According to TechCrunch, cybersecurity incidents in the first half of 2026 are no longer limited to data breaches. Attacks have expanded from corporate databases to government systems, school platforms, medical technology companies, and energy and water supply facilities, with impacts shifting from data theft to business disruption and real-world damage.
The controversy surrounding DOGE data continues to escalate.
The article mentions that the data processing by the U.S. Department of Government Efficiency (DOGE), led by Musk, after taking over the U.S. Social Security Administration remains controversial. Federal court litigation is ongoing. One of the most high-profile allegations is that a copy of the real-time Social Security database was uploaded to an unsecured third-party server, potentially involving a large number of U.S. residents' Social Security numbers and personal information.
Energy and water supply facilities are frequently attacked.
Recent cyberattacks in Europe have targeted civilian energy and water supply systems. The report mentions attacks on the Polish power grid, a thermal power plant in Sweden, and a dam in Norway, with some incidents attributed to or linked to Russia. Earlier this year, Poland's water treatment facilities were also targeted again.
Following the escalation of tensions in the Middle East, the United States has also warned that Iranian hackers may target critical U.S. infrastructure, particularly water supply systems operated by private entities with weak cybersecurity. Intrusion into such facilities would have far-reaching consequences, extending beyond the online realm.
From extortion to direct destruction
The article states that Iranian hackers breached the US medical technology company Stryker in March of this year, remotely deleting tens of thousands of employee devices, disrupting the company's operations for several days. The US government attributed the hacking group to Iranian intelligence. The incident subsequently impacted the company's first-quarter performance.
Another type of high-frequency attack comes from ShinyHunters. This group primarily uses voice phishing to gain access to internal corporate systems. The learning platform Canvas, owned by the edtech company Instructure, was compromised as a result, leading to the theft of data from over 30 million students and faculty members. Because the company initially failed to pay the ransom, the attackers re-infiltrated the site and tampered with the school's login page during final exams in the United States, disrupting exam scheduling. Reports indicate that the company eventually paid the ransom.
Open source supply chain impacts OpenAI
TechCrunch believes another prominent theme in 2026 will be the continued pressure on the open-source software supply chain. Tools and projects such as Aqua Security's Trivy, Bitwarden, and Checkmarx have all been compromised with backdoors. Attackers used these to steal passwords, credentials, and access tokens, and further spread the technology laterally.
These attacks subsequently impacted downstream companies that relied on the software. The article specifically names OpenAI and Vercel as also being affected. As open-source components are more widely used in cloud services and AI development processes, the spillover risks from single points of failure are amplifying.
In addition to corporate surveillance, an FBI surveillance system was also breached in April, triggering a "major cyber incident" notification. The report, citing external sources, stated that the incident may have exposed sensitive information such as the phone numbers of those being monitored, and the suspected attackers are alleged to be linked to Chinese espionage activities.
Additional information:The article also mentioned that Hasbro experienced several weeks of business disruption after the attack, and its financial disclosures were forced to be delayed; in recent months, more than 2 million passport or driver's license scans have also been exposed at several hotels, money transfer apps, prison phone service providers, and the UK visa service.
