Privacy Unpacked

Updated hourly

Count drift: breaches that grew

The first number a breach is announced with is often not the last. These are the breaches on the tracker whose count grew after the first notice: the same kind of count, from a later and larger source.

Breaches that grew
14
Typical growth
×2.3
Largest
×96
Typical days to the larger count
14

Together these breaches went from 305,392,804 to 344,923,327 in their first and largest counts: 39,530,523 more than first announced.

Every breach that grew, largest growth first

  1. SBI ×96 first 3,897 records (बिजनेस स्टैंडर्ड हिंदी, 20 October 2026), then 375,000 (The Economic Times, 14 November 2026, 25 days later)
  2. Lennar Mortgage ×52 first 6,643 people (Indiana Attorney General, 11 August 2026), then 348,416 (Indiana Attorney General, 14 August 2026, 3 days later)
  3. BreachForums ×50 first 4,204 accounts (Have I Been Pwned, 25 June 2023), then 212,156 (Have I Been Pwned, 26 July 2023, 31 days later)
  4. Roblox ×13 first 3,943 accounts (Have I Been Pwned, 18 July 2023), then 52,458 (Have I Been Pwned, 23 July 2023, 5 days later)
  5. Buechel Stone ×4.8 first 214 people (Indiana Attorney General, 19 June 2026), then 1,021 (Indiana Attorney General, 28 July 2026, 39 days later)
  6. Capital One ×4 first 3 people (Indiana Attorney General, 12 January 2026), then 12 (Indiana Attorney General, 27 January 2026, 15 days later)
  7. Interim HealthCare ×2.6 first 500 patients (US Department of Health and Human Services, 31 July 2026), then 1,283 (US Department of Health and Human Services, 10 September 2026, 41 days later)
  8. Allstate ×2.3 first 1,131 people (Indiana Attorney General, 5 August 2026), then 2,604 (Indiana Attorney General, 19 August 2026, 14 days later)
  9. Wiley Rein ×2.1 first 120 people (Indiana Attorney General, 26 February 2026), then 247 (Indiana Attorney General, 11 March 2026, 13 days later)
  10. Community Physicians of Indiana ×2 first 2 people (Indiana Attorney General, 15 July 2026), then 4 (Indiana Attorney General, 7 August 2026, 23 days later)
  11. Fidelity National Title ×2 first 1 people (Indiana Attorney General, 13 May 2026), then 2 (Indiana Attorney General, 15 May 2026, 2 days later)
  12. Explore Talent (August 2024) ×1.7 first 5,371,574 accounts (Have I Been Pwned, 25 July 2024), then 8,929,384 (Have I Been Pwned, 19 August 2024, 25 days later)
  13. LPL Financial ×1.3 first 572 people (Indiana Attorney General, 22 October 2026), then 740 (Indiana Attorney General, 30 October 2026, 8 days later)
  14. Binance ×1.1 first 300,000,000 users (WDR, 30 October 2026), then 335,000,000 (Tageblatt, 1 November 2026, 2 days later)

How it is counted

Each breach on the tracker keeps every notice about it: each state’s filing, each official register, each news report, with the number it gave and the day. A breach counts here when a later notice gives a larger number, at least 10% larger, in the same unit as the first (people with people, accounts with accounts). A state’s count of its own residents is never compared with a total: a breach told to several states is not growing, it is being counted state by state. Claims made only by attackers never count.

A larger count usually means the investigation found more: more people, more records, more systems. It is also why the first number in a headline should be read as a floor. Each breach links to its page, with every notice and its source.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.