Tech
The worst hacks and breaches of 2026 (so far)
If we look back at the year of 2026 so far, it might be easy to see cybersecurity falling by the wayside, as much of the world’s attention remains on wars raging, the climate worsening, and we’re seemingly just one dodgy sneeze away from the next global pandemic.
But cybersecurity remains a powerful barometer of what’s happening on the world stage, with botnets powering digital efforts to undermine the West and governments weaponizing citizens’ data and civilian infrastructure against entire populations of people. All the while, financially motivated hackers seek massive ransom payouts, as they spark disruption and occasional destruction across governments and private industries.
As we’re halfway through this already horrendous year of digital attacks and hybrid warfare, we look at some of the worst hacks and breaches so far, and how they might affect us going forward.
Questions remain over DOGE’s massive swipe of Social Security data
A year on, after operatives with the Elon Musk-led band of government destroyers known as the Department of Government Efficiency (or DOGE) swept through and dismantled federal agencies from the inside out, we’re still learning about the data lapses that happened under their watch.
After DOGE entered the Social Security Administration, it remains unclear as to what happened with some of the nation’s most sensitive data, as lawsuits battle on in federal court. The most alarming whistleblower’s claim is that DOGE uploaded a live copy of the Social Security database to an unsecured third-party server, leading to a scramble to understand what was stored in it. This database allegedly contained the Social Security numbers and associated personal information of most living Americans.
In court filings, the Social Security Administration doesn’t know for sure what was on the server, but said that the DOGE signed an agreement with an outside political advocacy group under the guise of finding evidence of voter fraud, something that President Trump continues to claim without any evidence. The fears are that the database could be misused to target Americans for spurious reasons.
Two of the top House Democrats investigating some of DOGE’s activities at the Social Security Administration said that the exposure of the government’s Social Security database “could very well be the largest data breach in our nation’s history.”
Hackers are increasingly targeting water systems and energy grids
A rash of cyberattacks across Europe targeting civilian energy and water supplies, like power plants and water dams, has set a troubling trend of late. Several hacks attributed to (or at least in part blamed on) Russia have risked real-world harm to communities and populations.
Poland’s energy grid was targeted with computer-destroying malware at the tail end of last year, as well as a Swedish thermal plant, and a Norwegian dam that spilled swimming pools’ worth of water. Hackers targeted Poland again earlier this year, this time its water treatment plants, showing that Russia’s hybrid war antagonism continues to extend beyond the digital realm.
Now, thanks to the recent war between the U.S. and Israel against Iran, there are warnings that Iranian hackers are targeting critical infrastructure in the United States. This includes privately owned water utilities, which remain a soft target for hackers, often lacking basic cybersecurity protections.
Iranian government hackers struck Stryker with a destructive device hack
Speaking of Iran, a cyberattack on a U.S. medical tech company, Stryker, in March saw Iranian hackers break in and remotely wipe tens of thousands of employee devices in one fell swoop, causing widespread disruption to the company’s operations for several days.
The breach was a marked shift in Iranian hacking tactics at a time of ongoing war in the Middle East, with Iran moving from its typical focus of espionage and hack-and-leak operations in aid of the country’s political gains, towards actively causing destructive hacks in apparent retaliation for the war. The U.S. government attributed the hacking group behind the breach to an arm of Iranian intelligence. The breach ended up having a material impact on Stryker’s first-quarter earnings after regaining control of its systems.
Instructure among ShinyHunters’ disruptive hacking campaigns
The ShinyHunters continued their hacking campaigns, targeting dozens of companies with simple but highly effective voice phishing techniques. The English-speaking hackers are adept at tricking companies into turning over access to their internal systems by pretending to be IT support, or conversely, an employee who forgot their password.
