How the tracker works

Records come from official breach notices (the registers: the Attorneys General of California, Washington, Vermont, Texas, Iowa, Indiana and Delaware, Oregon's Department of Justice, Wisconsin's consumer protection department, the US Department of Health and Human Services for health breaches of 500+ people, and companies' cybersecurity filings with the US Securities and Exchange Commission), from Have I Been Pwned's list of breached services, from ransomware gangs' own leak-site claims as collected by ransomware.live, and from the news: about 70 security and national news feeds and news searches in more than 15 languages, read every hour. Reports about the same company within 45 days are one record with several sources. Numbers are as reported: "accounts" are email addresses in a breached database, "Washington residents" are the people one state was told about, so the real total can be higher. A record marked reported has not been confirmed by the company or an authority; claimed by attackers means only the attackers or a researcher say so: a gang naming a victim on its leak site is not proof that personal data was stolen. Every fact taken from a news article is checked word for word against the article, in its own language.

Pins sit in the country where the company is based, not where the people affected live. Records whose country we have not yet checked are listed but not pinned. Every change after publication is on the corrections and changes page. Found a mistake? Tell us at our contact page and we correct it.

Were you affected? Start with what to do after a data breach.