 04-08 | 03-23 | Yes | Banking and finance | Unauthorized access, funds stolen | None stated |
| RCI Hospitality | 04-13 | 03-23 | No | Consumer products and retail | Web application vulnerability | None stated |
| ADT | 04-24 | 04-20 | No | Technology and telecom | Unauthorized access | None stated |
| Itron | 04-24 | 04-13 | No | Technology and telecom | Unauthorized access | None stated |
| Medtronic | 04-27 | 04-24 | No | Medical devices | Unauthorized access, data stolen | None stated |
| SailPoint | 05-08 | 04-20 | No | Technology and telecom | Unauthorized access via third-party app | Vulnerability in a third-party application |
| West Pharmaceutical Services | 05-11 | 05-04 | Yes | Pharma and biotech | Ransomware (encryption and data theft) | None stated |
| The Oncology Institute | 05-22 | 05-20 | Yes | Healthcare providers | Unauthorized access at vendor | Software service provider |
| Orrstown Financial Services | 05-29 | 05-21 | No | Banking and finance | Unauthorized access at vendor | Third-party vendor |
| Evertec | 06-09 | 05-13 | No | Banking and finance | Unauthorized access via third-party platform | Third-party support platform |
| Popular | 06-09 | 05-15 | No | Banking and finance | Unauthorized access at vendor | Evertec (processor) |
| iRhythm | 06-15 | 06-08 | Yes | Medical devices | Social engineering, extortion | Third-party-hosted business applications |
| 8×8 | 06-23 | 06-13 | Yes | Technology and telecom | Unauthorized access via third-party integration | Klue integration to Salesforce |
| River Financial | 06-25 | 06-19 | Yes | Banking and finance | Ransomware | None stated |
| AdaptHealth | 07-02 | 06-15 | Yes | Healthcare providers | Social engineering, data stolen | None stated |
| Navient | 07-02 | 06-08 | Yes | Banking and finance | Ransomware at vendor | Third-party law firm |
| SR Bancorp | 07-10 | Not stated | No | Banking and finance | Unauthorized access at vendor | Mercadien, P.C. CPAs (internal audit) |
| Coca-Cola (fairlife) | 07-16 | 07-16 | No | Food and beverage | Ransomware | None stated |
| Clover Health | 07-17 | 07-04 | No | Insurance | Social engineering | None stated |
| Five Below | 07-22 | 07-15 | No | Consumer products and retail | Social engineering, data stolen | None stated |
| Analog Devices | 07-29 | 06-23 | No | Manufacturing | Unauthorized access, data stolen | None stated |
| HealthStream | 07-29 | Not stated | No | Health IT and services | Unauthorized access, data stolen | None stated |
| Amgen | 07-31 | Not stated | Yes | Pharma and biotech | Unauthorized access, data stolen | Cloud environments hosted by third-party providers |
| IEH Corp | 08-06 | 08-04 | No | Manufacturing | Phishing | None stated |
| Levi Strauss | 08-07 | Not stated | No | Consumer products and retail | Social engineering, data stolen | None stated |
| Nutex Health | 08-24 | Not stated | Yes | Healthcare providers | Unauthorized access, extortion | None stated |
| Boston Scientific | 08-26 | 08-25 | Yes | Medical devices | Disruptive intrusion | None stated |
| McKesson | 08-28 | 08-25 | No | Health IT and services | Not stated | None stated |
| Park Dental Partners | 09-01 | 08-28 | Yes | Healthcare providers | Unauthorized access | None stated |
| NovoCure | 09-01 | Not stated | No | Medical devices | Unauthorized access | None stated |
| Veradigm | 09-08 | Not stated | No | Health IT and services | Unauthorized access at vendor | Third-party vendor credentials |
| CenterPoint Energy | 09-14 | Not stated | No | Utilities | Unauthorized access, data stolen | None stated |
| Astrana Health | 09-23 | Not stated | Yes | Healthcare providers | Social engineering | None stated |
| Quest Diagnostics | 10-22 | 10-21 | No | Healthcare providers | Unauthorized access | None stated |
Dates are month-day in 2026. “Detected” is the date the filing gives for detection or notification, where it states one. Evertec and Popular describe the same incident and are counted once each as filers.
