Data Breach Statistics 2026: Breaches per Year, Costs, Causes and Industries
The US had 1,803 publicly reported data compromises in the first half of 2026, according to the Identity Theft Resource Center, after a record 3,321 in 2025. Those H1 2026 breaches produced 471.2 million victim notices, already more than the 297.5 million for all of 2025, mostly because of one breach at the Canvas education platform. The global average cost of a breach reached a record $4.99 million in IBM's 2026 study. In Verizon's 2026 report, vulnerability exploitation overtook stolen credentials as the top way in.
Key statistics
- The US recorded 1,803 data compromises in the first half of 2026, up 3.3% on the first half of 2025, according to the Identity Theft Resource Center.
- US victim notices in H1 2026 were already 158% of the full-year 2025 total, calculated by StatisticsGlobal from Identity Theft Resource Center data.
- The global average cost of a data breach was a record $4.99 million in 2026, up 12% on the year before, according to IBM.
- Vulnerability exploitation was the top initial access vector at 31% of breaches in the 2026 report, ahead of credential abuse at 13%, according to Verizon.
- 810 HIPAA breaches affecting 500 or more people were reported to HHS in 2025, affecting 141.2 million individuals, counted by StatisticsGlobal from HHS OCR data.
Number of data breaches per year in the US
The Identity Theft Resource Center (ITRC) counts publicly reported data compromises in the US, using breach notices filed with states and regulators. It counts both events and the victim notices they produce.
Breach counts jumped in 2023 and have stayed above 3,000 a year since. The 2025 total of 3,321 is a record and 78.6% above 2021. The first half of 2026 is 3.3% ahead of the first half of 2025. If the second half matches the first, 2026 ends near 3,606 compromises, 8.6% above the record. Second quarters tend to be busier, so a straight doubling may overstate the year.
Victim notices swing far more than breach counts, because a handful of mega-breaches decide the total. Notices fell 78% from 2024 to 2025 while breaches rose. In H1 2026 they jumped again to 471.2 million. The Canvas breach alone accounts for an estimated 275 million. Without it, H1 2026 notices were about 196.2 million, 66% of the 2025 total.
ITRC revised its 2025 figures between reports. Its January 2026 release gave 3,322 compromises and 278.8 million victim notices. Its July 2026 report gives 3,321 and 297.5 million. We use the newer figures throughout.
Source: Identity Theft Resource Center, 2026 H1 Data Breach Report.
-
The US had a record 3,321 publicly reported data compromises in 2025, according to the Identity Theft Resource Center.
-
The US recorded 1,803 data compromises in the first half of 2026, up 3.3% on the first half of 2025, according to the Identity Theft Resource Center.
-
The US recorded 1,029 data compromises in Q2 2026, the second-highest quarter in ITRC tracking history, according to the Identity Theft Resource Center.
-
At the H1 pace, US data compromises would reach about 3,606 in 2026, 8.6% above the 2025 record, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 1,803 compromises in H1 2026 x 2 = 3,606. 3,606 / 3,321 (2025) - 1 = 8.6%. A simple run rate, not a forecast.
-
US data compromises rose 78.6% from 1,859 in 2021 to 3,321 in 2025, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 3,321 (2025) / 1,859 (2021) - 1 = 78.6%. Figures from the ITRC 2026 H1 report table. ITRC states the rise as 79% using its earlier 2025 count of 3,322.
-
US data compromises rose 33% from 774 in Q1 2026 to 1,029 in Q2 2026, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 1,029 (Q2 2026) / 774 (Q1 2026) - 1 = 32.9%. ITRC says second quarters tend to outpace the first.
-
Data compromises in the US produced 297.5 million victim notices in 2025, according to the Identity Theft Resource Center.
-
US data compromises produced 1.37 billion victim notices in 2024, according to the Identity Theft Resource Center.
-
Data compromises in the US produced 471.2 million victim notices in the first half of 2026, according to the Identity Theft Resource Center.
-
The Canvas education platform breach produced an estimated 275 million victim notices in H1 2026, 58% of the US total, according to the Identity Theft Resource Center.
-
US victim notices in H1 2026 were already 158% of the full-year 2025 total, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 471,206,085 victim notices in H1 2026 divided by 297,539,178 in full-year 2025 = 1.584, or 158.4%. Both totals from the ITRC 2026 H1 report table.
