We May Be Living Through the Most Consequential Hundred Days in Cyber History

We May Be Living Through the Most Consequential Hundred Days in Cyber History, and Almost Nobody Has Noticed

An archive of this year’s insane timeline of hacks few people are talking about

The first four months of 2026 have produced a sequence of cyber incidents that, if any one of them had landed in 2014 or 2017, would have dominated a news cycle for a week.

A Chinese state supercomputer reportedly bled ten petabytes. Stryker was wiped across 79 countries. Lockheed Martin was hit for a reported 375 terabytes. The FBI Director’s personal inbox was dumped on the open web. The FBI’s wiretap management network was breached in a separate “major incident.” Rockstar Games was breached through a SaaS analytics vendor most people have never heard of. Cisco’s private GitHub was cloned. Oracle’s legacy cloud cracked open. The Axios npm package, downloaded a hundred million times a week, was hijacked by North Korea. Mercor, the $10 billion AI training-data vendor that sits inside the data pipelines of OpenAI, Anthropic, and Meta simultaneously, was breached through the LiteLLM open source library and had 4 terabytes extracted by Lapsus$. Honda was hit twice. The new ShinyHunters/Scattered Spider/LAPSUS$ alliance breached approximately 400 organizations and exfiltrated roughly 1.5 billion Salesforce records.

Stacked on top of each other across roughly a hundred days, these events are something a historian of computing security writing in 2050 will probably file as a turning point, regardless of what else happens between now and then.

And yet, the public conversation around them has been quiet to the point of being strange. This is a curious observation more than a complaint. And the goal of what follows is to gather the events into one place, cite the publications that reported each one, and then ask, gently, why the period feels so undocumented in real time.

Every named incident below is followed by inline parenthetical citations to the publications that broke or covered it, in the same way an academic paper would.

I am not arguing that the cybersecurity community is failing. I am noting that something unusual is happening.

Four Threat Clusters, One Quiet Quarter

Strip out the noise and the 2026 wave so far breaks cleanly into four separate campaigns running in parallel against U.S. and Western targets. This convergence is the part nobody is naming out loud.

Cluster 1: Iran / Handala / Void Manticore (destructive state operations). Operating under the Handala Hack Team persona, attributed by Palo Alto Networks Unit 42 to Void Manticore, an actor linked to Iran’s Ministry of Intelligence and Security. Handala is claiming attacks against U.S. industrial, defense, and government targets and explicitly framing them as retaliation for a February 28 missile strike on a school in Minab, southern Iran, that killed at least 175 people, most of them children. Confirmed and claimed Q1 2026 victims: Stryker (200,000 devices wiped), Lockheed Martin (375 TB claim, 28 engineer doxxing), FBI Director Kash Patel (personal email dump).

Cluster 2: Scattered LAPSUS$ Hunters / SLH — the apex-predator merger (financially-motivated SaaS theft and extortion at industrial scale). This is the single largest and least-discussed organizational development in the criminal cyber landscape since the Conti collapse. In August 2025, three of the most notorious financially-motivated crews on the planet, ShinyHunters, Scattered Spider, and LAPSUS$, formally combined into a coordinated alliance widely tracked as Scattered LAPSUS$ Hunters (SLH), sometimes called “the Trinity of Chaos” (Resecurity; Cyberbit; Infosecurity Magazine; The Hacker News; Computer Weekly; ReliaQuest). Scattered Spider provides initial access through highly-effective social engineering and vishing. ShinyHunters handles exfiltration, leak-site management, and extortion. LAPSUS$ contributes its own brand of identity-system compromise. The result is an end-to-end criminal pipeline operating against the SaaS layer of the global enterprise.

The numbers from this cluster’s 2025-2026 Salesforce campaign alone are difficult to absorb. ShinyHunters has publicly claimed compromise of approximately 300 to 400 organizations, with around 100 described as high-profile, and approximately 1.5 billion Salesforce records stolen in aggregate (BankInfoSecurity, “ShinyHunters Counts 1.5 Billion Stolen Salesforce Records”; The Register; State of Surveillance, “400 Companies Breached”; Salesforce Ben). Salesforce released a security advisory on March 7, 2026 confirming that a “known threat group” was exploiting misconfigurations in its Experience Cloud product, and ShinyHunters claimed responsibility on its data leak site two days later. The named victim list reads like a roll call of global brand recognition: Google (corporate Salesforce instance, ~2.55M records of small and medium business contact data), Cisco, Adidas, Qantas (5.7M customers), Allianz Life, Farmers Insurance Group, Workday, Pandora, Chanel, TransUnion, the entire LVMH family including Louis Vuitton, Dior, Tiffany & Co., and Cartier, Air France-KLM, LastPass, Okta, AMD, Snowflake itself, Match Group (Hinge, Bumble, OkCupid), SoundCloud (29.8M users), Panera Bread (5.1M accounts), Betterment (1.4M), Harvard, the University of Pennsylvania, Crunchbase, Canada Goose, and the December 2025 Pornhub breach via the Mixpanel campaign that exposed roughly 200 million user records and 94 GB of historical analytics data (BleepingComputer on Qantas, Allianz Life, LVMH; Cybersecurity News on Google, Adidas, Louis Vuitton; Malwarebytes; Google Cloud Threat Intel; Wikipedia ShinyHunters). Q1 2026 alone added Rockstar Games (via Anodot → Snowflake), the Cisco Trivy / Salesforce double hit, and the single most consequential AI-industry-specific incident of the quarter: the Lapsus$-claimed breach of Mercor, the $10B AI recruiting and training-data vendor that sits inside the data pipelines of OpenAI, Anthropic, and Meta simultaneously, after a LiteLLM open source supply chain compromise by the TeamPCP cluster. All catalogued in dedicated sections later in this article.

Tradecraft note: this cluster is no longer just compromising SaaS integrators to lift their OAuth tokens, although that remains part of the playbook (the 2025 Salesloft Drift / UNC6395 incident that compromised over 700 Salesforce environments including Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, Tanium, Zscaler, and CyberArk is the precedent that proved the OAuth model works at scale, Unit 42 threat brief; UpGuard; Cloudflare response). The 2026 evolution is more direct: SLH operators now call employees on the phone, pretend to be IT support, walk them through “updating MFA settings” or “linking the Salesforce Data Loader app,” and harvest credentials, MFA codes, and OAuth grants in real time (Google Cloud Blog, “The Cost of a Call”; Varonis; The Hacker News). In parallel, ShinyHunters has weaponized Mandiant’s own AuraInspector audit tool to scan and exploit misconfigured Salesforce Experience Cloud guest user permissions across the customer base (Allure Security). Voice phishing has produced more 2026 enterprise breaches than any single technical vulnerability.

Cluster 3: North Korea / UNC1069 (open source supply chain compromise). Google Threat Intelligence Group attributed the March 31, 2026 hijack of the Axios npm package to UNC1069, a North Korea-nexus financially-motivated actor. They did not exploit a vulnerability. They built an entire fake company, a branded fake Slack workspace, a fake Microsoft Teams meeting with fake teammates, social-engineered the lead Axios maintainer into trusting the fake organization, and used that trust to seize his npm account. Then they shipped a cross-platform RAT to a JavaScript library wi