The year is only halfway through, yet 2026 has already been filled with data breaches, hacks, and cybersecurity incidents.

So let’s take a look back at the biggest cybersecurity breaches of 2026 so far. Mashable has picked the six most impactful incidents. There’s likely lessons to be learned in order to protect yourself for the rest of the year.

Here they are, in no particular order.

Grand Theft Auto VI fans and Rockstar Games

GTA 6, the most anticipated video game for the past decade, will finally be released this year. And malicious actors are already targeting its fans and even the game’s developer.

Fake GTA 6 pre-order websites, fake GTA 6 mobile apps, and even fake sites that copy legitimate game download platforms have been popping up since developer Rockstar Games confirmed a late 2026 launch for the game.

It’s unclear just how many users have already been affected, but it’s obviously growing, as hackers will continue to target Grand Theft Auto gamers up until the game’s release and likely well beyond.

Not even Rockstar Games is safe. Earlier this year, the now-infamous hacker collective ShinyHunters announced that it had breached the game developer’s networks. ShinyHackers sought out a ransom in exchange for not releasing the data it had stolen.

Rockstar downplayed the severity of the data breach, saying the breach occurred at a third-party provider. It also appeared that the data comprised corporate assets rather than private user information.

Instructure data breach

Edtech giant Instructure, the company behind the popular Learning Management System (LMS) Canvas, was a victim of what was easily one of the biggest breaches of the year so far.

The Instructure breach was also carried out by ShinyHunters, the hacking collective that is becoming quite notorious as the likely culprit behind so many data breaches. The stolen data in this breach included users’ names, email addresses, student IDs, and private messages exchanged on the platform, which was used by a whopping 275 million users at nearly 9,000 schools around the world. These users included students, teachers, and school staff.

To make matters even worse, ShinyHunters breached Instructure’s platforms again just one week after the company claimed it had fixed the security issues associated with the original data breach. This time, however, ShinyHunters defaced the login pages of specific schools.

The data breaches forced some schools to postpone final exams and assignments, as Instructure took its platforms offline to address the cybersecurity incidents.

ShinyHunters is well known for carrying out breaches and demanding a ransom in return for not releasing the data. It appears that Instructure struck a deal with ShinyHunters to prevent its users’ data from being disseminated. It’s certainly a worrying outcome that doesn’t bode well for how future data breaches may pan out.

Conduent data breach

Conduent is a data management company whose clients include many major corporations, healthcare providers, and state agencies. So, when there’s a data breach at an organization that handles sensitive data belonging to Humana and Blue Cross and Blue Shield of Texas, just to name a few, there is cause for concern.

Earlier this year, at least 25 million people in just two states were affected by a data breach at Conduent. A reported 15 million people were affected in Texas, which is just shy of half of the state’s more than 31 million residents. Reports state that more than 10 million people were affected in Oregon.

According to Conduent, the unauthorized parties “obtained some files that contained individuals’ personal information, which came into our possession due to the services that we provide to your current and former health plan.”

This data included users’ names, Social Security numbers, medical information, and health insurance information.

That’s a big cybersecurity incident involving some of the most sensitive user data that can be obtained.

Meta AI supports Instagram vulnerability

The most recent incident on this list perfectly encapsulates many of the unresolved cybersecurity issues with AI.

Meta rolled out an AI-powered support chatbot for Instagram. Hackers figured out they could simply request that the AI chatbot send a password reset link for any Instagram account to the hacker’s email address. Meta AI support complied with the requests simply because the hacker told them they were the account owner and needed the chatbot to send the password reset link to a new email address.

Malicious actors were stealing highly followed Instagram accounts through this method and then selling them on online black markets.

Meta did eventually fix the issue, but affected users were still locked out of their accounts for a time.

This may not have been the biggest, most widespread hack on our list. But the method used to steal these Instagram accounts is certainly the fastest-growing tool in hackers’ arsenal. We’ll be seeing many more bad actors tricking easy-to-fool AI-powered systems in the very near future.

DarkSword spyware

What if a hacker could steal a smartphone’s data with nothing more than their target visiting a website?

DarkSword spyware, which could do just that, had Google and numerous cybersecurity firms ringing the alarm bells earlier this year.

