January 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

January 2026 was a month about people, not exploits. The headline incidents — Match Group, Bumble and Crunchbase — were reached not by breaking servers but by phoning staff and talking them out of their single-sign-on logins. Alongside that social-engineering wave came a run of large breach disclosures whose underlying intrusions actually happened in 2025, a 149-million-credential dump assembled by malware, and a fresh set of actively-exploited vulnerabilities. This is our attributed digest, with a verification status and a clearly-labelled subjective severity on every item.

How to read this roundup (method note)

Every item carries a status — Confirmed (the organisation acknowledged it), Claimed (unverified) (a threat-actor assertion we could not independently verify), or Reported (based on researcher or security-outlet reporting) — and an editorial severity out of ten: a subjective PlayCISO reading of how much a security leader should care given scale, sensitivity and how actionable the fix is. It is not CVSS, not EPSS, and not any recognised standard, and should never be used on its own to prioritise patching. For vulnerabilities, defer to vendor CVSS and the CISA Known Exploited Vulnerabilities catalog; for breaches, to your own data classification and regulatory exposure — our breach-cost estimator and the explainer on what drives data-breach cost are a better basis for your own numbers than any headline figure.

The ShinyHunters social-engineering wave

Crunchbase. The business-intelligence firm confirmed on 26 January that a threat actor exfiltrated documents from its corporate network, while stressing that business operations were not disrupted. ShinyHunters claimed more than 2 million records and posted an archive after an extortion demand was refused; third-party analysis of the posted material reportedly found personal information. Status: Confirmed (breach); the 2-million record count is Claimed (unverified). Editorial severity: 6/10. Takeaway: corporate document stores are a target in their own right; treat SharePoint, Google Drive and Slack as crown-jewel systems, not back office.

Match Group. The dating-app operator confirmed a cybersecurity incident affecting “a limited amount of user data” around 28 January, and said it had no evidence that login credentials, financial information or private communications were taken. ShinyHunters claimed roughly 10 million records; Match did not verify that figure. Reporting attributes the access to voice phishing against Okta SSO. Status: Confirmed (incident); scale Claimed (unverified). Editorial severity: 6/10. Takeaway: make help-desk and identity-provider flows resistant to vishing — callback verification, number matching, and no credential or MFA resets on a voice request alone.

Bumble. Bumble said a contractor account with limited privileges was compromised in a phishing incident and used for brief unauthorised access, and that its member database, user accounts, app and private messages were not affected. ShinyHunters claimed around 30GB of files from Google Drive and Slack. Status: Confirmed (limited incident); the data haul is Claimed (unverified). Editorial severity: 4/10. Takeaway: scope contractor and third-party identities tightly — a vendor assessment (our vendor-risk scorecard is a starting point) should ask what a single compromised contractor account can actually reach.

Large breaches disclosed this month (intrusions mostly in 2025)

Covenant Health. The Massachusetts healthcare provider began notifying 478,188 patients around the New Year that a ransomware attack had exposed names, dates of birth, addresses, Social Security numbers, health-insurance details and treatment information. The Qilin group claimed the attack. Note the timeline: the intrusion dates to May 2025; the revised scope and notifications landed at the end of 2025 and into January 2026. Status: Confirmed. Editorial severity: 8/10. Takeaway: breach scope routinely grows months after detection — budget response and notification for a far larger number than the first count suggests.

CIRO (Canadian Investment Regulatory Organization). Canada’s investment-industry regulator confirmed that about 750,000 investors were affected by a phishing-driven breach, with exposed data potentially including dates of birth, Social Insurance Numbers, government ID numbers and investment-account details. The incident was detected in August 2025; notification letters began on 14 January 2026 after more than 9,000 hours of forensics. Status: Confirmed. Editorial severity: 7/10. Takeaway: a regulator holding bulk financial PII is a high-value target; minimise what you retain and segment it from the mailboxes phishing lands in.

Under Armour. A dataset of roughly 72 million email addresses, plus some names, dates of birth and addresses, was added to Have I Been Pwned as an unconfirmed breach after surfacing on a hacking forum on 21–22 January; reporting ties it to the Everest group and a late-2025 incident. Under Armour said it was investigating and had no evidence that UA.com, payment systems or stored passwords were affected. Status: Reported / Claimed (unverified — HIBP marked it unconfirmed; company investigating). Editorial severity: 5/10. Takeaway: email-only exposures still fuel targeted phishing — warn customers proactively rather than waiting for a confirmed verdict.

Illinois and Minnesota Departments of Human Services. Two U.S. state social-services agencies disclosed exposures — a misconfigured Illinois system and excessive internal access in Minnesota — affecting close to 1 million people combined, including benefits data. Status: Confirmed. Editorial severity: 7/10. Takeaway: misconfiguration and over-broad internal access cause as much harm as intrusions; this is data leakage, and continuous posture review catches it where an annual audit does not.

Credential exposure at scale

149-million-credential database. Researcher Jeremiah Fowler reported on 23 January finding a publicly accessible, unencrypted database of about 149 million unique login-and-password pairs — roughly 96GB spanning email, social-media, financial and dating accounts, including tens of millions of Gmail and Facebook credentials and some government logins. The data appears to have been aggregated by infostealer malware rather than from a single new breach. Status: Confirmed (exposure found and reported; later taken down). Editorial severity: 7/10. Takeaway: infostealer logs make credential reuse lethal — enforce phishing-resistant MFA and passkeys so a stolen password is not a login.

BreachForums. In a notable twist, the cybercrime forum itself was breached, exposing account details of roughly 324,000 users. Status: Confirmed. Editorial severity: 3/10. Takeaway: no system is exempt; the people running breach markets run the same unpatched software everyone else does.