Campaigns named in 2026 CISA joint advisories
CISA and partner agencies released 10 joint cybersecurity advisories in 2026 through October 29. Nine describe an active campaign or threat; the tenth (AA26-237A) reports red team findings. Attribution below is exactly as stated in each advisory.
| Advisory | Released | Campaign | Target | Attribution (per advisory) |
|---|---|---|---|---|
| AA26-097A | 04-07 | Iranian-affiliated actors disrupt internet-exposed PLCs across U.S. critical infrastructure | OT / ICS | Iran-affiliated (per advisory) |
| AA26-113A | 04-23 | China-nexus covert networks of compromised devices | Edge devices | China-nexus (per advisory) |
| AA26-194A | 07-13 | Russian FSB Center 16 actors exploit poorly configured network devices | Network devices | Russia, FSB Center 16 (per advisory) |
| AA26-204A | 07-23 | Russian state-supported phishing campaign against Zimbra Collaboration Suite users | Phishing / email | Russia, LAUNDRY BEAR (per advisory) |
| AA26-222A | 08-10 | #StopRansomware: Gunra ransomware-as-a-service | Ransomware | Ransomware-as-a-service affiliates (per advisory) |
| AA26-231A | 08-19 | Active threat to Siemens S7 series PLCs | OT / ICS | Not named in the summary |
| AA26-251A | 09-08 | China-based AI companies run industrial-scale distillation campaigns against U.S. AI models | AI model extraction | China-based companies (per advisory) |
| AA26-281A | 10-08 | Chinese government-linked actors (Integrity Technology Group) combine botnets and hands-on hacking to steal data | Exchange, VPN, web apps | China, Integrity Technology Group (per advisory) |
| AA26-293A | 10-20 | #StopRansomware: SafePay ransomware | Ransomware | SafePay ransomware group (per advisory) |
What this means for MSPs
- Treat vendor access as attack surface. 35% of 2026 HHS breaches involved a business associate, and 9 of the 22 incidents above 1 million people involved a vendor. An MSP that handles patient data for a health client falls in the same business associate category. Keep a current list of every vendor and integration that holds client data, and get breach-notice terms (hours, not weeks) into those contracts.
- Audit SaaS integrations, not just endpoints. 8×8 lost CRM data through a third-party integration connected to Salesforce, SailPoint had GitHub repositories accessed through a flaw in a third-party application, and card data held by Evertec’s bank clients was taken through a third-party support platform. Inventory OAuth apps and API keys connected to client CRMs, code repositories and ticketing systems, and remove the ones nobody owns.
- Harden the help desk against impersonation. 7 of 40 public-company attacks started with social engineering or phishing. Require call-back or in-person verification before any password or MFA reset, and never trust caller ID: Astrana’s attackers spoofed the company’s own number.
- Plan for ransomware recovery, not just prevention. Ransomware was 60% of Washington’s 2026 cyberattack notices. Test restores from offline, immutable backups on a schedule, and segment networks so one compromised device cannot reach everything; CISA’s Gunra advisory lists the same steps.
- Run the notification clock for clients. The typical consumer notice in 2026 went out four to five months after the breach. Build a notification runbook per client state, and log detection dates carefully: a public client may have four business days once it decides an incident is material.
- Take PLCs off the internet. Two 2026 advisories (AA26-097A and AA26-231A) describe active targeting of programmable logic controllers, and both tell owners to keep PLCs off the internet. Manufacturing, water and building-automation clients should confirm none are directly reachable.
Frequently asked questions
What are the biggest cyber attacks of 2026?
By people affected, the largest 2026 disclosures are DentaQuest (15.0 million in its HHS filing and 27.4 million in its Indiana notice), the Aesto vendor breach (9.5 million), iRhythm Technologies (8.2 million), AssuranceAmerica Managing General Agency (7.0 million) and Carnival (6.0 million). 22 separate 2026 disclosures in the HHS and Indiana records each affected more than 1 million people.
How many cyber attacks have there been in 2026?
There is no single official count. From January 1 to October 29, 2026, 40 public companies disclosed a new cyber attack in a Form 8-K, healthcare organizations reported 612 breaches of 500 or more records to HHS through October 8, and California’s attorney general posted 480 breach notices. Each source covers a different slice.
What is the most common type of cyber attack in 2026?
Ransomware, where the filing says. In Washington’s breach notices filed in 2026, 64 of 107 cyberattacks (60%) were ransomware, followed by phishing (11). Among SEC 8-K disclosures, 7 of 40 describe social engineering or phishing and 5 describe ransomware or encrypted systems.
