# May 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

> An independent, attributed roundup of the major cybersecurity incidents of May 2026 — from the ShinyHunters Canvas/Instructure extortion and the TanStack supply-chain worm that reached OpenAI to the DigiCert code-signing abuse, a suspected Iranian attack on US gas-station tank gauges, and breaches at Carnival, Charter/Spectrum, West Pharmaceutical and more. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

Source: https://playciso.com/blog/may-2026-cybersecurity-breaches-roundup · Published: 2026-05-31 · Publisher: PlayCISO (https://playciso.com)

---

May 2026 was a month of **identity-driven extortion and software supply-chain compromise** far more than classic network break-ins. The **ShinyHunters** group dominated the headlines — from the **Canvas/Instructure** education-platform extortion to data-theft disclosures at **Carnival** and **Charter/Spectrum** — while a fast-moving npm supply-chain worm reached **OpenAI**, **DigiCert** had code-signing certificates abused to sign malware, and CNN reported a suspected-Iranian intrusion into **US gas-station tank gauges**. This is an independent, attributed digest: every figure is sourced, each item is marked **confirmed**, **claimed** or **reported**, with a defensive takeaway. _PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party’s conduct._ ## Method, and a note on the severity scores We checked each item against primary reporting and vendor statements, corrected numbers where sources disagreed, and flagged anything we could not stand up. Where a figure comes from an attacker’s leak-site post rather than the affected organisation — as with the Canvas user count or Foxconn’s data volume — we say so explicitly and treat it as a **claim**. Some incidents this month began with an intrusion in April and became public, or escalated, in May; we include those and note the timeline. The **editorial severity** beside each entry is a **subjective PlayCISO reading out of ten** — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is **not CVSS, not EPSS and not any recognised standard**; use it as a quick relative signal only. Several of the highest-profile numbers this month are **unverified threat-actor claims**, not confirmed facts. ## Confirmed: supply-chain and code-signing compromises - DigiCert — support-portal social engineering, code-signing certificates abused. An attacker posing as a customer used DigiCert’s support chat to deliver a malicious file (reported as a .scr screensaver inside a ZIP), compromising support-analyst sessions. DigiCert said it processed and then revoked 60 EV certificate orders, with 27 explicitly linked to the threat actor; the misissued certificates were reportedly used to sign malware. Disclosure landed in early May. Status: Confirmed. Editorial severity: 8/10. Takeaway: your certificate authority’s help desk is part of your trust chain — hunt for software signed by any of the revoked certificates, and treat support portals as a social-engineering target, not a convenience. - TanStack npm supply-chain worm — OpenAI among downstream victims. On 11 May a group calling itself TeamPCP exploited the TanStack package-publishing process to push dozens of malicious artifacts; TanStack said the attacker engineered a path where its own CI pipeline leaked its publish token, so no maintainer was directly phished. OpenAI confirmed on 14 May that two employee devices were affected, that only a limited subset of internal repositories and some credential material were reachable, and that no customer data, production systems or IP were impacted; it rotated code-signing certificates as a precaution. The campaign reportedly also touched packages tied to Mistral AI, Guardrails AI, UiPath and OpenSearch, and GitHub disclosed a linked internal-environment breach around 20 May. Status: Confirmed. Editorial severity: 7/10. Takeaway: CI/CD publish tokens are a live supply-chain attack surface — scope them tightly, expire them fast, and audit which internal repos one developer device can reach. Rehearse the blast radius with our threat-model tool. - Grafana Labs — internal codebase stolen, ransom refused. Grafana disclosed that attackers stole portions of its internal codebase in a supply-chain-related breach around 17–18 May and attempted to inject code into customer repositories using a compromised token; the company said it refused the ransom demand. Status: Confirmed. Editorial severity: 6/10. Takeaway: source-code theft is an intelligence loss, not game over — but rotate any tokens the attacker could have reached and watch for tampering downstream. - Microsoft Exchange Server (CVE-2026-42897) added to CISA KEV. On 15 May CISA added a cross-site-scripting flaw in Microsoft Exchange Server to its Known Exploited Vulnerabilities catalog on evidence of active exploitation, setting a remediation deadline for federal agencies. Status: Confirmed (actively exploited). Editorial severity: 7/10. Takeaway: on-prem Exchange remains a favourite target — if you still run it, patch to the current cumulative update and prioritise anything in the KEV catalog over raw CVSS. ## Confirmed: major data breaches and extortion **Instructure / Canvas (ShinyHunters) — the month’s signature extortion.