Claimed and unverified

Nike. The WorldLeaks group claimed to have stolen and posted about 1.4TB of internal data; Nike said it was investigating. We found no company confirmation of the volume or contents. Status: Claimed (unverified). Editorial severity: 4/10 (pending confirmation). Takeaway: treat extortion-site claims as leads to verify, not facts — confirm against your own logs before acting on an attacker’s inventory.

Brightspeed. The Crimson Collective claimed data on more than 1 million customers; Brightspeed acknowledged a cybersecurity event in early January but did not confirm the attacker’s figures. Status: Confirmed (event); scale Claimed (unverified). Editorial severity: 5/10. Takeaway: acknowledge the event early and separately from the attacker’s numbers; conflating the two hands the narrative to the extortionist.

Actively-exploited vulnerabilities (CISA KEV additions)

CISA added actively-exploited flaws to its Known Exploited Vulnerabilities catalog twice this month, with federal remediation deadlines attached.

• CVE-2025-68645 — Synacor Zimbra Collaboration Suite (CVSS 8.8, PHP remote file inclusion). An unauthenticated attacker can include arbitrary files via the /h/rest endpoint. Fixed in November 2025; CrowdSec observed exploitation in the wild from 14 January 2026. Added to KEV on 22 January. Status: Confirmed exploited. Editorial severity: 8/10.
• CVE-2025-34026 — Versa Concerto (CVSS 9.2, authentication bypass reaching admin endpoints) and CVE-2025-31125 — Vite (CVSS 5.3, improper access control exposing file contents), both added to KEV on 22 January. Status: Confirmed in KEV.
• CVE-2025-54313 — eslint-config-prettier (CVSS 7.5, embedded malicious code from the July 2025 npm supply-chain compromise that delivered the “Scavenger Loader” infostealer), added 22 January. Status: Confirmed. Editorial severity: 7/10.
• 7 January additions: CVE-2009-0556 (Microsoft Office PowerPoint) and CVE-2025-37164 (HPE OneView), both added on evidence of active exploitation. Status: Confirmed in KEV.

Takeaway: the KEV catalog, not a severity headline, is the right trigger for emergency patching. Internet-facing mail, SD-WAN orchestration and build-pipeline dependencies all appeared this month — which ones you would have to patch first for a given asset is exactly what a threat model makes explicit.

Supply chain: fallout into January

Trust Wallet / Shai-Hulud 2.0. A self-replicating npm worm that spread through hundreds of packages was used to steal Trust Wallet’s GitHub secrets and Chrome Web Store key, then publish a trojanised browser extension that drained wallets. The event itself was late December 2025 (malicious version on 24 December; disclosure on 25 December), with about $8.5 million taken from 2,520 wallet addresses; reimbursement and claims handling continued through January 2026. Status: Confirmed (a December 2025 event with January fallout). Editorial severity: 7/10. Takeaway: a stolen publishing key turns your own release channel into the attack — protect CI/CD secrets and extension-store credentials as tightly as production, and layer controls so one stolen key is not game over (see defense in depth).

On the “AI is doing the hacking now” framing

Expect to see January’s dating-app breaches described as AI-powered. The documented facts point the other way: the ShinyHunters wave was human-driven voice phishing against help desks and identity providers — old-fashioned social engineering executed well, not autonomous AI intrusion. Generative tools lower the cost of convincing lures and voice spoofing at the margins, and that is worth planning for, but we found no primary-source evidence that an AI agent independently carried out any of January’s major breaches. We flag the distinction rather than inflate it. Our security APIs cover the detection side; the threat this month was a phone call, and the control that would have stopped it was a verification step at the help desk.

The through-line

January 2026 rewards the unglamorous controls: phishing-resistant MFA, help-desk verification that cannot be talked past, least-privilege for contractors and third parties, tight control of publishing and CI/CD secrets, and prompt action on the KEV catalog. For the series context, see our October 2026 roundup.

Frequently asked questions

What were the biggest cyber attacks in January 2026? The ShinyHunters wave against Match Group, Bumble and Crunchbase (confirmed incidents, disputed volumes, reached via voice phishing against SSO), plus large breach disclosures of 2025 intrusions — Covenant Health (478,188 patients), CIRO (about 750,000 investors) and an alleged Under Armour exposure (about 72 million emails) — and a researcher-found database of roughly 149 million infostealer-harvested credentials.

Was the Match Group and Bumble breach confirmed? Both confirmed incidents in late January but disputed the attackers’ numbers. Match said only “a limited amount of user data” was affected with no evidence of stolen credentials, finances or messages; Bumble said a limited-privilege contractor account was phished and its member database was not touched. The incidents are confirmed; the headline data volumes are unverified claims.

What vulnerabilities were being actively exploited? CISA added CVE-2025-68645 (Zimbra RFI, exploited from 14 January), CVE-2025-34026 (Versa Concerto), CVE-2025-31125 (Vite) and CVE-2025-54313 (eslint-config-prettier) to its KEV catalog on 22 January, and CVE-2009-0556 (Office) and CVE-2025-37164 (HPE OneView) on 7 January.

How is the severity score calculated? It is a subjective PlayCISO editorial read out of ten, not CVSS or EPSS. Use vendor CVSS and the CISA KEV catalog for patching and your own data classification for breach risk; treat our number as a quick relative signal only.

Is PlayCISO affiliated with the organisations named here? No. PlayCISO is independent and not affiliated with any organisation named. This is a digest of publicly reported events, provided as general information, with several items explicitly marked as unverified threat-actor claims.