Halfway through the year, TechCrunch published its mid-year roundup of the worst hacks and breaches of 2026. It makes grim reading: a ransomware group stole 3.65 TB from Canvas, the dominant learning management system used by over 9,000 educational institutions. A separate attack compromised archived medical records at One Medical. Foxconn was hit for 8 TB of data with supply chain implications for Apple and Google. The FBI declared a “major cyber incident” after a surveillance system was breached by suspected state-sponsored actors.
These incidents differ in target, method, and scale. What they share is more instructive: in each case, the attackers found a centralized repository of data about millions of people, and the access controls between “inside the perimeter” and “all the data” were narrower than anyone defending the system realized until it was too late.
That pattern has direct implications for how you store personal files — photos, documents, voice recordings, memories — and which threat model you’re actually managing.
The Canvas Breach: 275 Million Records, One Attack
The Canvas breach, carried out by the ShinyHunters group, is one of the largest education-sector attacks in history. Instructure — Canvas’s parent company — serves over 9,000 institutions globally. The attack compromised records for an estimated 275 million users across those institutions.
What was in those records varies by institution: at minimum, student and staff names, email addresses, and institutional IDs. At many institutions, the records included course content, submission history, assessment scores, and messaging history. Some institutions that use Canvas as a student records hub may have had more sensitive academic and personal data exposed.
The breach took months to fully scope. ShinyHunters’ method — a sophisticated combination of credential stuffing and lateral movement after initial access — is consistent with their previous high-profile attacks. Initial access was likely gained through credentials compromised in an earlier, unrelated breach, which were then used to access Canvas systems with more elevated privileges than the original accounts warranted.
The lesson isn’t unique to Canvas. It’s that a system serving 9,000 institutions across the globe necessarily aggregates data in ways that make it attractive to attackers at industrial scale. The sheer volume of data that could be accessed with a single successful intrusion is what makes centralized systems high-value targets — and high-consequence when they fail.
One Medical and the Medical Records Problem
The One Medical breach, discovered in June, involved archived medical records. The specifics of the attack vector and exact data scope were still being disclosed at time of writing, but the category of data involved — medical records, including diagnoses, prescription histories, and patient communications — is among the most sensitive that any cloud system can hold.
Health data is uniquely consequential when exposed. Unlike a credit card number, which can be cancelled, a medical history is permanent. Employers, insurers, and others may use health information in decisions about employment and coverage in ways that are difficult to trace back to a breach and nearly impossible to remedy after the fact. The HIPAA regulatory framework provides some protections and disclosure requirements, but it cannot undo the harm from data that’s already in circulation.
One Medical’s situation illustrates a specific risk pattern: the breach targeted archived records, not the active system. Data that is no longer operationally necessary but hasn’t been deleted is sometimes less carefully secured than the primary production environment — it’s “behind” the main security perimeter in organizational priority terms, even if it holds equally sensitive data.
The takeaway for personal file storage: deletion policies matter. Services that archive your data indefinitely — even data you no longer actively use — maintain a larger attack surface than services that apply retention limits and make deletion permanent when requested.
Foxconn: When Your Supplier’s Breach Becomes Your Problem
The Foxconn breach — 8 TB of data stolen in a ransomware attack — is a reminder that supply chain exposure isn’t limited to software. Foxconn manufactures devices for Apple, Google, Microsoft, and dozens of other technology companies. The stolen data included product specifications, manufacturing processes, financial information, and — according to preliminary reports — some employee and partner data from Foxconn’s technology clients.
Foxconn’s breach didn’t directly expose end users’ personal files. But it illustrates third-party risk in a way that’s relevant to any discussion of cloud storage: the security of your data depends not just on the company you’re storing with, but on every vendor and partner that company relies on. A cloud storage provider that uses third-party infrastructure, content delivery networks, or AI processing services inherits some fraction of each partner’s attack surface.
This is not a reason to avoid cloud storage — the risks of local-only storage (device loss, fire, theft, no off-site backup) are real and significant. It’s a reason to ask specific questions: Where does my data actually go? Which third parties can access it? What audit rights exist over those parties?
The FBI Surveillance System Breach
The FBI’s declaration of a “major cyber incident” — involving a surveillance system compromised by suspected Chinese state actors — is qualitatively different from the other breaches on this list. This wasn’t a ransomware group seeking financial leverage; it was a state-sponsored operation seeking intelligence.
What was in the compromised system? The FBI has been careful in its public statements. What’s known is that this was a surveillance infrastructure system, meaning it likely contained records of investigative activities, communications intercepts, or surveillance coordination data.