** Status: **Intrusion confirmed; headline figures claimed**. Editorial severity: 9/10. Attackers accessed Canvas systems around 25 April; Instructure detected and contained the incident, then on 7 May the Canvas login page was replaced with a ransom message and an outage followed. By 11 May the company said it had reached an agreement with the attacker and that the stolen data was destroyed, and a proposed class action was filed on 13 May. Instructure confirmed that **names, email addresses, student ID numbers and messages** were taken and said it found no evidence that passwords, dates of birth, government IDs or financial data were involved. ShinyHunters’ claims of about **275 million users, 3.65 TB and ~9,000 institutions** — and a reported ransom payment with a rumoured 10-million-dollar demand — remain **unverified**. _Takeaway: education platforms are now top-tier targets because of the sheer breadth of young people’s records they hold; verify an attacker’s scope figures before repeating them in your own comms._ - Carnival Corporation (ShinyHunters). Carnival confirmed a breach affecting about 5.99 million people (its Maine filing lists 5,995,277), after an attacker used social engineering to obtain an employee’s access on 14 April and copy personal data; notifications began 27 May. Exposed data includes names, addresses, emails, phone numbers, dates of birth and government ID numbers; card details and passwords were reportedly not included. An earlier 8.7-million figure was the attacker’s unverified claim. Status: Confirmed (about 5.99M). Editorial severity: 7/10. Takeaway: expect phishing and smishing against affected customers and brief your support teams. - Charter / Spectrum (ShinyHunters extortion). Charter Communications disclosed that customer information was stolen under extortion threats, with reporting putting potential impact at nearly 5 million customers after a voice-phishing (vishing) attack against cloud identity access. Status: Confirmed (breach); scope still firming. Editorial severity: 6/10. Takeaway: vishing against help desks keeps working — add call-back verification and out-of-band checks before any access change. - West Pharmaceutical Services (ransomware). The pharmaceutical-components maker detected an intrusion around 4 May, filed an 8-K with the SEC, and confirmed that data was exfiltrated and systems encrypted, taking parts of its global network offline and disrupting manufacturing and shipping; it engaged Unit 42 and no group had publicly claimed the attack at the time of writing. Status: Confirmed. Editorial severity: 7/10. Takeaway: a components supplier going dark is a supply-chain shock for its customers — map your critical suppliers and your fallbacks before one of them is encrypted. - Mediaworks (Hungary) / World Leaks. The Hungarian media company confirmed that attackers stole and leaked roughly 8.5 TB of internal data — payroll records, contracts, financial files and internal communications — in an incident claimed by the World Leaks group around 4 May. Status: Confirmed. Editorial severity: 6/10. Takeaway: once data is on a leak site, assume it is permanent; focus on notification, legal exposure and the next intrusion. ## Confirmed attack, claimed data; plus nation-state and critical-infrastructure activity - Foxconn / Nitrogen. Foxconn acknowledged a cyber attack after the Nitrogen ransomware group claimed to have stolen about 8 TB of data, including files it said were tied to Apple and NVIDIA projects. Status: Attack acknowledged; 8 TB theft claimed (unverified). Editorial severity: 6/10. Takeaway: a manufacturing partner’s breach can expose your own product roadmaps — contractually require breach notification from your suppliers. - US gas-station tank gauges — suspected Iran. CNN reported on 15 May that intruders reached automatic tank-gauge (ATG) systems at gas stations across several US states — devices sitting online with no password protection — and in some cases altered displayed readings without changing actual fuel levels. Officials named Iran as a leading suspect given its history of targeting such systems, while cautioning that attribution might not be provable; CISA did not comment publicly and the FBI declined to comment. No physical harm was reported. Status: Reported (intrusion credible; Iran