Which industries are hit most by cyber attacks in 2026?
Healthcare dominates the public record because HIPAA requires breaches of 500 or more people to be reported to HHS: 612 so far. Among public companies, banking and finance (8) and medical device makers (6) filed the most 8-K attack disclosures. In Washington, business (70) and health care (47) led notices from cyberattacks or unauthorized access.
How long does it take to disclose a cyber attack?
It depends on who is being told. Public companies filed their first 8-K a median 8 days after the detection date they stated. Consumer notices took far longer: a median 136 days from breach to notice in Indiana’s 2026 list and 150 days from breach to posting in California’s.
How many 2026 cyber attacks involved a vendor?
35% of 2026 HHS breaches (215 of 612) list a business associate, covering 39% of people affected. In SEC filings, 11 of 40 attacks happened at a vendor or came through a third-party application, platform or hosted environment.
Methodology
What counts. A cyber attack disclosed in 2026 is an incident first made public between January 1 and October 29, 2026 in one of these primary records. We do not add incidents known only from news reports, vendor blogs or leak sites.
SEC. EDGAR full-text search for 27 incident phrases (for example “cybersecurity incident”, “ransomware”, “threat actor”, “unauthorized access”, “exfiltrated”) across Forms 8-K and 8-K/A filed January 1 to October 29, 2026, month by month. We downloaded 514 candidate filing documents with Items 1.05, 8.01 or 7.01, kept those whose item text describes a specific incident, and read each one. Attack type, detection date and vendor involvement are recorded only as the filing states them. Wytec, Conduent and Inotiv filings about 2025 incidents and boilerplate risk language are excluded. Our 2026 original Item 1.05 filings through September 23 (17, counting CB Financial) match the list in our separate Item 1.05 tracker.
HHS. The HHS Office for Civil Rights breach portal (“under investigation” list exported October 30, 2026, with records through October 8), combined with the archive and current lists exported October 12, 2026, so that 2026 breaches already closed and archived are included. Deduplicated by entity name and submission date.
States. Washington Attorney General notices (data.wa.gov dataset sb4j-ca4h, notices affecting 500+ residents, with cause and cyberattack type). Indiana Attorney General 2026 year-to-date breach report (PDF; breach date, notice date, Indiana and total people affected). Massachusetts OCABR 2026 data breach notification report (PDF; organization type and residents affected). California Attorney General breach list (CSV export; breach dates and posting date). Maine’s public breach database, often used for nationwide totals, has been offline since its attorney general reported hoax filings on June 12, 2026, so it is not used.
CISA. Every 2026 joint Cybersecurity Advisory (AA26 series), from the CISA advisories feed plus a check of every advisory ID from January through April.
Limitations. These channels overlap and none is complete: private companies outside healthcare report only to states, thresholds differ (HHS 500 records, Washington 500 residents, California 500 residents, Massachusetts any resident), and people-affected figures are often revised. Merging across sources uses organization names and identical totals, so some incidents may be split or merged imperfectly. October is partial everywhere. Lag figures use only records that state both dates.
Not advice. This is a record of public filings. A listing does not imply fault by any organization.
Cite as:The Uptime Report. "Cyber Attacks 2026: 40 Public-Company Attacks, 612 Health Breaches and a 136-Day Wait for Victims." October 2026. https://theuptimereport.com/cyber-attacks-2026/
References
- SEC EDGAR full-text search, Forms 8-K and 8-K/A, 2026. Accessed October 2026.
- U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal. Accessed October 2026.
- Washington State Attorney General, Data Breach Notifications Affecting Washington Residents (data.wa.gov). Accessed October 2026.
- Indiana Attorney General, Data Breach Year-to-Date Report 2026. Accessed October 2026.
- Massachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report. Accessed October 2026.
- California Attorney General, Search Data Security Breaches. Accessed October 2026.
- Maine Attorney General, Statement on Abuse of Data Breach Reporting System, June 12, 2026. Accessed October 2026.
- CISA, Cybersecurity Advisories (AA26-097A, AA26-113A, AA26-194A, AA26-204A, AA26-222A, AA26-231A, AA26-237A, AA26-251A, AA26-281A, AA26-293A). Accessed October 2026.
- Each company’s Form 8-K, linked in the table above (SEC EDGAR). Accessed October 2026.
Leave a Reply