The week in breach news May 20, 2026

Microsoft disclosed details of a large-scale credential theft campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries.

The campaign used code-of-conduct-themed phishing lures, combined with legitimate email services, to redirect users to attacker-controlled domains and steal authentication tokens. The phishing emails featured polished, enterprise-style HTML templates with structured layouts and authenticity statements, making them appear more credible and convincing than typical phishing attempts.

Most of the phishing emails targeted organizations in the health care and life sciences, financial services, professional services and technology sectors. The disclosure comes just a month after Microsoft revealed another large-scale phishing campaign using device code authentication flows to compromise organizations worldwide.

A software company that handles sensitive data for nearly every U.S. federal agency was reportedly the victim of an insider threat earlier this year.

Opexus, a software services provider used for processing U.S. government records, disclosed that two employees improperly accessed sensitive documents and compromised or deleted dozens of databases, including systems containing data from the Internal Revenue Service and the General Services Administration. The incident is now under investigation by the FBI and other federal law enforcement agencies.

According to reports, the two individuals, identified as twin brothers Muneeb and Suhaib Akhter, allegedly destroyed more than 30 databases and removed over 1,800 files tied to a government project. The incident also reportedly caused outages in key government software systems and, in some cases, permanent data loss.

BWH Hotels, the parent company of Best Western, WorldHotels and SureStay, confirmed a major data breach that exposed sensitive customer information.

The global hospitality company, which operates more than 4,500 hotels across 100 countries, detected unauthorized activity in a web application containing guest reservation data on April 22. The company acknowledged that attackers had maintained access to the network for more than six months. Thousands of reservations tied to Best Western and other BWH brands may have been exposed, raising concerns over targeted phishing attacks against travelers.

The company has begun notifying affected guests and is warning them to remain cautious of fake booking pages, suspicious communications and urgent payment requests.

West Pharmaceutical Services, a manufacturer of pharmaceutical packaging and drug delivery systems, experienced a ransomware attack on May 4 that prompted the company to proactively shut down and isolate portions of its on-premise infrastructure.

The Pennsylvania-based company, one of the world's leading providers of drug-delivery technologies, detected unusual activity on its network and took systems offline as a precautionary measure. The shutdown disrupted access to enterprise systems and temporarily affected global business operations.

According to the latest updates, the company has made significant progress in restoring operations globally, including restarting critical manufacturing and receiving and shipping systems at certain locations.

A data breach at NYC Health + Hospitals Corporation in late March may have affected more than 1.8 million individuals.

NYC Health + Hospitals is the largest public health system in the U.S. and serves more than 1 million New Yorkers. The Department of Health and Human Services Office for Civil Rights breach portal was updated to show that personal and protected health information belonging to approximately 1.8 million current and former patients and employees was compromised in the incident.

Investigators found that attackers had access to the network for 11 weeks, with the breach reportedly originating from a security incident involving one of the organization's vendors.