Few know better than the toll a hack from the ShinyHunters can have than education tech giant Instructure. The hackers breached the company’s flagship learning management system Canvas to steal private data and personal information belonging to over 30 million students and staff. When the company didn’t pay the hackers’ ransom, the hackers broke in — again — and defaced the school’s login screens for Canvas, used by students to access their exam and coursework material. This second hack happened during school finals, disrupting exams for students across the United States. Instructure eventually paid the ransom, despite efforts by the FBI to dissuade the company from paying.
Instructure wasn’t the only company targeted by the ShinyHunters hackers by far. The gang has been behind some of the largest breaches by the number of records stolen, including some 40 million records from internet provider Charter and at least 6 million customer records from cruiseliner Carnival, among other victims in higher education, finance, and government.
The supply chain is under attack, targeting open source projects and big tech companies
A series of ongoing, concurrent, and occasionally overlapping attacks on open source developers have resulted in massive hacks targeting big tech companies and their customers.
Some of the biggest names in security, including Aqua Security’s Trivy tool, Bitwarden, and Checkmarx, alongside other major open source projects, were compromised this year, allowing the hackers to steal passwords, credentials, and other sensitive tokens from the computers of anyone who installed a backdoored copy of the software, or their pre-installed software auto-updated to download the malware.
These attacks used the stolen credentials to spread further, and opened the door to downstream compromises of big companies that rely on the targeted software, including AI giant OpenAI and web hosting company Vercel. With a new hack almost every week, the open source world remains a vulnerable target in the broader tech ecosystem.
FBI’s surveillance system was breached, sparking a ‘major cyber incident’
The U.S. Federal Bureau of Investigation was forced to declare a “major cyber incident” in April, prompting a legally required disclosure with Congress, after identifying that one of its surveillance systems was compromised. According to reports, the breach potentially exposed phone numbers of targets under surveillance by federal agents.
Chinese spies were accused of the breach of the unclassified network, which held sensitive information about the surveillance targets of wiretaps and other communication intercepts, such as pen register returns. By notifying lawmakers, the breach is likely to have met a bar of causing “demonstrable harm” to U.S. national security.
Hasbro’s hack has led to weeks of downtime
Toymaker giant Hasbro is the latest example of what happens when a large corporation is hit by a security incident and isn’t prepared for it. Weeks after discovering hackers in its systems in late March, the 103-year-old company remained largely offline, its website unavailable, and unable to serve its customers.
The company, which owns big name brands such as Transformers, Peppa Pig, and Dungeons & Dragons, has said little about the incident itself, what data was taken — if any, and whether it paid the hackers. But the disruption alone is likely to affect the company’s financials, which it was forced to delay, as the company scrambled to handle the incident.
Hasbro said as of mid-May that the hackers are no longer in its systems and that its recovery was underway. But the financial costs of the breach and the knock-on effect to its business are likely to be realized in the coming months, and are expected to be substantial.
Millions of passports and driver’s licenses have been exposed galore
Over the past few months alone, there has been an uptick in major data exposures involving people’s sensitive government-issued identity documents, including passport and driver’s license scans left exposed to the web. From a hotel check-in system and a money transfer app to a prison payphone provider and a U.K. visa service, these services exposed over two million people’s personal documents that can be easily misused. Many were caused by simple security lapses that were easily avoidable with basic cybersecurity practices.
These massive data spills come at a time when closed-community apps and websites are increasingly leaning on “know your customer” checks to force users to verify their identity before being allowed in, and governments are pushing age verification laws demanding similar identity checks from adults to access a vast swath of the internet.
The logic goes that the greater the spills, the less effective these identity checking systems are, as they can be easily misused with a stolen or leaked passport or driver’s license. The further rollout of these ID-collecting systems will inevitably lead to more data breaches and security lapses.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
The world’s largest privately owned laser just turned on
Fusion startup Xcimer Energy on Wednesday flipped the switch on its Phoenix laser system, which the company says is the largest privately owned example in the world.
Xcimer’s approach to fusion power is modeled after the National Ignition Facility (NIF), which proved in December 2022 that a controlled fusion reaction could release more power than required to ignite it.
