# Data Breach Statistics 2026: Breaches per Year, Costs, Causes and Industries

Updated 2026-11-04. Checked by StatisticsGlobal editorial team. ITRC breach notice counts, the IBM and Ponemon Cost of a Data Breach study, the Verizon DBIR and HHS OCR breach portal records, 4 primary sources, data for 2021 to October 2026.
Canonical: https://statisticsglobal.org/data-breach-statistics/

The US had 1,803 publicly reported data compromises in the first half of 2026, according to the Identity Theft Resource Center, after a record 3,321 in 2025. Those H1 2026 breaches produced 471.2 million victim notices, already more than the 297.5 million for all of 2025, mostly because of one breach at the Canvas education platform. The global average cost of a breach reached a record $4.99 million in IBM's 2026 study. In Verizon's 2026 report, vulnerability exploitation overtook stolen credentials as the top way in.

## Key statistics

- The US recorded 1,803 data compromises in the first half of 2026, up 3.3% on the first half of 2025, according to the Identity Theft Resource Center.
- US victim notices in H1 2026 were already 158% of the full-year 2025 total, calculated by StatisticsGlobal from Identity Theft Resource Center data.
- The global average cost of a data breach was a record $4.99 million in 2026, up 12% on the year before, according to IBM.
- Vulnerability exploitation was the top initial access vector at 31% of breaches in the 2026 report, ahead of credential abuse at 13%, according to Verizon.
- 810 HIPAA breaches affecting 500 or more people were reported to HHS in 2025, affecting 141.2 million individuals, counted by StatisticsGlobal from HHS OCR data.

## Number of data breaches per year in the US

The Identity Theft Resource Center (ITRC) counts publicly reported data compromises in the US, using breach notices filed with states and regulators. It counts both events and the victim notices they produce.

Breach counts jumped in 2023 and have stayed above 3,000 a year since. The 2025 total of 3,321 is a record and 78.6% above 2021. The first half of 2026 is 3.3% ahead of the first half of 2025. If the second half matches the first, 2026 ends near 3,606 compromises, 8.6% above the record. Second quarters tend to be busier, so a straight doubling may overstate the year.

Victim notices swing far more than breach counts, because a handful of mega-breaches decide the total. Notices fell 78% from 2024 to 2025 while breaches rose. In H1 2026 they jumped again to 471.2 million. The Canvas breach alone accounts for an estimated 275 million. Without it, H1 2026 notices were about 196.2 million, 66% of the 2025 total.

ITRC revised its 2025 figures between reports. Its January 2026 release gave 3,322 compromises and 278.8 million victim notices. Its July 2026 report gives 3,321 and 297.5 million. We use the newer figures throughout.

- The US had a record 3,321 publicly reported data compromises in 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- The US recorded 1,803 data compromises in the first half of 2026, up 3.3% on the first half of 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- The US recorded 1,029 data compromises in Q2 2026, the second-highest quarter in ITRC tracking history, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- At the H1 pace, US data compromises would reach about 3,606 in 2026, 8.6% above the 2025 record, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- US data compromises rose 78.6% from 1,859 in 2021 to 3,321 in 2025, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- US data compromises rose 33% from 774 in Q1 2026 to 1,029 in Q2 2026, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Data compromises in the US produced 297.5 million victim notices in 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- US data compromises produced 1.37 billion victim notices in 2024, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Data compromises in the US produced 471.2 million victim notices in the first half of 2026, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- The Canvas education platform breach produced an estimated 275 million victim notices in H1 2026, 58% of the US total, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- US victim notices in H1 2026 were already 158% of the full-year 2025 total, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- US data compromises averaged about 261,000 victim notices each in H1 2026, against about 90,000 in 2025, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Without the Canvas breach, US victim notices in H1 2026 were about 196.2 million, 66% of the 2025 total, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf

Table: Publicly reported US data compromises and victim notices, 2021 to H1 2026

| Period | Data compromises | Victim notices | Notices per compromise |
|---|---|---|---|
| 2021 | 1,859 | 351,833,545 | 189,260 |
| 2022 | 1,798 | 425,219,503 | 236,496 |
| 2023 | 3,202 | 420,393,489 | 131,291 |
| 2024 | 3,152 | 1,367,208,915 | 433,759 |
| 2025 | 3,321 | 297,539,178 | 89,593 |
| H1 2026 | 1,803 | 471,206,085 | 261,346 |

Source: Identity Theft Resource Center, 2026 H1 Data Breach Report, July 2026. Notices per compromise calculated by StatisticsGlobal. H1 2026 notices include about 275 million from the Canvas breach; the US-only count is unconfirmed.