-
US data compromises averaged about 261,000 victim notices each in H1 2026, against about 90,000 in 2025, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 471,206,085 notices / 1,803 compromises = 261,346 (H1 2026). 297,539,178 / 3,321 = 89,593 (2025). Averages are pulled up by a few very large breaches.
-
Without the Canvas breach, US victim notices in H1 2026 were about 196.2 million, 66% of the 2025 total, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 471,206,085 total H1 2026 notices - 275,000,000 estimated Canvas notices = 196,206,085. Divided by 297,539,178 (2025) = 65.9%.
| Period | Data compromises | Victim notices | Notices per compromise |
|---|---|---|---|
| 2021 | 1,859 | 351,833,545 | 189,260 |
| 2022 | 1,798 | 425,219,503 | 236,496 |
| 2023 | 3,202 | 420,393,489 | 131,291 |
| 2024 | 3,152 | 1,367,208,915 | 433,759 |
| 2025 | 3,321 | 297,539,178 | 89,593 |
| H1 2026 | 1,803 | 471,206,085 | 261,346 |
Average cost of a data breach in 2026
IBM's Cost of a Data Breach study is conducted by the Ponemon Institute and sponsored by IBM. It estimates the cost of breaches at 602 organisations worldwide.
The global average rose 12% to a record $4.99 million. IBM says higher detection, escalation and lost business costs drove the rise. One in four malicious breaches in the study was AI-enabled, mostly deepfake impersonation and AI-assisted malware. Those cost about $1 million more than the average.
Spending on defence pays back. Organisations that used AI and automation extensively in security saved $1.93 million per breach against those using none, a sum close to 39% of the average breach cost. Basic hygiene still lags. Only 37% of breached organisations encrypted sensitive data both at rest and in transit.
The IBM average is a global figure across 602 organisations. It is not a typical cost for a small business, and it does not cover the US alone. The free report page and press release do not give a US or healthcare figure for 2026, so we do not quote one.
Source: IBM Cost of a Data Breach Report 2026.
-
The global average cost of a data breach was a record $4.99 million in 2026, up 12% on the year before, according to IBM.
-
One in four malicious breaches was AI-enabled in IBM’s 2026 study, and these breaches cost an average of $6 million, according to IBM.
-
Financial services breaches cost an average of $6.3 million in 2026, according to IBM.
-
Energy sector breaches cost an average of $5.2 million in 2026, according to IBM.
-
Extensive use of AI and automation in security cut breach costs by $1.93 million in 2026, compared with organisations using none, according to IBM.
-
Only 37% of breached organisations encrypted sensitive data both at rest and in transit in 2026, according to IBM.
-
More than 20% of organisations reported a breach targeting AI models or applications in IBM’s 2026 study, according to IBM.
| Breach group | Average cost | Difference from global average |
|---|---|---|
| Financial services | $6.3 million | +26.3% |
| AI-enabled breaches | $6.0 million | +20.2% |
| Energy | $5.2 million | +4.2% |
| All breaches (global average) | $4.99 million | - |
Causes of data breaches (ransomware, third parties, vulnerabilities)
Two sources describe causes. ITRC classifies US breach notices by attack vector. Verizon's Data Breach Investigations Report (DBIR) analyses more than 22,000 confirmed breaches worldwide shared by partner organisations.
Verizon finds attackers now get in mostly through software flaws. Exploitation of vulnerabilities was the first step in 31% of breaches, while stolen credentials fell to 13%. The System Intrusion pattern rose to 61% of breaches, from 53% in 2025. Ransomware was present in 48%, but 69% of victims did not pay and the median payment fell to $139,875.
Suppliers spread the damage. Verizon saw third-party involvement in 48% of breaches, up 60% in a year. ITRC counted 38 supply chain attacks in H1 2026 that reached 206 US organisations, about 5.4 each, and produced 280.6 million victim notices.
The US data says less every year about causes. Only 24% of H1 2026 notices said how the breach happened, down from 93% in 2021. Named phishing cases fell, but that may reflect thinner notices rather than less phishing. Insider wrongdoing and zero-day attacks both rose from small bases. For wider attack and fraud data, see our cybersecurity statistics.
Source: Identity Theft Resource Center, 2026 H1 Data Breach Report.
