March 2026 proved to be an illustrative month for the shifting cybersecurity landscape, as organizations grappled with the unintended consequences of AI integration and the vulnerabilities inherent in legacy infrastructure. From exposed chatbot logs to sophisticated lateral movement in medical and financial systems, this month’s incidents highlight a critical transition. We are no longer just defending against “hacks”—we are defending against the complexity of the modern digital ecosystem itself.

Sears Home Services

AI Integration Failure: Chatbot and Voice Logs Exposed to the Public Web

In one of the most high-profile exposures of the year, Sears Home Services was forced to address a major security lapse involving its AI-driven customer support tools. Reports revealed that an improperly secured database left millions of phone call transcripts and text chat logs accessible to anyone on the web without a password. The leak, totaling roughly 37 million records, contained highly personal information, including service requests, home addresses, and details shared during customer repair calls. This incident serves as a definitive warning: as companies race to deploy AI chatbots for efficiency, the security of the underlying data storage remains a catastrophic point of failure if not properly siloed.

Berkadia Commercial Mortgage

Financial Sector Targeted: Lateral Movement Leads to Sensitive Client Data Leak

Berkadia Commercial Mortgage disclosed a significant data event in March that impacted its internal file servers. According to breach notifications, unauthorized actors gained access to the network and moved laterally to exfiltrate documents containing sensitive borrower and employee information. The data involved included financial identifiers and Social Security numbers, typical of high-value targets in the commercial lending space. The breach underscores a recurring theme in 2026: financial institutions remain top-tier targets for cybercriminals who are patient enough to bypass initial perimeters to reach deep-storage file repositories.

Navia Benefit Solutions

The Risks of Healthcare Administration: Personal Health Information Compromised

Navia Benefit Solutions, a provider of health and employee benefit services, notified regulators of a breach that exposed the personal and health-related data of its participants. The incident involved unauthorized access to a specific segment of their server environment, allowing threat actors to view and extract files containing names, healthcare plan details, and in some cases, Social Security numbers. Navia’s “Notice of Data Event” highlighted the ongoing vulnerability of the healthcare administrative supply chain, where the aggregation of HIPAA-regulated data makes these third-party processors lucrative targets for extortion-based attacks.

Stryker

Critical Infrastructure Protection: Medical Device Leader Probes Network Intrusion

Global medical technology leader Stryker confirmed in late March that it was investigating a “cybersecurity event” that impacted a subset of its internal systems. While the company moved quickly to isolate the affected segments and maintain its manufacturing and supply operations, the incident raised concerns about the resilience of the medical device supply chain. Stryker’s communication to customers emphasized that patient safety remained the priority, but the event reflects the heightened pressure on medical manufacturers as attackers increasingly target the infrastructure that keeps modern healthcare functioning.

The Complexity Tax on Security

The breaches of March 2026 reveal a “complexity tax” being paid by organizations across all sectors. Whether it is the misconfiguration of a new AI tool at Sears or the exploitation of administrative servers at Navia, the common denominator is the difficulty of securing an ever-expanding web of data. Attackers are no longer looking for the front door; they are looking for the forgotten window in the new extension. For security leaders, the takeaway is clear: as we adopt new technologies, our primary responsibility is ensuring that visibility and governance scale at the same pace as innovation.