## Average cost of a data breach in 2026

IBM's Cost of a Data Breach study is conducted by the Ponemon Institute and sponsored by IBM. It estimates the cost of breaches at 602 organisations worldwide.

The global average rose 12% to a record $4.99 million. IBM says higher detection, escalation and lost business costs drove the rise. One in four malicious breaches in the study was AI-enabled, mostly deepfake impersonation and AI-assisted malware. Those cost about $1 million more than the average.

Spending on defence pays back. Organisations that used AI and automation extensively in security saved $1.93 million per breach against those using none, a sum close to 39% of the average breach cost. Basic hygiene still lags. Only 37% of breached organisations encrypted sensitive data both at rest and in transit.

The IBM average is a global figure across 602 organisations. It is not a typical cost for a small business, and it does not cover the US alone. The free report page and press release do not give a US or healthcare figure for 2026, so we do not quote one.

- The global average cost of a data breach was a record $4.99 million in 2026, up 12% on the year before, according to IBM. Source: IBM, Cost of a Data Breach Report 2026 (July 2026, accessed 4 November 2026) https://www.ibm.com/reports/data-breach
- One in four malicious breaches was AI-enabled in IBM’s 2026 study, and these breaches cost an average of $6 million, according to IBM. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- AI-enabled breaches cost 20.2% more than the average breach in 2026, about $1 million extra, calculated by StatisticsGlobal from IBM data. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- Financial services breaches cost an average of $6.3 million in 2026, according to IBM. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- Financial services breaches cost 26.3% more than the global average in 2026, calculated by StatisticsGlobal from IBM data. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- Energy sector breaches cost an average of $5.2 million in 2026, according to IBM. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- Extensive use of AI and automation in security cut breach costs by $1.93 million in 2026, compared with organisations using none, according to IBM. Source: IBM, Cost of a Data Breach Report 2026 (July 2026, accessed 4 November 2026) https://www.ibm.com/reports/data-breach
- The $1.93 million AI and automation saving equals 38.7% of the global average breach cost in 2026, calculated by StatisticsGlobal from IBM data. Source: IBM, Cost of a Data Breach Report 2026 (July 2026, accessed 4 November 2026) https://www.ibm.com/reports/data-breach
- Only 37% of breached organisations encrypted sensitive data both at rest and in transit in 2026, according to IBM. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- More than 20% of organisations reported a breach targeting AI models or applications in IBM’s 2026 study, according to IBM. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average

Table: Average cost of a data breach by type and sector, IBM 2026 study, US dollars

| Breach group | Average cost | Difference from global average |
|---|---|---|
| Financial services | $6.3 million | +26.3% |
| AI-enabled breaches | $6.0 million | +20.2% |
| Energy | $5.2 million | +4.2% |
| All breaches (global average) | $4.99 million | - |

Source: IBM Cost of a Data Breach Report 2026 report page and IBM press release, 29 July 2026. Differences calculated by StatisticsGlobal.

## Causes of data breaches (ransomware, third parties, vulnerabilities)

Two sources describe causes. ITRC classifies US breach notices by attack vector. Verizon's Data Breach Investigations Report (DBIR) analyses more than 22,000 confirmed breaches worldwide shared by partner organisations.

Verizon finds attackers now get in mostly through software flaws. Exploitation of vulnerabilities was the first step in 31% of breaches, while stolen credentials fell to 13%. The System Intrusion pattern rose to 61% of breaches, from 53% in 2025. Ransomware was present in 48%, but 69% of victims did not pay and the median payment fell to $139,875.