The NIF trained 192 laser beams on a fuel target smaller than a pencil eraser. The energy from the lasers hit the gold target. As the lasers obliterate the gold target, their energy is converted into X-rays, which are focused on the fuel pellet inside, compressing it until atoms in the fuel fuse and release energy.
The company is betting that more powerful, less complex lasers will help turn NIF’s concept for fusion power into something more profitable.
Xcimer’s plans for a fusion power plant call for two lasers capable of firing in microsecond-long pulses. Light from those pulses will be fed through a compression system, of sorts, which will delivers the lasers’ energy to the fuel target in nanoseconds. The quicker the fuel is compressed, the more likely it is to generate usable fusion reactions.
Phoenix is a step toward an eventual power plant. The system uses excimer amplification, similar to those used in semiconductor manufacturing but significantly more powerful. At full strength, the krypton-fluoride laser generates over 1 kilojoule of energy, Xcimer told TechCrunch, and its core is 38 meters long.
While that may be the most powerful privately owned laser, it’s still a fraction of what the company says it will need for a commercial power plant, which could exceed 12 megajoules.
Xcimer hopes to complete a prototype in 2028 before working on a larger system that it hopes will produce at least as much power as it consumes. Sometime in the mid-2030s, it is planning to build its first commercial scale power plant.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Plex adds new social features ahead of a major price hike for its lifetime pass
Plex has come a long way from being just a personal media server. Over the past few years, it has transformed into a streaming hub, today featuring ad-supported content and movie rental options.
Now, the company is setting its sights on competing with social networking platforms like Reddit and Letterboxd: on Wednesday, Plex unveiled several social features aimed at changing how users interact with the platform.
Notable among these is Discussions, a community forum where users can post comments and talk about movies or TV shows. Plex is likely hoping this forum will create a dedicated space that challenges Reddit’s dominance when it comes to community discussions of movies and shows.
The company said it’s worked up a moderation system that uses a blend of AI and human input to moderate both visual and written content.
Another new feature is Lists, which lets users create, manage and share lists of their favorite movies and shows, react with emojis instead of simple star ratings, and share images. Later this year, Plex will add the ability to import existing lists from other platforms, and let users react and comment on their friends’ lists. Letterboxd and IMDb both offer user-generated lists.
Additionally, Plex is adding a new Match Score feature that predicts how much a user might enjoy a particular title based on their viewing habits and preferences.
“It looks at the things you watch and the way you rate them, and turns that into a simple percentage that tells you how closely a title lines up with what you tend to enjoy,” co-founder and chief product officer Scott Olechowski told TechCrunch. “The idea is to take the guesswork out of discovery, so instead of scrolling endlessly, you get a quick, personal read on whether something is likely to be for you.”
The platform is also adding Alerts that will notify users about new activities related to lists, movies, shows and film professionals they follow.
Lists are currently available to all Plex users, and Discussions is set to launch this month. Other features will be rolled out throughout the year.
The new features aim to create a more community-driven content discovery experience, allowing users to share recommendations, compare opinions and connect over their favorite shows and films.
“People are spending more time figuring out what to watch than ever before, and we’re seeing viewers are increasingly turning to friends, creators, and communities they trust for recommendations. Discovery has become a shared experience, and we think the products people use to find entertainment should reflect that,” Olechowski added.
The new features come as Plex is grappling with an increasingly competitive entertainment landscape where streaming companies and social media platforms together vie for people’s attention. Netflix and Disney+ have even launched short-form video content within their apps in a bid to farm daily engagement.
This isn’t Plex’s first foray into social networking. In 2023, the company launched “Discover Together,” which allowed users to create profiles and follow friends’ viewing activities. Last year, Plex rolled out public profiles and reviews for users.