Google Threat Intelligence Group and cybersecurity companies Lookout and iVerify laid out their findings in March, showing how malicious actors were exploiting vulnerabilities in Apple’s iPhone to siphon data from a device after the target visited an infected website.

Call logs, contacts, iMessage and WhatsApp data, email, calendars, notes, photos, screenshots, location history, web browser history, signed-in account identities, device keychains, SIM card info, Find My Phone settings, WiFi passwords, iCloud content, and more were all able to be pulled from a malicious actor using DarkSword.

Nearly 25 percent of all iPhones are still running some version of iOS 18, the iPhone operating system that was susceptible to the attack. This meant that there were potentially hundreds of millions of iOS devices on which DarkSword could be deployed.

According to the reports, Russian hacker groups were already deploying the spyware “to fully compromise devices.”

To make matters worse, DarkSword was soon released into the wild shortly after the cybersecurity firms warned about it.

Apple did release updates and important information for users who were susceptible to the spyware. However, the existence of such an exploit shows just how easy it’s becoming for bad actors to carry out an attack.

WeedHack

Speaking of how easy it is to get hacked, WeedHack may be the perfect example of how accessible it is to become an attacker, too.

A recent report from McAfee Labs detailed a new hacker tool being offered as a $5 per month service to aspiring attackers who may not have the technical know-how to carry out a campaign themselves. 

WeedHack is a malware that’s deployed under the guise of a Minecraft client or mod. Once a device is infected, an attacker can collect system information, search for files on the infected device, take screenshots of the target’s system, and steal cookies and passwords from the target’s web browser. And that’s just the free version.

For $5 per month, an attacker could also gain webcam access to the infected device, keylogging capabilities, screen sharing with keyboard and mouse access, file management features for uploading and downloading files, and more.

Perhaps the most concerning revelation, however, was just how WeedHack was being used.

McAfee Labs uncovered a Telegram channel for WeedHack’s customer base and found it was largely used by teenagers and young adults who were using the malware to cyberbully other young people, threatening, harassing, and spying on victims. 

Malware-as-a-service has existed before, but WeedHack seems to be ushering in something that goes well beyond just your typical cybersecurity issues.

By Jacob VanGundy
| Published 31 seconds ago

I recently rewatched Hellraiser, one of the best horror movies of the 1980s, and I was struck by how much it resembles a vampire story. Aesthetically, thematically, and even in terms of plot, the story has more in common with Dracula than the supernatural slashers of the era. While elements centered around the Cenobites dominated the sequels, the original movie is more interested in exploring the vampiric antagonist, Frank.

Released in 1987, Hellraiser was written and directed by Clive Barker, who had adapted his novella, The Hellbound Heart. It made $14.6 million at the US box office ($30 million worldwide) on a budget of only $1 million and became a hit with horror fans, though it faced heavy censorship and a ban in Ontario. The movie was so successful it spawned nine sequels and a reboot. 

The Dracula Parallels

Hellraiser begins with the hedonist Frank Cotton using a puzzle box to summon Cenobites, a group of sadomasochistic extradimensional beings who torture him to death and take his soul to their dimension. When Frank’s brother Larry cuts himself in the attic where Frank died, it resurrects him as a skinless monster. Larry’s wife Julia is seduced into luring victims to Frank, who, now a vampire, needs the blood to restore himself. 

While the movie’s heroine, Kirstie, solves the puzzle box and is tormented by Cenobites for it, Frank is the clear antagonist. In his new vampire form, Frank requires the blood of multiple victims, becoming increasingly human in appearance as he feeds on the men Julia seduces and brings to him. He also attempts to seduce and murder Kirstie, making a much more explicit villain than the more mysterious Cenobites. 

Frank’s need to feed on blood is the most obvious way Hellraiser is a vampire story, but his entire character resembles Dracula. His origin, making a deal with demonic beings, is a common origin for the character and similar to the implied origin in Bram Stoker’s novel. The fact that he was resurrected from death by human blood also fits within the mythology. 

