/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

Field Notes: Six Outages and Breaches from Mid-2026

Field Notes  · 634 words · 3 min read · by QiO:~$ ·

Field Notes: Six Outages and Breaches from Mid-2026

A quick survey of what actually happened across a few rough months in 2026 — a breach, two cloud outages, a data center fire, and a ransomware extortion attempt.

A few incidents from earlier this year are worth a quick look, less for drama and more because they're useful, concrete examples of how different "something went wrong" actually looks in practice.

Carnival Corporation — social engineering, June 2026. Attackers used social engineering to compromise an employee account, gaining access to a limited portion of Carnival's IT systems. Nearly 6 million people were affected — names, addresses, emails, phone numbers, and dates of birth across the board, with passport and driver's license numbers exposed for some. No malware, no exploit code. Just a convincing enough pretext to get someone to hand over access.

AWS data center, UAE — physical damage, March 2026. Unidentified objects struck one of AWS's UAE data centers, starting a fire. Firefighters cut power to the facility to control it, taking out services tied to that regional group. What exactly hit the building was never confirmed publicly, though the timing coincided with regional conflict activity nearby — which makes this closer to collateral physical damage than a weather event. A reminder that "the cloud" still runs on buildings that can be damaged by things entirely outside an attacker's control, or an organization's.

Kodak — ransomware extortion, June 2026. The ShinyHunters group claimed to have stolen 2.2 million records from Kodak and set a leak deadline to pressure payment. Kodak confirmed unauthorized access. Classic double-extortion playbook: steal first, encrypt or don't, threaten to publish either way.

Google Cloud, Netherlands — infrastructure failure, July 2026. An electrical fault upstream of a Netherlands data center knocked out power distribution gear, which in turn took down the cooling system for that zone. No attacker involved at all — just a hardware failure with a cascading effect, which is its own kind of lesson about dependency chains.

AWS CloudFront — configuration failure, July 2026. A failure in how CloudFront distributed configuration updates to the systems managing VPC-origin connections caused roughly three and a half hours of elevated errors. The technical cause was narrow — a constraint in one subsystem — but the blast radius was wide, since CloudFront sits upstream of a lot of other infrastructure. Canvas and Blackboard, among others, both went down as a downstream effect, which meant students and teachers lost access during the outage too.

Canvas/Instructure — unauthorized access, April–May 2026. Separately from the CloudFront outage above, Canvas had its own incident in the spring: ShinyHunters claimed 3.65 TB of data from roughly 275 million users across nearly 8,800 institutions, tied to an issue with Free-for-Teacher trial accounts. Exposed data included names, emails, student ID numbers, and private messages between students and teachers — no passwords or financial data, per Instructure. The exact mechanism (a compromised account versus an actual flaw in the signup flow) was never spelled out publicly, so I'd call this unauthorized access rather than a confirmed software exploit.

The Takeaway

Line these six up and the variety is the point: a phished employee, debris from a regional conflict, a pure hardware failure, a config rollout gone wrong, and two separate incidents hitting the same platform months apart. "Security" covers all of it, and most of it has nothing to do with a hacker in a hoodie.

Sources

Read next

A Sample Cybersecurity Policy for a Small DoD Subcontractor