However, it’s important to note that this update also coincides with a significant price hike for Plex’s Lifetime Plex Pass, which will cost $749.99 from July 1. The staggering increase certainly caught the attention of users, especially since Plex just last year increased the Pass’ price from $119.99 to $249.99.
Currently, Plex boasts over 42 million active users monthly across more than 180 countries and territories.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Coralogix raises $200M on bet that someone needs to watch the AI agents
Coralogix, a Boston-headquartered software monitoring startup founded in Israel, has raised $200 million in a new funding round, betting that the rise of AI agents will drive demand for a new generation of tools to monitor, troubleshoot, and manage increasingly autonomous software systems.
The Series F financing comes just 11 months after Coralogix raised $115 million in a Series E round, a pace that reflects just how quickly investor appetite for AI infrastructure companies has accelerated. The new round values the startup at $1.6 billion post-money and was led by Advent and the Canada Pension Plan Investment Board (CPPIB), with participation from Greenfield Partners and Brighton Park Capital. The company has now raised a total of $550 million to date.
The investment comes as software companies race to adapt to the rise of AI agents, software systems that can autonomously write code, investigate problems, and complete tasks that would previously have required a human engineer. Coralogix is among a growing number of infrastructure firms betting that as AI systems move into production, demand will rise for tools that can monitor their behavior, troubleshoot failures, and provide the operational data needed to keep them running reliably. (The more autonomous software you deploy, the more you need to know when something goes wrong and why.)
Founded in 2014, Coralogix helps companies monitor the health and performance of software systems by collecting and analyzing operational data such as logs, metrics, and traces — essentially a continuous record of what a software system is doing and how it’s behaving. The platform is used by more than 5,000 customers worldwide, including IBM, Tradeweb, and JFrog, to detect outages, investigate incidents, and optimize applications.
The observability industry, where Coralogix competes with the likes of Datadog, New Relic, and Splunk, is being reshaped by the rise of AI. Vendors are increasingly embedding AI into monitoring and incident-response workflows as enterprises deploy more AI-powered applications and agents.
The shift is already changing how customers interact with Coralogix’s platform, co-founder and CEO Ariel Assaraf (pictured above, right) said in an interview. More than half of the startup’s enterprise customers now use either its AI agent, Olly, or their own AI models through command-line and agentic interfaces to investigate incidents and query operational data, he said.
“The interface layer is slowly getting eroded,” Assaraf told TechCrunch, observing that engineers are increasingly interacting with software through AI assistants and command-line tools rather than traditional dashboards. “Most of the usage is going to be around, ‘How do I connect my LLM to this? How do I operate this through my CLI?’” In plain terms, his customers are less interested in logging into a dashboard and more interested in asking an AI assistant what’s wrong.
The shift has coincided with strong growth for Coralogix. The startup grew revenue by more than 60% over the past year and now counts about 30 customers spending more than $1 million annually, Assaraf said, as it expands further into the enterprise market. The company surpassed $100 million in annualized revenue more than a year ago, Assaraf added, though he declined to disclose current figures
The startup employs more than 600 people globally, with about 100 based in India, home to its third-largest office after the U.S. and Israel. The India operation, Assaraf said, has evolved into a regional hub supporting customers across Asia while helping Coralogix expand into large domestic enterprises, including financial institutions.
Coralogix did not raise because it needed additional runway, Assaraf said, adding that the funding would be used to accelerate investment in AI-focused products, security offerings and global expansion.
“In the AI era, execution and speed matter more than any point-in-time valuation,” he said. “We wanted to accelerate, expand, and take a further step into this AI game that we believe we’re leading in our space.”
Coralogix does not currently expect to raise additional capital and is working toward profitability over the next few years, Assaraf said. The company is also preparing to operate with the financial discipline of a public company, he said, though he stopped short of committing to a timeline for an initial public offering.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
The New Star Wars Movie Just Made History In The Worst Possible Way
Aaron Donald’s Return Would Make the Rams’ Myles Garrett Trade a Victory
