Report by Identity Theft Resource Center
ITRC H1 2026 Data Breach Report
Key Findings
Zero-day attacks rose to 14 events in H1 2026, nearly matching the 17 events recorded in all of 2025.
Only 24% of H1 2026 breach notices contained attack-vector details, the lowest rate ever recorded by the ITRC.
A single Canvas data compromise generated an estimated 275 million victim notices, accounting for 58% of the H1 2026 total.
Financial services recorded the highest frequency of compromises by sector at 387.
Healthcare compromises rose to 281, reversing a slight downward trend from the previous year.
Manufacturing produced 74 million victim notices in H1 2026 compared to 1.97 million in all of 2025.
There were 1,803 data compromises in the first half of 2026.
Q2 2026 tallied 1,029 compromises, the second-highest single-quarter total on record.
2025 recorded 3,321 compromises, and 2026 is on pace to set a new annual record above that.
Insider wrongdoing events totaled 21 in the first half of 2026, a sevenfold increase over the three incidents in 2025.
The number of victim notices issued during the first six months of the year reached an estimated 471.2 million, eclipsing the 297.5 million notices in all of 2025.
Publicly traded companies accounted for 10.3% of compromises but generated 83.4% of all victim notices.
Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.