Reuters is maintaining something a wire service rarely does: a running ledger of U.S. companies that have reported cyber incidents in 2026, updated as new ones surface.

The January entries alone: Nike, where a ransomware group published 1.4 terabytes of stolen data; the dating apps Bumble and Match Group; Panera Bread. By spring the ledger adds the casino company Wynn Resorts, the toy maker Hasbro, the medical device makers Stryker and Boston Scientific, the healthcare firms NovoCure and Astrana Health, the anime streaming service Crunchyroll, and the company behind Rockstar Games.

A sneaker company, a sandwich chain, a hospital-equipment maker, a casino. Different industries, different months, same year.

What the list has in common

Reuters frames the whole ledger as a surge in cyberattacks that use AI: attacks that steal data and disrupt operations. The same technology that made writing and coding faster has made breaking into companies faster and cheaper too. The playbook that works against a global enterprise runs just as well against a twenty-person shop with none of the enterprise's defenses.

There's a second thread in the coverage that's easy to miss. In July, the White House announced a coordination group to share information on security vulnerabilities found using AI. Reuters notes it hasn't released any details since, even as security incidents piled up at the AI companies themselves. The list includes OpenAI, which reported an issue after a malicious third-party software component got pulled into its own build pipeline. The company says no user data was compromised. The incident still happened.

Washington is still organizing its response. The attacks aren't waiting.

None of the break-ins were exotic

Read down the list and the methods are almost boring.

At Astrana Health, attackers impersonated company personnel and phoned employees from a spoofed corporate number. At OpenAI and at Rockstar Games, the way in came through third-party software and vendors: nearly 80 million business records allegedly taken by exploiting a breach at an analytics provider. At Nike, it was ransomware: steal the data, publish what you don't get paid for. At Wynn Resorts, employee records with a demand for roughly $1.5 million in bitcoin.

Voice fraud is on the same trajectory. Days before the list was published, Reuters reported that fraudsters impersonated a bank's chief executive by text message and cloned a real lawyer's voice on the confirmation call, stealing roughly $108 million. Tens of millions of it is still missing.

The tools got cheaper, which made the same old methods easier to run at scale.

What a smaller company should take from this

Every name on the list has a security budget most businesses can't imagine, and they got hit anyway. That's not a reason to shrug. It's a reason to look at what actually failed, because it's rarely the expensive part.

  • Verify money and data requests on a channel you choose. Call back on a number you already have. The $108 million voice-clone theft would have died at a callback.
  • Turn on multi-factor authentication everywhere it's offered. A second check beyond the password stops the most common way one stolen login becomes a full break-in.
  • Ask your vendors where your data lives. Two incidents on this list moved through third parties, and last week we wrote about a court-records vendor that exposed filings in 11 states. If a company you've never heard of holds your customer list, that's a door you're responsible for even though you didn't build it.
  • Write down your first hour. When Boston Scientific detected its incident in late August, manufacturing and order shipments were disrupted; nine days later it was shipping most products again. The companies that recover fastest decided in advance who to call, what to disconnect, and who talks to customers.

None of this requires a security team. It takes an afternoon, a written list, and the follow-through to actually do it.

The Bottom Line

The 2026 breach ledger will keep growing between now and December. You can't do anything about the tools attackers use. You can decide whether the cheapest version of the playbook works on you. Pick one item above and do it this week. And if you'd rather know where you actually stand than guess, have a conversation with someone who does this for a living. The earlier that conversation happens, the shorter the list of things to fix.