The relevance to personal file storage is indirect but real. State-sponsored attackers who compromise law enforcement surveillance infrastructure often do so to identify who is being watched and why. If cloud providers receive legal process from law enforcement agencies that have been compromised, the resulting responses could theoretically be intercepted or misdirected. This is a theoretical risk, not an established fact from this incident — but it illustrates why transparency about legal process and jurisdiction matters when evaluating cloud storage providers.
What These Breaches Share
Looking across the four incidents:
Centralized data creates concentrated risk. Whether it’s 9,000 institutions’ records in one attack (Canvas), archived patient histories in one server environment (One Medical), or manufacturing intelligence in one corporate network (Foxconn), the common thread is that consolidation in the name of convenience or efficiency also consolidates risk. A successful attack on the centralized system reaches everything.
Credential compromise is usually the entry point. The Canvas breach and most large-scale cloud breaches begin not with exotic zero-days but with valid credentials that were obtained elsewhere and reused here. The attacker finds an account that has more access than it should, and moves laterally from there. Password hygiene, multi-factor authentication, and credential monitoring are not exciting topics, but they account for the majority of preventable intrusions.
Archived data is under-secured. The One Medical breach hitting archived records is consistent with a broader pattern. Data that institutions don’t actively need day-to-day is often stored in cheaper, less-monitored infrastructure with fewer access controls. If it still holds sensitive data — which archived medical and financial records certainly do — the downgrade in security attention creates exposure.
Discovery lags behind intrusion. In all four cases, the time between initial access and discovery was significant. ShinyHunters had substantial time to exfiltrate from Canvas before the breach was detected. The gap between compromise and discovery is where the actual damage happens — the exfiltration that can’t be undone once it’s occurred.
Implications for Personal File Storage
If you’re storing personal photos, voice recordings, personal documents, or sensitive memories in a cloud service, these breaches suggest specific questions worth asking:
What data does the service actually hold about you? A service that stores your files but also logs extensive metadata — access patterns, search queries, feature usage, communications with support — has a larger breach footprint than one that holds your files and little else.
What is the retention policy? Services that archive data after you stop using it, or that retain indefinitely “for legal compliance,” have more historical exposure than services with active deletion commitments. When an account is deleted, is the data actually deleted?
What credentials protect access? Your cloud storage is only as secure as the authentication protecting it. Services that support hardware security keys, prompt for re-authentication before sensitive operations, and notify you of new logins reduce the risk that compromised credentials elsewhere lead to a breach of your personal storage.
Who are the third parties? AI processing services, content delivery networks, analytics tools — each represents a relationship where your data (or signals derived from it) may travel. Services that minimize third-party data sharing reduce the supply chain risk the Foxconn breach illustrates.
What happens in a breach? Does the service have a published incident response policy? How have they handled past incidents? GDPR-obligated providers must notify authorities within 72 hours of discovering a breach; that obligation concentrates organizational attention on detection and response in a way that voluntary commitments sometimes don’t.
A Different Risk Profile
daftei is a subscription-funded service that stores your files with TLS 1.3 in transit and AES-256 encryption at rest. It’s GDPR and CCPA compliant, doesn’t sell data, doesn’t run ads, and doesn’t use your content for AI training. Account deletion triggers a 30-day grace window followed by permanent irreversible erasure.
These specifics address the breach risk profile in concrete ways. Encryption at rest means that if storage infrastructure were accessed without authorization, the files themselves would be protected by the encryption layer. GDPR compliance creates accountability for breach notification and response. Minimal third-party data sharing reduces the supply chain exposure that incidents like Foxconn illustrate.
daftei is not impervious to intrusion — no cloud service can claim that honestly. But the architecture is designed to minimize what’s accessible in the event that access controls fail, and the business model creates no incentive to retain data beyond what’s necessary to provide the storage service.
What You Should Do Today
Regardless of which cloud services you use, the 2026 breach landscape suggests several practical steps:
Enable multi-factor authentication on every cloud storage account. Authenticator apps (TOTP-based) are better than SMS; hardware keys are better still. The majority of cloud storage breaches begin with credential reuse, and MFA breaks that chain.
Audit your third-party app access. Services and apps that have been granted access to your cloud storage (photo editors, backup tools, productivity apps) represent attack surface beyond the primary provider. Remove access for anything you no longer actively use.
Check data broker records for your email address. Breach notification services (like Have I Been Pwned) will tell you if credentials associated with your email have appeared in known breach datasets. If they have, change passwords on any service where that credential was reused.
Review deletion and retention policies. If you have accounts at services you no longer use, delete them rather than letting them sit. Dormant accounts with retained data are exposure without benefit.
The 2026 breach wave isn’t evidence that the cloud is categorically unsafe. It’s evidence that scale, centralization, and inadequate credential management create specific, predictable risks — and that taking those risks seriously means asking pointed questions rather than assuming the problem belongs to someone else.