TWiT's network was breached in January 2026, and the intruder stayed undetected for 121 days — more than 4 months — because Leo had disconnected the Thinkst Canary for an ad read. The breach was only discovered when Google flagged unusual activity in TWiT's Workspace account.