Data Breach Statistics (2026)

How many breaches are reported, which sectors they hit, what they cost and how attackers get in, with every figure tied to the report that published it.

By Siddharth ShankarUpdated October 12, 202652 statistics · 13 sourcesCite this page

Key takeaways

• Breaches are at a record count. The ITRC logged 3,322 US compromises in 2025, up from 3,152 in 2024 and the prior record of 3,202 in 2023. That is 79% more than the 1,859 in 2021 (our calculation).
• Cyberattacks drive most of them: ITRC counts 2,656 cyberattacks out of 3,322 compromises, about 80% (our calculation). Ransomware was 143 compromises, down from 194.
• Transparency is poor. In 2,324 of 3,322 breach notices, 70%, the notice did not state the attack vector (ITRC).
• Costs keep climbing. IBM’s 2026 global average is $4.99 million, up 12% (IBM), and extensive use of AI and automation in security was linked to $1.93 million lower costs.
• Regulators outside the US see the same pressure: 1,205 notifications in Australia in 2025 (OAIC) and 443 breach notifications a day across Europe (DLA Piper).

How many breaches: the US count

The Identity Theft Resource Center (ITRC) compiles an annual count of publicly reported US data compromises. A “victim notice” is a notification sent to an affected person, and one person can receive several.

The victim-notice total fell sharply in 2025 while the compromise count rose. The notice total leans heavily on a few very large incidents: the five biggest breaches in the table below add up to about 61% of all 2025 victim notices (our calculation). Use the compromise count to judge frequency and the notice count to judge the size of the largest events.

Which sectors are hit

What a breach costs

IBM’s annual study estimates the average cost of a breach. The full 2026 report is gated, so we separate what IBM’s own page states from figures we confirmed through two independent write-ups (marked †).

† Confirmed in both Baker Donelson and eSecurity Planet (both July 30, 2026). The IBM page we could read gives the first three figures only. Baker Donelson also reports the US average as 11% higher than the previous year; eSecurity Planet gives no year-over-year change. IBM’s page also reports a 56% increase in AI-driven attacks without stating a baseline period, so we do not use it.

How attackers get in

Verizon’s Data Breach Investigations Report analyzes incidents reported to it by contributing organizations. The 2026 edition covers November 1, 2024 to October 31, 2025. Verizon’s landing page gives the four headline figures below, and the third-party figure is confirmed by two independent summaries.

† Confirmed in eSecurity Planet and Safe Security. eSecurity Planet adds that the third-party share was up from 30% the year before; Safe Security reports it as up 60% year over year. The Verizon summary we read does not state the comparison group for the mobile click rate.

Other countries and regulators

The UK government estimates the 43% equates to roughly 612,000 businesses and the 28% to 57,000 charities. The survey covered 2,112 businesses and 1,085 charities.

If you want to see how this affects your own accounts, start with what a data breach is, then check whether your email was exposed and follow what to do next.

Methodology and limitations

Every figure on this page comes from the organization that published it, such as a regulator, a government agency or the original report. We read the source page or document directly, and we record the period each figure covers. When a number could not be confirmed against a primary source, we left it out. A dagger (†) marks a figure we confirmed through two independent summaries because the original report is gated or could not be read in full. Rows marked “Our calculation” are simple arithmetic on published figures, and the inputs are named in the same row.

• The ITRC counts publicly reported US compromises. Breaches that are never disclosed are not in the count.
• An industry average can differ widely from any single company’s experience.
• Verizon’s dataset is incidents contributed to it, not a census of all breaches.
• Regulator counts (OAIC, DPC, DLA Piper) depend on each jurisdiction’s notification rules and are not comparable across countries.

Counts of reports, complaints and notifications measure what was reported or notified, not everything that happened. Currency symbols follow the source. Where an agency does not name its currency, we show the symbol the source uses (for example, C$ for Canada and A$ for Australia are our labels). Figures from different countries use different definitions and should not be added together. Spot an error? Tell us and include the source link; we correct verified errors and note the date at the top of the page.