Hellraiser’s setting is also reminiscent of classic vampiric folklore. Taking place in a grand but dilapidated family home is similar to the decrepit mansions and castles common in vampire stories. The fact that Frank is confined to the attic of that home by his appearance takes the place of hiding in a crypt to avoid sunlight. 

Thematically, Hellraiser explores ideas that frequently appear in vampire stories. Hedonism, sexual taboos, and corruption are all central themes of the movie that can be found in everything from Interview With the Vampire to Carmilla. Solving the puzzle box also connects to the idea of forbidden knowledge, which is often a central piece of Dracula’s mythology. 

The seductive element of Frank’s character is another central connection to vampire lore, with Julia being Hellraiser’s version of Dracula’s bride. While Frank doesn’t directly turn Julia into a monster, he does lead her to behave monstrously, helping him murder multiple men, including her husband. The sequel would double down on this by making her a central antagonist after her own resurrection. 

Hellraiser Is Misunderstood

Hellraiser has more than earned its place in the pantheon of great horror movies, but it’s also largely misunderstood by those who haven’t seen it as a movie about Pinhead as a supernatural slasher. The movie is much more at home within the vampire genre than the broader oeuvre of 80s horror. Fans of horror, particularly fans of vampire stories, should watch Hellraiser, which is available to stream for free on Tubi, Pluto TV, Plex, and Amazon Prime Video.

By Jacob VanGundy
| Published 7 seconds ago

Operation Mincemeat is a spy thriller based on a true British intelligence operation from World War II. While the spy story is fascinating, and there was enough suspense to keep me watching, the movie is bogged down with unnecessary interpersonal drama. The result is an uneven, disappointing movie that doesn’t live up to its premise. 

Based on Ben Macintyre’s book about the historical event, Operation Mincemeat is about a misdirection mission by British intelligence. To hide the Invasion of Sicily, a plot is hatched by British intelligence officers Ewen Montagu and Charles Cholmondeley to plant false information on a corpse and have it wash ashore.

To sell the fake soldier’s identity, a detailed backstory was constructed including a fictional fiance using a photo of the office’s secretary Jean Leslie. 

The Period Drama Overshadows The Spy Intrigue

Operation Mincemeat brings together a fantastic cast of UK actors, who deliver great performances across the board. Colin Firth, Matthew Macfayden, and Kelly Macdonald play the movie’s three leads, making their characters feel real. The supporting cast also features great actors like Penelope Wilton, Johnny Flynn, Jason Issacs, Mark Gatiss, Paul Ritter, and Simon Russell Beale.

While I found the depiction of spycraft in Operation Mincemeat compelling it was weighed down with superfluous period drama elements. Much of the film’s runtime is dedicated to the love triangle between its three main characters, which adds a layer of unneeded personal drama that actively distracts from the spy mission’s inherent tension.

It’s the sort of tacked-on plotline that feels like it exists to meet period drama expectations, and I was unsurprised to learn it was invented whole cloth for the movie. 

The Spycraft Is More Interesting

Some of the most interesting spy thriller moments of Operation Mincemeat are glossed over to dedicate more time to its boring love triangle. Numerous scenes depict the budding relationship between Ewen and Jean, while the head of Germany’s army intelligence discovering the plot and turning a blind eye to undermine the Nazi regime is given a single truncated scene.

As a fan of spy thrillers, I can’t help but feel like the movie prioritizes the wrong elements of its plot.

The pacing in Operation Mincemeat also suffers due to its love triangle. What should be a consistently suspenseful movie grinds to a halt halfway through to focus on the romantic subplot and the hostility it creates between Ewen and Charles. With a runtime of 128 minutes, it drags on for too long, drawing attention to its unneeded subplot.

Despite its shortcomings, Operation Mincemeat has a strong story at its core and it tells that story well when its focus isn’t divided. It’s at its best when it depicts the finer details of the operation and the construction of the soldier’s fictional life. With strong acting and directing, it’s well-made even when the writing falls short. 

Fans of period dramas who also enjoy spy stories will likely enjoy Operation Mincemeat, while fans looking for a spy thriller like I was may find it disappointing. It’s a well-made movie bogged down by a single poor creative decision. You can watch the film version of one of history’s most fascinating spy stories for yourself on Netflix.

OPERATION MINCEMEAT SCORE