-
Verizon analysed more than 31,000 incidents and more than 22,000 confirmed data breaches for its 2026 report, according to Verizon.
-
Vulnerability exploitation was the top initial access vector at 31% of breaches in the 2026 report, ahead of credential abuse at 13%, according to Verizon.
-
System Intrusion made up 61% of breaches in the 2026 report, up from 53% in 2025, according to Verizon.
-
Third parties were involved in 48% of breaches in the 2026 report, up 60% on the year before, according to Verizon.
-
A human element was present in 62% of breaches in the 2026 report, up from 60%, according to Verizon.
-
The median ransom paid fell to $139,875 in the 2026 report from $150,000, and 69% of ransomware victims did not pay, according to Verizon.
-
Ransomware was reported in 39% of breaches in IBM’s 2026 study, up from 34% the year before, according to IBM.
-
Cyberattacks caused 1,256 of 1,803 US data compromises in H1 2026 (69.7%) and 92.3% of victim notices, according to the Identity Theft Resource Center.
-
Phishing, smishing and business email compromise caused 157 US data compromises in H1 2026, down 37.9% from 253 in H1 2025, according to the Identity Theft Resource Center.
-
Ransomware caused 76 publicly reported US data compromises in H1 2026, up from 73 in H1 2025, according to the Identity Theft Resource Center.
-
Insider wrongdoing caused 21 US data compromises in H1 2026, against 3 in all of 2025, according to the Identity Theft Resource Center.
-
Zero-day attacks caused 14 US data compromises in H1 2026, double the 7 in H1 2025, according to the Identity Theft Resource Center.
-
Supply chain attacks in H1 2026 came from 38 initial breaches, hit 206 US entities and produced 280.6 million victim notices, according to the Identity Theft Resource Center.
-
Each initial supply chain attack in H1 2026 reached an average of 5.4 US entities, calculated by StatisticsGlobal from Identity Theft Resource Center data.
How we calculated it: 206 affected entities / 38 initial supply chain breach events = 5.42.
-
76% of US breach notices in H1 2026 did not say how the breach happened, up from 70% in 2025, according to the Identity Theft Resource Center.
| Attack vector | H1 2025 | H1 2026 | Full year 2025 |
|---|---|---|---|
| All cyberattacks | 1,363 | 1,256 | 2,660 |
| Phishing, smishing and BEC | 253 | 157 | 469 |
| Ransomware | 73 | 76 | 144 |
| Insider wrongdoing | 0 | 21 | 3 |
| Zero-day attack | 7 | 14 | 17 |
| Malware | 16 | 10 | 25 |
| Credential stuffing | 22 | 9 | 28 |
| Unknown or unclassified | 216 | 402 | 363 |
Data breaches by industry
ITRC ranks US sectors by the number of compromises. Verizon gives incident and breach counts for each industry in its global dataset.
Financial services has the most breaches but not the most victims. It had 21.5% of US compromises in H1 2026 and only 2.8% of victim notices. Technology had just 99 compromises but 314.4 million notices, driven by the Canvas breach. Manufacturing notices rose to 74 million, against 1.97 million in all of 2025.
Verizon's global data ranks industries differently. Manufacturing had the most confirmed breaches, 2,713, followed by professional services and public administration. Small and medium-sized businesses had 7,152 breaches. Northern America supplied 46.7% of breaches with a known region, which reflects where Verizon's contributors work. For cloud providers that sit behind much third-party exposure, see our cloud market share page.
Source: Identity Theft Resource Center, 2026 H1 Data Breach Report.
-
Financial services had 387 US data compromises in H1 2026, more than any other sector, according to the Identity Theft Resource Center.
-
Healthcare had 281 US data compromises in H1 2026, up from 270 in H1 2025, according to the Identity Theft Resource Center.
-
Manufacturing data compromises in the US produced 74 million victim notices in H1 2026, against 1.97 million in all of 2025, according to the Identity Theft Resource Center.
-
Publicly traded companies had 10.3% of US data compromises in H1 2026 but 83.4% of victim notices, according to the Identity Theft Resource Center.
-
Manufacturing had the most confirmed breaches of any industry in the 2026 report, 2,713, ahead of professional services at 2,558, ranked by StatisticsGlobal from Verizon data.
