Data breach statistics 2026

Most data breach statistics pages repeat each other. This one counts. We pulled the full Have I Been Pwned breach catalogue, every breach notice filed with Washington State's Attorney General, and every material cybersecurity incident US public companies have disclosed to the SEC, and computed the numbers below from those records. We add published figures from the Identity Theft Resource Center, the FBI and IBM, each with its source and its limits. Every chart can be embedded, and the whole dataset downloads as a CSV at the end of the page.

How many data breaches are there in 2026?

More than ever, by every count that tracks them. Have I Been Pwned, the free service that lets anyone check whether their email address was in a breach, added 110¹ verified breaches in 2026 by 20 October. That is already more than in any full year since the service began, when the previous high was 101¹. Those breaches exposed 480.2 million¹ accounts.

The Identity Theft Resource Center, a nonprofit that tracks publicly reported compromises in the United States, counted a record 3,322⁵ in 2025, and 1,803⁶ in the first half of 2026 alone.

How many breach notices reach one state?

In Texas, more than there are Texans. The breach notices on the Texas Attorney General's list named 42.8 million⁴ Texans in a year, against a population of 31.3 million⁴: 1.4x⁴ the people who live there. One person can be named in many notices, so this counts letters, not people, but it shows how routine a breach notice has become. 83%⁴ of those notices said Social Security numbers were exposed.

What personal data do data breaches expose?

Far more than passwords. Across the 12.4 billion¹ breached accounts in Have I Been Pwned's catalogue, 39.6%¹ were in a breach that exposed phone numbers, 28.1%¹ one that exposed dates of birth and 22.2%¹ one that exposed home addresses. Passwords were exposed for 59.9%¹.

The shift is starker by the year a breach happened. Passwords were exposed in 97%¹ of 2013's breaches and 11%¹ of 2026's. Phone numbers went the other way, to 72%¹ of 2026's breaches, and home addresses to 65%¹. Every year since 2023, more breaches have exposed phone numbers than passwords.

Phone numbers are now the norm. Of the breaches added in 2026, 72¹ exposed phone numbers, 65%¹ of them, and 66¹ exposed home addresses.

The largest data breaches of 2026

The biggest breaches added this year came from household names: a sportswear brand, a music app and a retailer each exposed tens of millions of accounts. Most of the ten largest included phone numbers.

How long do data breaches stay hidden?

Often for months, sometimes for years. The median breach added to Have I Been Pwned in 2026 was listed 23¹ days after it happened, much faster than the catalogue's all-time median of 132¹ days. But old breaches keep surfacing as their data is resold or leaked again.

Companies are slow to tell anyone, too. In Washington, which requires notice within 30 days of discovering a breach, the median breach notice in 2025 reached the Attorney General 134² days after the organization says it became aware of the breach, up from 36² days in 2020. 87%² of the 2025 notices came more than 30 days after that awareness date.

IBM's survey of breached organizations points the same way: they took an average of 247⁸ days to identify and contain a breach.

What causes data breaches?

Mostly cyberattacks, and mostly ransomware. Of the 209² breaches reported in Washington in 2025, 157² were cyberattacks, and ransomware caused 61%² of those.

Most companies no longer say how they were breached. 70%⁵ of breach notices in 2025 gave no details of the attack, rising to 76%⁶ in the first half of 2026. That leaves the people affected without the one fact they need to judge their risk.

How much does a data breach cost?

For the organization, about $4.99 million⁸ on average worldwide in IBM's 2026 report, up 12%⁸ on the year before, and $11.5 million⁸ in the United States, the highest of any country it measured. The report also found that 43%⁸ of security incidents involved staff using AI tools their employer had not approved.

How many people report a breach of their own data?

More each year. People filed 67,456⁷ complaints with the FBI's Internet Crime Complaint Center in 2025 after their own personal data was exposed, and reported losses of $1.3 billion⁷. Identity theft complaints rose to 31,675⁷ from 21,403⁷.

Which public companies disclosed material cyberattacks?

Since December 2023, US public companies have had to file a Form 8-K within four business days of deciding a cybersecurity incident is material. They have filed 59³ such reports under Item 1.05, from 57³ companies, and 18³ in 2026.

What to do if your data was in a breach

How we compiled these numbers

Our own counts come from three public records, each pulled into a dated snapshot that we hash so a number can only change through a reviewed refresh. Have I Been Pwned's catalogue: 974¹ verified breaches, leaving out fabricated breaches, spam lists and malware logs. Washington's breach notice data, counted by the calendar year each notice was filed. And SEC filings tagged Item 1.05 in EDGAR full-text search, counting original filings and not amendments.

The published figures were read in each source document at the page given in its source line. The Identity Theft Resource Center counts compromises that were publicly reported in the United States, and its victim notices are notices sent, not unique people. The FBI's figures are complaints people chose to file. Each chart on this page links to its own page with the full table, a CSV and embed code.