Suppliers spread the damage. Verizon saw third-party involvement in 48% of breaches, up 60% in a year. ITRC counted 38 supply chain attacks in H1 2026 that reached 206 US organisations, about 5.4 each, and produced 280.6 million victim notices.

The US data says less every year about causes. Only 24% of H1 2026 notices said how the breach happened, down from 93% in 2021. Named phishing cases fell, but that may reflect thinner notices rather than less phishing. Insider wrongdoing and zero-day attacks both rose from small bases. For wider attack and fraud data, see our [cybersecurity statistics](https://statisticsglobal.org/cybersecurity-statistics/).

- Verizon analysed more than 31,000 incidents and more than 22,000 confirmed data breaches for its 2026 report, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Vulnerability exploitation was the top initial access vector at 31% of breaches in the 2026 report, ahead of credential abuse at 13%, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- System Intrusion made up 61% of breaches in the 2026 report, up from 53% in 2025, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Third parties were involved in 48% of breaches in the 2026 report, up 60% on the year before, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- A human element was present in 62% of breaches in the 2026 report, up from 60%, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- The median ransom paid fell to $139,875 in the 2026 report from $150,000, and 69% of ransomware victims did not pay, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Ransomware was reported in 39% of breaches in IBM’s 2026 study, up from 34% the year before, according to IBM. Source: IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release) (29 July 2026, accessed 4 November 2026) https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
- Cyberattacks caused 1,256 of 1,803 US data compromises in H1 2026 (69.7%) and 92.3% of victim notices, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Phishing, smishing and business email compromise caused 157 US data compromises in H1 2026, down 37.9% from 253 in H1 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Ransomware caused 76 publicly reported US data compromises in H1 2026, up from 73 in H1 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Insider wrongdoing caused 21 US data compromises in H1 2026, against 3 in all of 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Zero-day attacks caused 14 US data compromises in H1 2026, double the 7 in H1 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Supply chain attacks in H1 2026 came from 38 initial breaches, hit 206 US entities and produced 280.6 million victim notices, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Each initial supply chain attack in H1 2026 reached an average of 5.4 US entities, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- 76% of US breach notices in H1 2026 did not say how the breach happened, up from 70% in 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf

Table: Named attack vectors in publicly reported US data compromises, H1 2025 vs H1 2026

| Attack vector | H1 2025 | H1 2026 | Full year 2025 |
|---|---|---|---|
| All cyberattacks | 1,363 | 1,256 | 2,660 |
| Phishing, smishing and BEC | 253 | 157 | 469 |
| Ransomware | 73 | 76 | 144 |
| Insider wrongdoing | 0 | 21 | 3 |
| Zero-day attack | 7 | 14 | 17 |
| Malware | 16 | 10 | 25 |
| Credential stuffing | 22 | 9 | 28 |
| Unknown or unclassified | 216 | 402 | 363 |

Source: Identity Theft Resource Center, 2026 H1 Data Breach Report, attack vector table. 972 of the 1,256 H1 2026 cyberattacks list no specific method.

## Data breaches by industry

ITRC ranks US sectors by the number of compromises. Verizon gives incident and breach counts for each industry in its global dataset.

Financial services has the most breaches but not the most victims. It had 21.5% of US compromises in H1 2026 and only 2.8% of victim notices. Technology had just 99 compromises but 314.4 million notices, driven by the Canvas breach. Manufacturing notices rose to 74 million, against 1.97 million in all of 2025.

Verizon's global data ranks industries differently. Manufacturing had the most confirmed breaches, 2,713, followed by professional services and public administration. Small and medium-sized businesses had 7,152 breaches. Northern America supplied 46.7% of breaches with a known region, which reflects where Verizon's contributors work. For cloud providers that sit behind much third-party exposure, see our [cloud market share](https://statisticsglobal.org/cloud-market-share/) page.