attribution suspected, not confirmed). Editorial severity: 6/10. Takeaway: unauthenticated OT on the public internet is still a live problem a decade after the first warnings — inventory and firewall every internet-exposed device. - MuddyWater (Iran-linked) social engineering. Reporting this month tied the Iran-linked MuddyWater group to Microsoft Teams social-engineering intrusions that stole credentials and data while using Chaos ransomware as a decoy, alongside a longer intrusion at a South Korean electronics maker. Status: Reported. Editorial severity: 5/10. Takeaway: collaboration tools like Teams are now a phishing channel in their own right — extend your anti-phishing controls and user training beyond email. ## Claimed and unverified: treat as threat-actor marketing - Liberty Mutual / Everest (108 GB claim). The Everest group claimed to have stolen more than 108 GB of policyholder data; Liberty Mutual said its initial investigation found no evidence of a compromise of its own systems and indicated the incident may be linked to a third-party vendor. Status: Claimed (company disputes compromise of its systems). Editorial severity: 5/10. Takeaway: a leak-site listing is an allegation, not a confirmed breach — but it is still worth running down the third-party angle. ## Is AI really doing the hacking now? May’s most AI-relevant story is not a chatbot writing exploits — it is attackers **targeting the AI toolchain itself**. The TanStack supply-chain worm reached **OpenAI** and reportedly touched packages tied to **Mistral AI** and **Guardrails AI**, which tells you the fast-growing AI-developer ecosystem inherits every weakness of the npm and CI/CD plumbing underneath it. Separate, single-source reporting described a group dubbed **GreyVibe** using mainstream assistants to automate phishing and malware development; we flag that as **reported and unverified**. The honest read: AI is clearly accelerating and scaling _parts_ of attacks — reconnaissance, phishing, package-poisoning triage — while sweeping “the AI did the whole hack” headlines keep outrunning the evidence. Weight confirmed vendor disclosures over threat-actor claims, and treat your AI dependencies as ordinary software supply chain. ## What to do this week - Harden help desks and support portals against social engineering — the DigiCert, Carnival and Charter cases all turned on a human being talked into granting access. Add call-back verification and out-of-band checks before any credential or access change. - Treat code-signing certificates and publish tokens as crown jewels. Short lifetimes, tight CI/CD scoping, and alerting on new signatures; audit your dependencies for the TanStack-linked malicious packages and rotate anything a pipeline could have exposed. - Patch the actively-exploited Exchange flaw (CVE-2026-42897) and prioritise the CISA KEV catalog over raw CVSS. - Inventory internet-exposed OT. The gas-station tank gauges are a reminder that unauthenticated devices online are still being found and abused — firewall or take them offline. - Treat SaaS and third parties as in-scope vendor risk. Score them with our Vendor Risk Scorecard, build in layers so one compromised identity is not game over (defense in depth), watch how data walks out through third parties (what is data leakage), and put a defensible figure on exposure with the Breach Cost calculator (how it is calculated). To automate the checks, see our security APIs. ## Frequently asked questions **Biggest attacks of May 2026?** The ShinyHunters Canvas/Instructure extortion, the TanStack supply-chain worm that reached OpenAI, and the DigiCert code-signing abuse; plus confirmed breaches at Carnival (about 5.99 million people), Charter/Spectrum (nearly 5 million), West Pharmaceutical and Mediaworks, and a suspected-Iranian intrusion into US gas-station tank gauges. **How were the severity scores decided?** A subjective PlayCISO reading out of ten — not CVSS or any standard. Use it as a relative signal only. **Was the Canvas breach as big as reported?** The intrusion is confirmed, but the 275-million-user and 3.65-terabyte figures are ShinyHunters’ unverified claims, and the reported ransom payment was not officially confirmed. **Did Iran hack US gas stations?** CNN reported a credible intrusion into unprotected automatic tank-gauge systems across several states on 15 May; the Iran attribution is suspected, not proven, and CISA and the FBI did not confirm it. **What to do first?** Harden help desks against social engineering, lock down code-signing certificates and CI/CD publish tokens, patch CVE-2026-42897, inventory internet-exposed OT, and treat SaaS and third parties as in-scope vendor risk. Earlier in this series: [the October 2026 roundup](/blog/october-2026-cybersecurity-breaches-roundup).