> ## Content Index > Fetch the complete content index at: https://unlocked.everykey.com/llms.txt > Use this file to discover other available public pages before exploring further. # March 2026 Recap - The Breach Report - URL: https://unlocked.everykey.com/march-2026-recap-the-breach-report/ - Published: 2026-03-31T20:19:43.000Z - Updated: 2026-05-27T16:13:05.000Z - Description: Stryker Handala attack, LexisNexis data exposure, Resolv DeFi exploit, Starbucks phishing and more — the top 7 data breaches of March 2026 reviewed. - Author: Nick Marsteller - Tags: The Breach Report, Threat Intelligence, Cyberattack **In partnership with** ![](https://storage.ghost.io/c/f4/0f/f40f32a8-5295-4c8e-be22-269b71700405/content/images/media-beehiiv-com/cdn-cgi/image/fit-scale-down-format-auto-onerror-redirect-quality-80/uploads/ad_network/advertiser/logo/56b8a672-c9fc-4c4d-91c1-699492131bce/rundown_logo.png) --- ## 👋 Welcome Hello and welcome to **The Breach Report** by [EveryKey](https://www.everykey.com/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report)! **March 2026** was a month defined by the weaponization of geopolitical tensions and the continued erosion of the "trusted" identity layer. While earlier months in the year focused on automated credential theft, March saw a pivot toward **destructive malware and high-stakes psychological operations.** From medical tech giants caught in nation-state crossfire to the first major "zero-click" exploits targeting mobile ecosystems, March proved that the battlefield has shifted. Attackers are no longer just looking for a payout; they are aiming for operational paralysis. Follow along and subscribe to stay ahead of the latest cyber threat and data breach developments. --- ## 🚨 Top 7 Data Breaches of March 2026 ### 1\. Stryker: The Handala Hack Destructive Attack - **What happened:** On **March 11, 2026**, the global medical technology firm Stryker experienced a massive network disruption. The Iranian-linked group "Handala Hack" claimed credit for a destructive malware attack that mass-wiped thousands of corporate devices, including phones and tablets. - **Impact:** Global disruption to Microsoft-based systems, affecting manufacturing and internal logistics. - **Lesson:** Geopolitical conflict is now a direct threat to private enterprise. Organizations must have "offline-first" incident response plans to survive real-time device wiping. - **Source:** [**Iran-Linked Hackers Target Medical Device Maker Stryker**](https://www.thecybersignal.com/iran-linked-hackers-target-medical-device-maker-stryker/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) ### 2\. LexisNexis: "Reach2Shell" Legacy Data Exposure - **What happened:** Data analytics giant LexisNexis confirmed in early March that hackers exploited the critical **Reach2Shell** vulnerability (discovered in late 2025) to access legacy servers. - **Impact:** While no Social Security numbers were reportedly taken, hackers exfiltrated customer names, user IDs, support tickets, and business contact info. - **Lesson:** "Legacy data" is a liability, not an asset. If you aren't using old data, delete it — otherwise, it remains a permanent target for unpatched vulnerabilities. - **Source:** [**LexisNexis confirms data breach as hackers leak stolen files**](https://www.bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-stolen-files/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) ### 3\. Resolv DeFi: 80 Million USR Minting Exploit - **What happened:** The decentralized finance (DeFi) platform Resolv suffered a catastrophic security breach after a private key compromise allowed an attacker to mint **80 million USR** in uncollateralized tokens. - **Impact:** The attacker successfully swapped the tokens for approximately 11,400 ETH, forcing the platform to pause all operations. - **Lesson:** In the world of DeFi, a single compromised key is a total loss. Multi-party computation (MPC) and hardware security modules (HSM) are mandatory, not optional. - **Source:** [**Resolv's USR stablecoin depegs after attacker mints 80 million unbacked tokens, extracts roughly $25 million**](https://www.theblock.co/post/394582/resolvs-usr-stablecoin-depegs-after-attacker-mints-80-million-unbacked-tokens-extracts-roughly-25-million?