Blog Single

A thorough data breach investigation starts from the same question every time…There are four kinds of data almost every organization holds, and almost none of them think about together: what it knows about the people who work for it, what it knows about the people it treats, what it knows about the people who buy from it, and what it knows about the children who pass through it.

Employee data. Patient data. Customer data. Student data.

Each one carries a different kind of trust. An employee hands over a bank account number assuming payroll will protect it. A patient hands over a diagnosis assuming it stays between them and their provider. A customer hands over a card number assuming a transaction is the end of the story, not the beginning of one. A parent sends a child to school assuming the school, not a criminal record marketplace, ends up holding that child’s information.

In 2026, all four of those assumptions have been tested, and all four have failed somewhere, publicly, at scale.

What Happened to Employee Trust

In November 2025, employees at a major global beauty company received notice that a vulnerability in the HR platform managing their payroll had been exploited. What came out wasn’t just names and addresses — it was Social Security numbers, passport numbers, bank account details, health information, and performance evaluations, the kind of file an employee assumes only HR will ever see.

Weeks later, a different kind of HR breach made clear this wasn’t isolated: an automaker disclosed that a zero-day vulnerability in its own HR platform had exposed the same category of data — payroll, tax administration, personnel records — to attackers who, security researchers noted, now had everything needed to attempt payroll-change fraud, convincingly impersonate an employee, or socially engineer their way further into the company.

The pattern in both cases is the same. HR and payroll systems hold some of the most sensitive, most reusable personal data an organization has, and they’re frequently treated as internal administrative tools rather than the high-value target they actually are. A class-action settlement earlier in 2026 — $2.6 million, tied to a payroll provider breach first discovered back in March 2024 — is a reminder of how long the financial and legal tail on an HR breach can run after the technical incident is “resolved.”

What Happened to Patient Trust

Healthcare has the dubious distinction of holding the most expensive data breaches tracked anywhere. The average healthcare breach now costs $7.42 million and takes 279 days to identify and contain — nearly nine months during which exposed health records are simply out there.

The scale involved is difficult to overstate. A breach at a healthcare claims processor disclosed in 2024, with its final scope confirmed only in 2026, affected 192.7 million individuals — the largest healthcare breach ever recorded, in a country of roughly 340 million people. A second breach, at a business associate processing claims and billing data, was revised upward mid-2026 to 62.2 million individuals once the full scope became clear. Between 2009 and early 2026, healthcare breaches have cumulatively affected 935 million individual records — more than twice the population of the country where most of them were reported.

The first half of 2026 alone saw 397 large healthcare breaches reported, and while the raw count has actually declined slightly year over year, that’s a misleading comfort: incident counts are down, but the data confirms what’s already been exposed keeps growing as investigations into older breaches finalize their true scope. A breach disclosed as “500 individuals” in an initial filing has, in several 2026 cases, been revised months later to several million.

What Happened to Customer Trust

Retail and consumer platforms don’t make the same per-record headlines healthcare does, but the volume is enormous and constant. Across the Philippines alone, more than 155 million compromised accounts have been tracked since 2004, with over 216,000 added in a single recent quarter. A separate 2026 regional cybersecurity report counted 255 breach incidents and 19.2 million compromised credentials in just the first half of the year, concentrated in finance, hospitality, logistics, and manufacturing — sectors that, notably, all depend heavily on customer-facing systems.

What makes customer data breaches distinct from the other three categories is persistence. A stolen password gets reused across other accounts. A stolen card number gets tested against other merchants within hours. The damage from a customer data breach rarely stays contained to the business that was breached — it radiates outward into every other account the customer touches, which is part of why these breaches are so difficult to fully contain even after the original vulnerability is patched.

What Happened to Student Trust

Of the four, student data may be the most quietly alarming, because children can’t consent to the risk and often won’t discover the consequences until years later, when they apply for their first credit card or loan using an identity that was already stolen before they were old enough to know it.

In December 2024, a single compromised credential — used through a customer-support portal that lacked multi-factor authentication — gave an attacker access to a widely used school information system. By the time the investigation concluded, roughly 62 million students and 9.5 million teachers across more than 18,000 North American schools had their data exposed, the largest student-data breach on record. The attacker, 19 years old at the time, was sentenced in late 2025 to four years in federal prison and $14 million in restitution — a sentence that resolves the legal case but does nothing to put 62 million exposed identities back behind a locked door.

That wasn’t an isolated event. A separate 2026 incident attributed to a known data-extortion group claimed exposure of roughly 275 million user records across nearly 9,000 educational institutions using a different learning platform — a figure the vendor has not fully confirmed, but one that, even partially accurate, would rank among the largest breaches in any sector this year. Verizon’s 2026 global breach analysis found ransomware present in 48% of education-sector breaches, up from 44% the year before, with a human element — a clicked link, a reused password, a social-engineered support call — present in 62% of all breaches analyzed across every sector.

The nature of what’s exposed in a school breach compounds the problem: not just names and birth dates, but special education records, health-related information, and financial aid data — categories of information that, unlike a credit card, can’t simply be canceled and reissued.

The Thread Connecting All Four

Read individually, these look like four unrelated stories: a cosmetics company, a hospital claims processor, a cluster of regional retailers, a school software vendor. Read together, a pattern emerges that matters more than any single incident.

In nearly every case above, the breach wasn’t a sophisticated, unstoppable attack. It was a single compromised credential, a vulnerability that had already been flagged, a support portal without multi-factor authentication, a vendor relationship nobody was monitoring closely. The weak point was rarely the data itself — it was the access path to the data, sitting one step removed from where anyone was actually watching.

And in every case, the real cost wasn’t measured at the moment of the breach. It was measured in the 279 days healthcare breaches take to contain, the months it took for the true scope of a “500 individual” filing to become “62 million individuals,” the years it will take for a student whose Social Security number was exposed at age eleven to discover it when they’re finally old enough to apply for credit.

That gap — between when a breach happens and when its full shape becomes known — is exactly where forensic investigation earns its place. Not to prevent the initial compromise; that’s a security function. But to answer, after the fact and with evidence that holds up, the three questions every affected employee, patient, customer, and parent eventually asks: what exactly was taken, how long was it exposed, and what else might it be connected to.