How we calculated it: Ranked confirmed breach counts across all industries in the executive summary: Manufacturing 2,713, Professional 2,558, Public Administration 2,410, Healthcare 1,438, Financial and Insurance 1,300, Educational Services 1,252. Small and medium-sized businesses (7,152) is a size group, not an industry.
-
Small and medium-sized businesses had 7,152 confirmed data breaches from 7,256 incidents in the 2026 report, according to Verizon.
-
Northern America had 12,371 incidents and 8,426 confirmed data breaches in the 2026 report, according to Verizon.
| Sector | H1 2025 compromises | H1 2026 compromises | H1 2026 victim notices |
|---|---|---|---|
| Financial services | 396 | 387 | 13,011,106 |
| Healthcare | 270 | 281 | 11,724,232 |
| Professional services | 248 | 269 | 906,960 |
| Manufacturing | 161 | 189 | 74,004,994 |
| Technology | 70 | 99 | 314,444,664 |
| Education | 107 | 90 | 5,009,373 |
| Government | 92 | 87 | 1,615,357 |
| Retail | 58 | 51 | 13,162,075 |
Healthcare data breach statistics
Healthcare is the one US sector with a full public register. HIPAA-covered entities must report breaches affecting 500 or more people to the HHS Office for Civil Rights, which lists them on its breach portal. We exported every listed report on 4 November 2026.
Large healthcare breach reports reached 810 in 2025, the most in the portal's history, while the people affected halved to 141.2 million. The 2024 total was inflated by a single Change Healthcare report covering 192.7 million individuals. In 2025 one business associate breach, at Conduent Business Services, made up 44.1% of all individuals affected.
Hacking drives the register. It caused 80.9% of 2025 reports and 95.6% of individuals affected. Vendors matter as much as in other sectors. A business associate was involved in 35.1% of reports but 63.8% of individuals affected. From January to September 2026, reports were 5.2% lower than a year earlier, but individuals affected were 6.8% higher.
ITRC counts 281 healthcare compromises in H1 2026, while HHS lists more. The sources differ in scope. HHS includes every HIPAA breach of 500 or more people, including theft, loss and unauthorised disclosure, while ITRC counts public notices across states. For hospital technology trends, see our AI in healthcare statistics.
Source: HHS Office for Civil Rights breach portal, counted by StatisticsGlobal.
-
810 HIPAA breaches affecting 500 or more people were reported to HHS in 2025, affecting 141.2 million individuals, counted by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. 2025: 810 reports, 141,248,514 individuals affected.
-
741 HIPAA breaches affecting 500 or more people were reported to HHS in 2024, affecting 290.1 million individuals, counted by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. 2024: 741 reports, 290,052,596 individuals affected. Totals add reported counts, so one person in several breaches is counted more than once.
-
Large HIPAA breach reports rose 9.3% in 2025 while individuals affected fell 51.3%, calculated by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. Reports: 810 (2025) / 741 (2024) - 1 = 9.3%. Individuals: 141,248,514 / 290,052,596 - 1 = -51.3%.
-
Hacking or IT incidents made up 80.9% of large HIPAA breach reports in 2025 and 95.6% of individuals affected, calculated by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. Type of breach "Hacking/IT Incident": 655 of 810 reports = 80.9%; 135,049,969 of 141,248,514 individuals = 95.6%.
-
A business associate was involved in 35.1% of large HIPAA breaches in 2025 and 63.8% of individuals affected, calculated by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. "Business Associate Present" = Yes: 284 of 810 reports = 35.1%; 90,124,354 of 141,248,514 individuals = 63.8%.
-
The largest HIPAA breach reported in 2025 affected 62.2 million people, 44.1% of that year’s total, calculated by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. Largest 2025 report: Conduent Business Services LLC (business associate), 62,224,658 individuals, submitted 8 October 2025. 62,224,658 / 141,248,514 = 44.1%.
-
16 HIPAA breaches reported in 2025 affected one million people or more each, counted by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. Reports with individuals affected of 1,000,000 or more, submission year 2025: 16. Also 16 so far in 2026 to 9 October.
-
600 large HIPAA breaches were reported to HHS from January to September 2026, 5.2% fewer than a year earlier, calculated by StatisticsGlobal from HHS OCR data.
