TechCrunch's September 2026 roundup of the year's worst breaches shows repeating patterns: a credential issued in 2022 for a pilot, developer tools backdoored to steal tokens, and destructive attacks on utilities and medical device makers. The defences are old and unglamorous, which is the useful part.
Pattern 1: access that outlived its purpose
The roundup says the extortion gang behind the Klue breach used a credential Klue issued in 2022 for a limited pilot, and that the breach affected close to 200 companies. Whether or not the details change, the lesson holds: pilot access needs an end date.
What to do: list every service account, API key and vendor credential with a creation date and an owner, then expire what has no current purpose.
Pattern 2: tools that steal from the people who install them
The roundup says Trivy, Bitwarden and Checkmarx were compromised in 2026, and that attackers stole passwords and tokens from people who installed backdoored software. It says those stolen credentials enabled downstream compromises at several organisations.
What to do: pin versions, verify checksums and provenance for security and developer tools, and keep tokens short lived so a stolen one expires quickly. See the Trivy supply chain compromise.
Pattern 3: destructive attacks, not only theft
The roundup lists wiper malware against Poland's energy grid in late 2025, attacks on water systems, a medical device maker whose employee devices were remotely wiped, and a disruption at another device maker that halted shipping and new orders for a time.
What to do: test recovery. Know how long a rebuild takes, and keep backups that an attacker with admin rights cannot erase. For Poland, see CERT Polska's report.
Pattern 4: identity and support paths
The roundup describes attackers convincing Meta's AI chatbot to send password reset codes to addresses they controlled, affecting tens of thousands of accounts. It also notes a ransomware gang's claimed access to a law enforcement agency system. Recovery and support paths are part of the attack surface. See AI support assistants as an account recovery hole.
Pattern 5: big data piles
The roundup lists healthcare and identity data thefts affecting millions, such as a dental benefits company with about 15 million people and an identity verification firm whose breach reportedly involved about 150 million drivers' photos. Data you do not keep cannot be stolen. Set retention limits.
Caveats
This is a single journalistic summary. Counts and claims are as reported there, some come from attackers, and several investigations were open. Check each company's own statements before quoting a number.
A one page review
- How many credentials have no owner or no recent use?
- Which developer and security tools run with access to tokens, and how are updates controlled?
- How long does a full rebuild take, and when was it last tested?
- Which support and recovery flows can change account details, and what proves identity?
- What data are we keeping that we no longer need?
Where Safeguard fits
Safeguard's SBOM and dependency scanning, policies and gates, and agent identity address parts of patterns 1 and 2 for the software you build. A free scan is at gold.safeguard.sh/scan.
Quick check
What do the 2026 breach patterns have in common?
Many involve access or trust that was not reviewed: old credentials, installed tools that were later backdoored, and support or recovery paths that could be abused.
Why treat these numbers carefully?
They come from a single news summary, some are attacker claims, and investigations were ongoing.
Sources
Last reviewed: 19 October 2026.