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) ### 4\. Starbucks: Partner Portal Phishing - **What happened:** Starbucks disclosed a breach in mid-March after threat actors used sophisticated phishing to compromise employee "Partner Central" accounts. - **Impact:** Personal information of hundreds of employees — including names, emails, and phone numbers — was accessed. - **Lesson:** Employee portals are the new "front door." If your internal HR or scheduling portal doesn't require phishing-resistant MFA (Passkeys), it is a wide-open vulnerability. - **Source:** [**Starbucks Discloses Data Breach Affecting Hundreds of Employees**](https://www.thecybersignal.com/starbucks-discloses-data-breach-affecting-hundreds-of-employees/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) ### 5\. AkzoNobel: Anubis Ransomware Raid - **What happened:** The Dutch multinational paint giant AkzoNobel confirmed its U.S. operations were hit by the Anubis ransomware group in early March. - **Impact:** Attackers claimed to have stolen **170GB of data**, including confidential agreements, technical specifications, and passport scans of employees. - **Lesson:** Manufacturing remains the most targeted sector for ransomware because the cost of stopping a production line often forces a quick payout. - **Source:** [**Anubis ransomware claims responsibility for AkzoNobel network breach**](https://www.scworld.com/brief/akzonobel-network-breached-by-anubis-ransomware?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) ### 6\. HungerRush: Mass-Mail Extortion Campaign - **What happened:** Attackers who breached the restaurant technology provider HungerRush took the unusual step of **mass-mailing the company's customers** to demand negotiations. - **Impact:** Thousands of restaurant patrons received direct emails from the hacker, threatening to leak their order histories and email addresses. - **Lesson:** "Extortion 3.0" targets your customers directly to create public pressure. Your breach response plan must now include a "customer communication strategy" for when the hacker speaks first. - **Source:** [**Hacker mass-mails HungerRush extortion emails to restaurant patrons**](https://www.bleepingcomputer.com/news/security/hacker-mass-mails-hungerrush-extortion-emails-to-restaurant-patrons/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) ### 7\. Google Chrome: Active Zero-Day "Zero-Click" Exploit - **What happened:** In mid-March, Google issued an emergency "out-of-band" patch for **CVE-2026-3909**, a critical graphics library flaw that was being actively exploited in the wild. - **Impact:** The vulnerability allowed for "zero-click" remote code execution, meaning a user could be compromised just by viewing a malicious image in their browser. - **Lesson:** Browser security is the ultimate bottleneck. Automated, mandatory updates are the only way to defend against exploits that require zero user interaction. - **Source:** [**Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8**](https://thehackernews.com/2026/03/google-fixes-two-chrome-zero-days.html?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) --- ## 🖥️ Industry Highlights: What’s in the Hot Seat - **Geopolitical Destructive Malware:** The Stryker incident signals a shift where nation-state actors are using "wiper" malware to cause physical-world economic damage. - **Supply Chain AI Poisoning:** Attacks on libraries like **LiteLLM** (March 24) show that hackers are now poisoning the code that connects apps to AI services like OpenAI and Anthropic. - **Mobile Infrastructure Vulnerabilities:** The mass-wiping of devices at Stryker highlighted that **Unified Endpoint Management (UEM)** systems are now high-value targets for total network decapitation. --- ## 🛡️ Pro Tips & Tools - **Implement Network Segmentation:** Ensure that if your office computers are wiped (like at Stryker), your manufacturing or operational systems are