Top 5 Biggest Data Leaks of 2026 That Exposed Billions

Short answer: The year 2026 set records for digital exposure through a combination of decade-old code vulnerabilities and coordinated ransomware intrusions. Breaches moved beyond stolen credit card numbers. Attackers exfiltrated immutable data including biometric templates, genetic sequences, and real-time telecom location records. The five incidents below represent the largest exposures measured by records leaked, affected systems, and long-term risk.

1. What the leak logs show

Over the past year, enterprise security defenses faced intense pressure. Corporate networks struggled as zero-day disclosures collided with automated scanning tools. Instead of targeting single corporate servers, ransomware syndicates focused on central software engines and shared infrastructure.

When foundational open-source components break, thousands of independent organizations suffer at the same moment. At the same time, centralized government registries and major retail banks accumulated massive volumes of citizen data. That centralization turned single API weaknesses into national events. Stolen files quickly moved from private hacker chats onto public dark web forums and Telegram networks.

2. The global PHP2Shell web infrastructure leak

A pair of critical memory safety flaws inside the core PHP engine triggered an internet-wide emergency. Tracked under CVE-2026-109618 and CVE-2026-109619, the bugs scored 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). The vulnerability had remained hidden within PHP request termination routines for over ten years. Security researchers discovered the defect using frontier machine learning models.

Because PHP powers roughly 70% of public websites, attackers moved quickly. Threat actors automated remote code execution attempts and dumped active server memory. The exploit chain knocked national government portals offline across France, Belgium, Finland, and the Netherlands. Major knowledge repositories, including Wikipedia and the Internet Archive, reported severe traffic disruptions while operations teams deployed emergency patches. For technical analysis of this engine bug, read our breakdown of the PHP2Shell vulnerability.

3. The Meta biometric and private message exposure

In one of the largest single-platform exposures on record, an architectural access flaw affected Meta’s backend ecosystem. The leak exposed user records belonging to more than 1.2 billion accounts worldwide. Exposed data sets included private user message threads, detailed location histories, and biometric facial vector templates.

The security disaster attracted intense scrutiny from international privacy regulators. European and North American authorities initiated enforcement proceedings that totaled over $25 billion in statutory penalties. Threat actors subsequently packaged the user IDs and cryptographic tokens for sale across underground forums.

4. State Bank and South Asian banking breach

South Asian financial institutions faced sharp scrutiny after dark web sellers advertised customer databases originating from public banking infrastructure. The seller published sample files from a claimed 375,000-row repository. Initial reports warned that unpatched backend APIs had exposed account balances, ledgers, and national identity documents.

In regulatory disclosures submitted to the stock exchange, State Bank of India verified that 3,897 customer files containing personal information were part of the circulating cache. The confirmed data included names, mobile numbers, branch identifiers, and internal Customer Information File (CIF) numbers. Crucially, forensic teams confirmed that core account balances, transaction ledgers, passwords, and payment card numbers were not breached. Read our complete investigation into the State Bank data breach and filing numbers.

5. Telecom infrastructure and national ID registry dumps

Ransomware syndicates executed coordinated attacks against primary telecommunications carriers across multiple continents. Instead of encrypting endpoint laptops, attackers exfiltrated core subscriber billing and routing databases.

The stolen archives compromised hundreds of millions of mobile subscribers. Leaked fields included real-time cell tower connection logs, SIM card registration numbers, and linked national identity cards. By pairing SIM identifiers with live movement records, attackers turned private citizen mobility into a searchable commodity on illicit marketplaces.

6. Healthcare network and genetic data auctions

Centralized hospital systems and medical testing networks suffered extensive exfiltration campaigns during 2026. Attackers bypassed perimeter firewalls to extract diagnostic records, prescription histories, and raw genetic sequencing files.

This breach introduced distinct dangers because biological data is permanent. Unlike credit card numbers or passwords, individuals cannot reset their genetic code or medical history. Criminal syndicates listed the files on encrypted messaging channels, demanding ransoms directly from affected patients.

7. What’s missing / the permanence footnote

Raw headlines often treat all leaked records as identical, but evaluating real-world harm requires looking at data permanence. When an incident exposes account passwords or credit card numbers, banks issue replacements and consumers update their credentials. The immediate financial danger resolves once systems invalidate the old tokens.

The 2026 breach wave highlights the growth of non-resettable identifiers. Biometric vectors, home addresses, phone numbers, and family records cannot be replaced with a single click. When attackers link basic phone numbers to leaked national registry files, the threat shifts from automated card theft to high-stakes social engineering.

Institutions also face complex audit trails. As seen during recent banking sector reviews, determining whether a leak occurred inside core servers or at third-party contractors can take weeks. To understand how statistical disclosures and corporate risk reports are calculated, explore our guide on how to read rankings.

Sources to check yourself

• UK National Cyber Security Centre (NCSC) technical security advisories on PHP core vulnerabilities.
• Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog.
• Bombay Stock Exchange regulatory disclosures regarding commercial bank incident logs.
• Wiz Research threat reports and vulnerability documentation on engine-level heap exploitation.

Frequently asked questions

Q: Which 2026 data leak affected the largest number of individual users? A: The Meta architectural exposure affected over 1.2 billion user profiles, making it the largest single-platform incident of the year by user count.

Q: Did the PHP2Shell vulnerability only affect personal computers? A: No. PHP2Shell targeted server-side PHP runtimes, exposing cloud servers, content management platforms, and web hosting infrastructure supporting roughly 70% of public websites.

Q: What is the main danger if financial balances were not leaked? A: Leaked contact details, national IDs, and internal customer numbers allow scammers to run convincing impersonation scams and SIM-swapping attacks against verified account holders.