The month of May 2026 has proven to be a watershed moment for cybersecurity, characterized by a series of high-impact data breaches that have exposed the personal, biometric, and intellectual property of millions. As the SecureIDsafe threat-research team, we have monitored these developments closely. The recurring theme across these incidents is not just the sophistication of the attackers, but the inherent vulnerability of centralized data storage. When organizations hold the keys to their users' data, they become the ultimate target for threat actors.
What happened
DentaQuest: 15 Million Records Exposed
In one of the largest healthcare-related breaches of the year, DentaQuest reported a significant network breach occurring in May 2026 [1]. The incident resulted in the exposure of sensitive personal information for approximately 15 million individuals. The stolen data included Social Security numbers, vision health records, and dental health information. This breach highlights the extreme risk associated with storing high-value identifiers like SSNs in a format that can be read by the service provider or an intruder who gains administrative access to the network.
NYC Health + Hospitals: Biometric Data Compromise
Also in May 2026, NYC Health + Hospitals confirmed a breach involving a third-party vendor that affected at least 1.8 million people [2]. Unlike typical credential leaks, this incident was particularly severe because it involved the exposure of biometric data, specifically fingerprints and palm prints. Biometric data is immutable; once a fingerprint is compromised, it cannot be changed like a password. The reliance on a third-party vendor for processing such sensitive data created a secondary point of failure that attackers successfully exploited.
GitHub: Source Code Theft by TeamPCP
In the realm of intellectual property, the developer platform GitHub was targeted by a threat group known as TeamPCP in May 2026 [3]. The group claimed responsibility for stealing approximately 4,000 developer code repositories. Rather than demanding a ransom, the attackers stated their intent to sell the stolen internal source code. This incident demonstrates that even technically sophisticated platforms are susceptible to repository-level access breaches, which can lead to the exposure of proprietary algorithms and internal security secrets.
Instructure (Canvas): Nationwide Educational Impact
Educational technology provider Instructure, which operates the Canvas learning management system, faced a nationwide security incident starting in early May 2026 [4]. A threat actor exploited a vulnerability in the Canvas platform to gain unauthorized access, making unauthorized changes to pages and potentially accessing student and institutional data [4], [5]. The incident affected numerous universities and schools across the United States, illustrating how a single vulnerability in a centralized service can have a cascading effect across thousands of downstream organizations.
Why it matters
These incidents represent a fundamental failure of the traditional security model. In the cases of DentaQuest and NYC Health + Hospitals, the organizations acted as custodians of plaintext or reversible data. Because the providers held the keys to decrypt or access the records for their own operational needs, any attacker who bypassed the perimeter security effectively gained the same level of access as the provider.
Furthermore, the GitHub and Instructure breaches show that even when the primary goal is not identity theft, the exposure of internal infrastructure and source code can lead to long-term security degradation. When a provider stores data in a way that they can access, they are creating a "honeypot" that is mathematically certain to be targeted. The cost of these breaches—ranging from identity theft protection for millions to the loss of competitive advantages in source code—continues to rise, yet the underlying architecture of these services remains largely unchanged.
How zero-knowledge changes this
SecureIDsafe’s architecture is designed to neutralize the impact of the very types of breaches seen this month. By moving away from centralized trust, we ensure that even a total server-side compromise results in zero usable data for an attacker. Our security model is built on four pillars that would have fundamentally changed the outcome of the May 2026 incidents:
- AES-256 Client-Side Encryption: In the DentaQuest breach, if the 15 million SSNs had been encrypted using AES-256 on the user's device before being uploaded, the attackers would have only retrieved encrypted blobs. Without the keys, the data is mathematically useless.
- Device-Derived Keys: Unlike the NYC Health + Hospitals vendor, SecureIDsafe never holds the encryption keys. Keys are derived locally on the user's hardware. This means there is no central database of keys for an attacker to steal, and no "master key" that can be coerced from the provider.
- Ciphertext-Only Storage: Our servers only store ciphertext. In a scenario like the GitHub breach, an attacker gaining access to our storage environment would find no readable source code, no plaintext metadata, and no way to reverse the encryption. The provider is truly "zero-knowledge" regarding the content of the data.
- Non-Bypassable 24-Word BIP-39 Seed: Recovery is handled through a 24-word seed phrase that the provider cannot reset or bypass. This eliminates the social engineering and "vishing" risks that often lead to administrative account takeovers in centralized systems.
By adopting a zero-knowledge framework, organizations can ensure that a breach of their infrastructure does not become a breach of their users' privacy. The events of May 2026 make it clear: if you don't own the keys, you don't own the data.