The week in breach news Jan 21, 2026

Canada's national self-regulatory body, CIRO, revealed that hackers compromised the personal information of approximately 750,000 individuals in an August 2025 cyberattack.

Following a detailed forensic investigation, CIRO confirmed the full scope of the incident, which it first detected on August 11 and disclosed on August 18 last year. The attack, stemming from a phishing campaign, impacted its member firms and their registered employees. Exposed data includes annual income, dates of birth, government-issued ID numbers, phone numbers, investment account numbers, Social Insurance numbers and account statements. CIRO noted that since it does not store passwords, PINs or security questions, none of those were affected.

At this time, CIRO says it has no evidence that the compromised information has been misused or surfaced on the dark web, but the organization will continue to monitor for signs of abuse.

A cybercriminal compromised more than 50 multinational companies without any advanced exploit, exposing sensitive corporate and customer data across multiple industries.

A threat actor known as Zestix (also tracked as Sentap) stole and listed the data from dozens of global enterprises for sale on the dark web. The breach required no sophisticated exploitation techniques — the attacker relied entirely on valid credentials sourced from infostealer malware logs. Affected organizations span multiple sectors, including Iberia Airlines, Burris & Macomber, Maida Health, Intecro Robotics and Pickett & Associates. Without multifactor authentication in place, the attacker logged in directly to corporate file-sharing portals to exfiltrate data.

The stolen credentials were traced to several infostealer variants, including RedLine, Lumma and Vidar. In some cases, the credentials had been exposed for years before being weaponized.

Central Maine Healthcare confirmed that a data breach it experienced last year compromised the personal, treatment and health insurance information of more than 145,000 patients.

The health care provider detected unusual activity within its IT network on June 1, 2025. Further investigation revealed that an unauthorized party had gained access to its environment as early as March 19, 2025. Exposed data includes names, dates of birth, Social Security numbers, treatment details, provider names, dates of service and health insurance information, impacting 145,381 patients.

The organization stated it has enhanced its monitoring and alerting capabilities to help prevent similar incidents and advised affected individuals to review statements from healthcare providers and insurance plans.

A Belgian general hospital network, AZ Monica, was forced to shut down all servers, cancel scheduled procedures and transfer critical patients after a cyberattack disrupted its operations.

On January 13, the hospital network experienced a serious IT outage and proactively shut down all servers across its campuses in Deurne and Antwerp. AZ Monica confirmed it launched an investigation and notified police and prosecutors, though it has not shared other details about the intrusion.

While some reports mentioned possible ransom demands, hospital officials and authorities have not yet confirmed whether ransomware was involved.

South Korean conglomerate Kyowon confirmed a ransomware attack that disrupted its operations and may have exposed customer data.

Kyowon Group, which operates across education, publishing, media and technology, detected abnormal activity in its network on January 10, 2025. The company immediately activated its incident response plan and isolated affected servers to stop the attack from spreading. Signs suggest data may have leaked, though the full impact on customer information is still under investigation.

According to reports, attackers gained access through an externally exposed server connected to the internet, then moved into Kyowon's internal systems, allowing ransomware to spread across multiple subsidiaries.