- Financial services had 387 US data compromises in H1 2026, more than any other sector, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Financial services accounted for 21.5% of US data compromises in H1 2026 but 2.8% of victim notices, calculated by StatisticsGlobal from Identity Theft Resource Center data. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Healthcare had 281 US data compromises in H1 2026, up from 270 in H1 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Manufacturing data compromises in the US produced 74 million victim notices in H1 2026, against 1.97 million in all of 2025, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Publicly traded companies had 10.3% of US data compromises in H1 2026 but 83.4% of victim notices, according to the Identity Theft Resource Center. Source: Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report (July 2026, accessed 4 November 2026) https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
- Manufacturing had the most confirmed breaches of any industry in the 2026 report, 2,713, ahead of professional services at 2,558, ranked by StatisticsGlobal from Verizon data. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Small and medium-sized businesses had 7,152 confirmed data breaches from 7,256 incidents in the 2026 report, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Northern America had 12,371 incidents and 8,426 confirmed data breaches in the 2026 report, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Northern America accounted for 46.7% of confirmed breaches with a region in the 2026 report, calculated by StatisticsGlobal from Verizon data. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf

Table: Publicly reported US data compromises and victim notices by sector, H1 2026 vs H1 2025

| Sector | H1 2025 compromises | H1 2026 compromises | H1 2026 victim notices |
|---|---|---|---|
| Financial services | 396 | 387 | 13,011,106 |
| Healthcare | 270 | 281 | 11,724,232 |
| Professional services | 248 | 269 | 906,960 |
| Manufacturing | 161 | 189 | 74,004,994 |
| Technology | 70 | 99 | 314,444,664 |
| Education | 107 | 90 | 5,009,373 |
| Government | 92 | 87 | 1,615,357 |
| Retail | 58 | 51 | 13,162,075 |

Source: Identity Theft Resource Center, 2026 H1 Data Breach Report, industry table.

## Healthcare data breach statistics

Healthcare is the one US sector with a full public register. HIPAA-covered entities must report breaches affecting 500 or more people to the HHS Office for Civil Rights, which lists them on its breach portal. We exported every listed report on 4 November 2026.

Large healthcare breach reports reached 810 in 2025, the most in the portal's history, while the people affected halved to 141.2 million. The 2024 total was inflated by a single Change Healthcare report covering 192.7 million individuals. In 2025 one business associate breach, at Conduent Business Services, made up 44.1% of all individuals affected.

Hacking drives the register. It caused 80.9% of 2025 reports and 95.6% of individuals affected. Vendors matter as much as in other sectors. A business associate was involved in 35.1% of reports but 63.8% of individuals affected. From January to September 2026, reports were 5.2% lower than a year earlier, but individuals affected were 6.8% higher.

ITRC counts 281 healthcare compromises in H1 2026, while HHS lists more. The sources differ in scope. HHS includes every HIPAA breach of 500 or more people, including theft, loss and unauthorised disclosure, while ITRC counts public notices across states. For hospital technology trends, see our [AI in healthcare statistics](https://statisticsglobal.org/ai-in-healthcare-statistics/).

- 810 HIPAA breaches affecting 500 or more people were reported to HHS in 2025, affecting 141.2 million individuals, counted by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- 741 HIPAA breaches affecting 500 or more people were reported to HHS in 2024, affecting 290.1 million individuals, counted by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- Large HIPAA breach reports rose 9.3% in 2025 while individuals affected fell 51.3%, calculated by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- Hacking or IT incidents made up 80.9% of large HIPAA breach reports in 2025 and 95.6% of individuals affected, calculated by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- A business associate was involved in 35.1% of large HIPAA breaches in 2025 and 63.8% of individuals affected, calculated by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- The largest HIPAA breach reported in 2025 affected 62.2 million people, 44.1% of that year’s total, calculated by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- 16 HIPAA breaches reported in 2025 affected one million people or more each, counted by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- 600 large HIPAA breaches were reported to HHS from January to September 2026, 5.2% fewer than a year earlier, calculated by StatisticsGlobal from HHS OCR data. Source: US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs) (Rolling list, latest submission 9 October 2026, exported 4 November 2026) https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- Healthcare had 1,492 incidents and 1,438 confirmed data breaches in the 2026 report, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 4 November 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf

Table: HIPAA breaches affecting 500 or more people reported to HHS OCR, by submission year, 2019 to 2026

| Year | Breach reports | Individuals affected |
|---|---|---|
| 2019 | 511 | 44,969,724 |
| 2020 | 663 | 35,321,223 |
| 2021 | 715 | 61,206,238 |
| 2022 | 718 | 64,570,326 |
| 2023 | 745 | 183,256,225 |
| 2024 | 741 | 290,052,596 |
| 2025 | 810 | 141,248,514 |
| 2026 (to 9 October) | 618 | 87,693,355 |

Source: HHS Office for Civil Rights breach portal, under investigation and archive tabs, exported 4 November 2026. Counted by StatisticsGlobal by breach submission date. Snapshot: /data/snapshots/hhs/ocr-breach-portal-2026-11-04.csv

## How the sources measure data breaches

The Identity Theft Resource Center counts publicly reported US data compromises from breach notices. A compromise can be a breach, an exposure, a leak or an unclassified event. Victim notices count notification letters, so one person can be counted several times, and some large events include people outside the US. ITRC revises past totals as late notices arrive. We use its 2026 H1 report, published in July 2026.

IBM's Cost of a Data Breach study is run by the Ponemon Institute and sponsored by IBM. It covers 602 organisations worldwide that were breached between March 2025 and February 2026. Costs are reported by the study, not audited losses. The full report needs an email, so we use the free report page and the press release.

Verizon's DBIR uses more than 22,000 confirmed breaches contributed by Verizon and partner organisations, covering October 2024 to November 2025, in 145 countries. It is not a random sample. Industry and regional counts reflect who contributes data. We use the free executive summary.

The HHS OCR breach portal lists HIPAA breaches affecting 500 or more people. We counted reports by submission date from the CSV exports of both tabs and keep a [snapshot of the data](https://statisticsglobal.org/data/snapshots/hhs/ocr-breach-portal-2026-11-04.csv). OCR can add or edit reports later, so recent counts may change.


## Frequently asked questions

### How many data breaches were there in 2025?

The Identity Theft Resource Center counted a record 3,321 publicly reported data compromises in the US in 2025, with 297.5 million victim notices. In healthcare alone, 810 HIPAA breaches affecting 500 or more people were reported to HHS.

### How many data breaches have there been in 2026 so far?

The US recorded 1,803 data compromises in the first half of 2026, up 3.3% on the first half of 2025. They produced 471.2 million victim notices, already more than all of 2025.

### What is the average cost of a data breach in 2026?

$4.99 million worldwide, a record and 12% more than the year before, according to IBM's 2026 study of 602 breached organisations. Financial services breaches averaged $6.3 million and AI-enabled breaches $6 million.

### What is the most common cause of data breaches?

In Verizon's 2026 report, exploitation of software vulnerabilities was the most common way in, at 31% of breaches, ahead of credential abuse at 13%. Ransomware was present in 48% of breaches and third parties in 48%. In the US, most breach notices no longer say how the breach happened.

### Which industry has the most data breaches?

In the US, financial services had the most publicly reported compromises in H1 2026, with 387, followed by healthcare with 281. In Verizon's global data, manufacturing had the most confirmed breaches, 2,713.

### Will 2026 be a record year for data breaches?

It is on track. At the first-half pace, US compromises would reach about 3,606 in 2026, 8.6% above the 2025 record of 3,321. That is a simple run rate, not a forecast. We will update this page when ITRC publishes its full-year 2026 report.

## Sources

1. Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report, July 2026, accessed 4 November 2026. https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf
2. IBM, Cost of a Data Breach Report 2026, July 2026, accessed 4 November 2026. https://www.ibm.com/reports/data-breach
3. Verizon, 2026 Data Breach Investigations Report, Executive Summary, 2026, accessed 19 October 2026. https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
4. US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs), Rolling list, latest submission 9 October 2026, exported 4 November 2026. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
5. IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release), 29 July 2026, accessed 4 November 2026. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average