Data Breach Statistics
Data Breach by Industry
Latest Statistics
AI-enabled malicious breaches increased by 56% over the previous year.
Financial services breaches cost on average $6.3 million.
64% of organizations plan to increase security spending after experiencing a breach.
More than 20% of organizations reported a breach targeting AI models or applications.
25% of malicious breaches were AI-enabled.
AI-enabled breaches cost an average of $6 million.
AI-enabled breaches cost roughly $1 million more than the global breach average.
Energy sector breaches cost on average $5.2 million.
27% of breaches were caused by cloud misconfigurations affecting AI workloads.
Using AI and automation in security operations cuts breach costs by almost $2 million on average.
37% of breached organizations encrypted sensitive data both at rest and in transit.
73% of organizations have found their workforce’s credentials in breach, Dark Web, or infostealer data in the past year
Nearly 693,000 records are known to have been breached in the confirmed education-sector ransomware attacks in H1 2026.
Only 24% of H1 2026 breach notices contained attack-vector details, the lowest rate ever recorded by the ITRC.
A single Canvas data compromise generated an estimated 275 million victim notices, accounting for 58% of the H1 2026 total.
Financial services recorded the highest frequency of compromises by sector at 387.
Healthcare compromises rose to 281, reversing a slight downward trend from the previous year.
Manufacturing produced 74 million victim notices in H1 2026 compared to 1.97 million in all of 2025.
There were 1,803 data compromises in the first half of 2026.
Q2 2026 tallied 1,029 compromises, the second-highest single-quarter total on record.
2025 recorded 3,321 compromises, and 2026 is on pace to set a new annual record above that.
The number of victim notices issued during the first six months of the year reached an estimated 471.2 million, eclipsing the 297.5 million notices in all of 2025.
Publicly traded companies accounted for 10.3% of compromises but generated 83.4% of all victim notices.
Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.
77% of enterprises are concerned about data breaches or theft in non-production environments.
68% of enterprises are concerned about data leaks in AI workflows.
Stealer log exposure increased 175% in a before-and-after security posture comparison.
34% of enterprise leaders report their organizations have experienced data breaches or theft.
Deadlock was absent from public data-leak sites for 11 months before emerging publicly.
Confirmed ransomware attacks on government entities involved 179,000 known breached records in H1 2026.
The City of Suffolk, Virginia breach affected 157,725 people in February 2026.
İzelman A.Ş. (İzmir municipal parking service) reports that 10,000 people may have been impacted in its March 2026 breach.
The City of Middletown, Ohio began notifying 123,791 people of a breach originating in July 2025.
Winona County notified 6,196 people of a breach following its January 2026 attack.
Most government agencies take an average of about four months to notify victims of data breaches following ransomware attacks.
The US absorbed 1,094 ransomware victim data leak posts in Q2, roughly 49% of observed activity and nine times the volume of the next country.
100% of executives have breach data linking their name to at least one current email address.
94% of executives have at least one plaintext password exposed in breach data.
40% of quick service and fast casual restaurant chains had payment card data leaked in the past 12 months.