How we calculated it: Counted by StatisticsGlobal from the HHS OCR breach portal CSV exports (under investigation and archive tabs) on 4 November 2026, grouped by breach submission date. January to September 2026: 600 reports, 79,153,694 individuals. January to September 2025: 633 reports, 74,088,450 individuals. Reports -5.2%, individuals +6.8%.
-
Healthcare had 1,492 incidents and 1,438 confirmed data breaches in the 2026 report, according to Verizon.
| Year | Breach reports | Individuals affected |
|---|---|---|
| 2019 | 511 | 44,969,724 |
| 2020 | 663 | 35,321,223 |
| 2021 | 715 | 61,206,238 |
| 2022 | 718 | 64,570,326 |
| 2023 | 745 | 183,256,225 |
| 2024 | 741 | 290,052,596 |
| 2025 | 810 | 141,248,514 |
| 2026 (to 9 October) | 618 | 87,693,355 |
How the sources measure data breaches
The Identity Theft Resource Center counts publicly reported US data compromises from breach notices. A compromise can be a breach, an exposure, a leak or an unclassified event. Victim notices count notification letters, so one person can be counted several times, and some large events include people outside the US. ITRC revises past totals as late notices arrive. We use its 2026 H1 report, published in July 2026.
IBM's Cost of a Data Breach study is run by the Ponemon Institute and sponsored by IBM. It covers 602 organisations worldwide that were breached between March 2025 and February 2026. Costs are reported by the study, not audited losses. The full report needs an email, so we use the free report page and the press release.
Verizon's DBIR uses more than 22,000 confirmed breaches contributed by Verizon and partner organisations, covering October 2024 to November 2025, in 145 countries. It is not a random sample. Industry and regional counts reflect who contributes data. We use the free executive summary.
The HHS OCR breach portal lists HIPAA breaches affecting 500 or more people. We counted reports by submission date from the CSV exports of both tabs and keep a snapshot of the data. OCR can add or edit reports later, so recent counts may change.
Frequently asked questions
How many data breaches were there in 2025?
The Identity Theft Resource Center counted a record 3,321 publicly reported data compromises in the US in 2025, with 297.5 million victim notices. In healthcare alone, 810 HIPAA breaches affecting 500 or more people were reported to HHS.
How many data breaches have there been in 2026 so far?
The US recorded 1,803 data compromises in the first half of 2026, up 3.3% on the first half of 2025. They produced 471.2 million victim notices, already more than all of 2025.
What is the average cost of a data breach in 2026?
$4.99 million worldwide, a record and 12% more than the year before, according to IBM's 2026 study of 602 breached organisations. Financial services breaches averaged $6.3 million and AI-enabled breaches $6 million.
What is the most common cause of data breaches?
In Verizon's 2026 report, exploitation of software vulnerabilities was the most common way in, at 31% of breaches, ahead of credential abuse at 13%. Ransomware was present in 48% of breaches and third parties in 48%. In the US, most breach notices no longer say how the breach happened.
Which industry has the most data breaches?
In the US, financial services had the most publicly reported compromises in H1 2026, with 387, followed by healthcare with 281. In Verizon's global data, manufacturing had the most confirmed breaches, 2,713.
Will 2026 be a record year for data breaches?
It is on track. At the first-half pace, US compromises would reach about 3,606 in 2026, 8.6% above the 2025 record of 3,321. That is a simple run rate, not a forecast. We will update this page when ITRC publishes its full-year 2026 report.
Sources
- Identity Theft Resource Center (ITRC), 2026 H1 Data Breach Report, July 2026, accessed 4 November 2026. Link · Saved data copy
- IBM, Cost of a Data Breach Report 2026, July 2026, accessed 4 November 2026. Link · Saved data copy
- Verizon, 2026 Data Breach Investigations Report, Executive Summary, 2026, accessed 19 October 2026. Link · Saved data copy
- US Department of Health and Human Services, Office for Civil Rights, Breach Portal: Breaches of Unsecured Protected Health Information (under investigation and archive tabs), Rolling list, latest submission 9 October 2026, exported 4 November 2026. Link · Saved data copy
- IBM, IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026 press release), 29 July 2026, accessed 4 November 2026. Link · Saved data copy
Changes to this page
- : Page published with the ITRC 2026 H1 Data Breach Report, IBM Cost of a Data Breach 2026, the Verizon 2026 DBIR executive summary and HHS OCR breach portal data exported on 4 November 2026.