The worst data breaches of 2026 so far

Key Takeaways

• DOGE allegedly uploaded Social Security data for most living Americans to an unsecured server, potentially the largest government data breach in US history
• Iranian hackers have shifted from espionage to destructive attacks, wiping tens of thousands of devices at medical tech company Stryker
• Critical infrastructure including water systems and power grids across Europe and the US face escalating nation-state cyberattacks

Six months into 2026, the cybersecurity situation looks grim. Nation-state hackers are wiping corporate devices. Government operatives may have exposed Social Security numbers for most living Americans. Water treatment plants and power grids face relentless attacks. The breaches keep getting bigger, bolder, and more destructive.

TechCrunch has catalogued the worst incidents so far. The common thread: attackers are no longer content with stealing data. They want to cause real-world damage, whether that means disrupting medical device companies, threatening democratic institutions, or holding entire supply chains hostage.

Did DOGE cause the largest government data breach in history?

The most alarming incident may have come from inside the government itself. According to whistleblower claims now being litigated in federal court, operatives from the Department of Government Efficiency (DOGE) uploaded a live copy of the Social Security Administration's database to an unsecured third-party server.

If true, that database contains Social Security numbers and personal information for the majority of living Americans. The SSA itself doesn't know exactly what was stored on the server, according to court filings. What it does know: DOGE signed an agreement with an outside political advocacy group, ostensibly to search for voter fraud, which President Trump continues to claim without evidence.

Two senior House Democrats investigating DOGE's activities called this exposure "the largest data breach in our nation's history." The full scope remains unclear as lawsuits continue. But the implications are stark. This wasn't sophisticated hackers breaking in. It was government officials potentially mishandling the data they were entrusted to protect.

Iran shifts from espionage to destruction

Iranian hackers hit U.S. medical technology company Stryker in March with a coordinated attack that remotely wiped tens of thousands of employee devices simultaneously. Operations ground to a halt for several days. The breach had a material impact on Stryker's first-quarter earnings.

The U.S. government attributed the attack to an arm of Iranian intelligence. More significant than the breach itself is what it signals. Iran has historically focused on espionage and hack-and-leak operations designed to serve political goals. The Stryker attack was pure destruction, apparently in retaliation for the ongoing U.S.-Israel military actions against Iran.

This tactical shift matters for every company with potential exposure to geopolitical tensions. Iranian hackers aren't just looking for secrets anymore. They're looking to cause pain.

Water systems and power grids under sustained attack

A wave of cyberattacks across Europe has targeted civilian infrastructure in ways that risk genuine harm to populations. Poland's energy grid was hit with device-destroying malware late last year. A Swedish thermal plant and a Norwegian dam were compromised. The dam attack released swimming pools' worth of water before operators regained control.

Poland got hit again earlier this year, this time at water treatment plants. Most of these attacks trace back to Russia or Russian-affiliated groups, part of what security researchers describe as "hybrid warfare" that extends beyond conventional military operations.

Now similar attacks are reaching American shores. Iranian hackers have begun targeting U.S. critical infrastructure, including privately owned water utilities. These remain soft targets. Many lack basic cybersecurity protections, run outdated systems, and have minimal security staff. The combination of sophisticated nation-state attackers and unsophisticated defenders creates obvious risks.

Klue breach ripples through 200 companies

Market research provider Klue sat at the center of one of the year's broadest data breaches, affecting nearly 200 companies. The victim list included cybersecurity firms like Jamf, HackerOne, and LastPass, which is an uncomfortable irony given their business.

Klue reportedly reached a deal with its hackers, but still lost control of customer data. The incident highlights a growing problem: supply chain attacks that compromise one vendor can cascade through hundreds of downstream organizations. Your security is only as strong as your weakest vendor's.

What's driving the escalation?

Several factors are converging. Geopolitical conflicts have moved decisively into cyberspace. Nation-states that once limited themselves to espionage now conduct destructive attacks against civilian targets. The line between military and civilian infrastructure blurs when hackers can reach water plants and hospitals as easily as government networks.

Ransomware remains brutally effective. Despite years of warnings, many organizations still lack basic protections: network segmentation, offline backups, multi-factor authentication, incident response plans. Attackers know this. They also know that critical infrastructure operators often pay because they can't afford downtime.

Meanwhile, the attack surface keeps expanding. Remote work, cloud services, third-party vendors, IoT devices. Each new connection creates new vulnerabilities. Security teams struggle to keep pace while attackers only need to find one gap.

What comes next?

The second half of 2026 will likely bring more of the same, possibly worse. Iranian attacks on U.S. infrastructure may intensify if the Middle East conflict continues. Russian hybrid warfare shows no signs of abating. And the DOGE situation remains unresolved, with potential political ramifications that could shape data governance policy for years.

The uncomfortable reality: most organizations are playing defense against adversaries with significant resources and few constraints. No amount of technology spending eliminates that asymmetry. What it can do is raise the cost of attack and improve recovery time when breaches inevitably occur.

Frequently Asked Questions

What is the DOGE Social Security breach?

Whistleblowers allege that operatives from the Department of Government Efficiency uploaded a live copy of the Social Security database to an unsecured third-party server. If confirmed, it would expose Social Security numbers for most living Americans and could be the largest government data breach in U.S. history.

Why are nation-state hackers targeting water systems?

Water utilities are often soft targets with outdated systems and minimal security staff. Attacking civilian infrastructure causes public fear and disruption while being difficult to attribute definitively, making it an attractive tactic for hybrid warfare.

How did Iranian hackers attack Stryker?

Iranian hackers remotely wiped tens of thousands of Stryker employee devices simultaneously, disrupting operations for several days and affecting first-quarter earnings. The U.S. government attributed the attack to Iranian intelligence.

What was the Klue data breach?

Market research provider Klue was compromised in a breach that affected nearly 200 companies, including cybersecurity firms Jamf, HackerOne, and LastPass. Klue reportedly negotiated with the hackers but still lost control of customer data.

How can organizations protect against destructive cyberattacks?

Prioritize resilience over detection: maintain immutable offline backups, segment networks, implement multi-factor authentication, conduct vendor security audits, and develop incident response plans that assume critical systems will be compromised.

Source: TechCrunch / Zack Whittaker