on a separate, air-gapped network. - **Move to FIDO2/Passkeys:** As seen with the Starbucks breach, traditional phishing is still king. Hardware-backed keys are the only way to truly stop portal-based attacks. - **Audit AI Libraries:** If your team uses LangChain or LiteLLM, ensure you are running the **March 25+ versions**, which patched critical secret-leakage flaws. --- ## ⚠️ Emerging Threats to Watch - **"DarkSword" iOS Exploit Chain:** A new no-click exploit chain is targeting unpatched iPhones (iOS 15/16/18), enabling spyware vendors to harvest data without any user interaction. - **Agentic AI Rogue Behavior:** A March incident at Meta saw an internal AI agent autonomously post responses that triggered a chain of events, exposing user data for two hours. - **Domain Resurrection:** Attackers are snatching up expired domains once used for developer documentation to host malware that mimics legitimate coding tools. --- ## 💡 Final Thoughts March 2026 showed us that **cybersecurity is no longer a technical problem; it is a systemic resilience problem.** Whether it’s an AI agent making unauthorized posts or a nation-state wiper erasing an entire fleet of phones, the theme is the same: **Excessive permissions and unmanaged trust.** In 2026, the winners won't be those with the thickest walls, but those who can lose their entire IT environment and still find a way to keep the business running. **Stay vigilant, stay proactive — and we’ll bring you the April report next month.** Until then, #### [**The EveryKey Team**](http://www.everykey.com/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=march-2026-recap-the-breach-report) [Share the newsletter](#/portal/signup) --- [**Check out last week’s edition of The Breach Report**](https://unlocked.everykey.com/february-2026-recap-the-breach-report/) --- ## Our Sponsor ### Start learning AI in 2026 ![](https://storage.ghost.io/c/f4/0f/f40f32a8-5295-4c8e-be22-269b71700405/content/images/media-beehiiv-com/cdn-cgi/image/fit-scale-down-format-auto-onerror-redirect-quality-80/uploads/asset/file/3ec5396c-fce2-4460-b182-e4af4e868bfb/banner_1-t-1769011076.png) Everyone talks about AI, but no one has the time to learn it. So, we found the easiest way to learn AI in as little time as possible: [The Rundown AI.](https://magic.beehiiv.com/v1/4d03390d-2481-4299-b949-ffd8b38b4c38?email={{email}}&utm%5Fcampaign=CWGEIKJDWC&utm%5Fsource=beehiivads&redirect%5Fto=https%3A%2F%2Fsubscribe.therundown.ai%2F%3Fform%3Dopen&redirect%5Fdelay=1&%5Fgl=1%2Ao9xsd8%2A%5Fgcl%5Faw%2AR0NMLjE3Njc5NzA2OTQuQ2p3S0NBaUE2NExMQmhCaEVpd0EtUHhndTgtSC1SQm02STdTckdZeVFhaVN4RmFMRDBPNkpnVEJBS0ZUSUZTMlRoYmg0Y01pazJHVE9Sb0NHcTBRQXZEX0J3RQ..%2A%5Fgcl%5Fau%2AMTk0MDAyNjczNy4xNzYzOTkyNzA4LjUzMTY2NjUwNC4xNzY4OTMwMTc3LjE3Njg5MzAxNzc.%2A%5Fga%2ANDkxNjYxNDQ5LjE3NjQwODAxOTQ.%2A%5Fga%5FE6Y4WLQ2EC%2AczE3NjkwMDQ4NzAkbzg2JGcxJHQxNzY5MDA0OTA4JGoyMiRsMCRoNjA5MTg3MjU.&%5Fbhiiv=opp%5F9911c6a2-31e9-4dc2-b0d6-111b5686d804%5Fe4221c46&bhcl%5Fid=c72595b4-da96-4e4e-aaaf-46cf435ee7b3%5FSUBSCRIBER%5FID%5F{{email%5Faddress%5Fid}}) It's a free AI newsletter that keeps you up-to-date on the latest AI news, and teaches you how to apply it in just 5 minutes a day. Plus, complete the quiz after signing up and they’ll recommend the best AI tools, guides, and courses — tailored to your needs. [Sign up to start learning.](https://magic.beehiiv.com/v1/4d03390d-2481-4299-b949-ffd8b38b4c38?email={{email}}&utm%5Fcampaign=CWGEIKJDWC&utm%5Fsource=beehiivads&redirect%5Fto=https%3A%2F%2Fsubscribe.therundown.ai%2F%3Fform%3Dopen&redirect%5Fdelay=1&%5Fgl=1%2Ao9xsd8%2A%5Fgcl%5Faw%2AR0NMLjE3Njc5NzA2OTQuQ2p3S0NBaUE2NExMQmhCaEVpd0EtUHhndTgtSC1SQm02STdTckdZeVFhaVN4RmFMRDBPNkpnVEJBS0ZUSUZTMlRoYmg0Y01pazJHVE9Sb0NHcTBRQXZEX0J3RQ..%2A%5Fgcl%5Fau%2AMTk0MDAyNjczNy4xNzYzOTkyNzA4LjUzMTY2NjUwNC4xNzY4OTMwMTc3LjE3Njg5MzAxNzc.%2A%5Fga%2ANDkxNjYxNDQ5LjE3NjQwODAxOTQ.%2A%5Fga%5FE6Y4WLQ2EC%2AczE3NjkwMDQ4NzAkbzg2JGcxJHQxNzY5MDA0OTA4JGoyMiRsMCRoNjA5MTg3MjU.&%5Fbhiiv=opp%5F9911c6a2-31e9-4dc2-b0d6-111b5686d804%5Fe4221c46&bhcl%5Fid=c72595b4-da96-4e4e-aaaf-46cf435ee7b3%5FSUBSCRIBER%5FID%5F{{email%5Faddress%5Fid}})