For journalists and researchers

Using the breach tracker in your reporting

5,278 breach records at 4,890 organisations, every one with its sources. Free to quote, chart and republish with credit.

When a breach is in the news

• Major breaches: what we know 141 of 100,000 people or more in the last 90 days. Each page says what is confirmed and by whom, what is not known yet, and the organisation’s earlier breaches, regulator actions and settlements.
• Every organisation, A to Z: its notices to each regulator, the count each one gave, and its notice letter where one was filed.
• Vendor breaches: one attack on a supplier, and every organisation known to be hit through it.

Findings from the data

• What is taken: 80% of US state breach notices that list the data expose Social Security numbers; 2% expose passwords (1,100 notices, twelve months).
• California’s 30-day rule: how long companies take from finding a breach to telling people, from their own letters.
• Count drift: breaches whose number grew after the first announcement.
• The claim ledger: ransomware groups’ claims, followed until they are confirmed or not.
• What regulators did: fines and decisions after breaches, by regulator.
• The annual report and the weekly brief.

Each finding has its method on the page and its rows as a CSV. Figures move as notices are filed, so quote them with their date.

What the three labels mean

• Confirmed: the organisation itself or an authority says the breach happened.
• Reported: in the news, not yet confirmed.
• Claimed by attackers: only the attackers say so. A claim is not proof that data was taken, and we do not present it as a fact; please do not either.

How to cite

Privacy Unpacked data breach tracker, https://privacyunpacked.com/breaches/, figures as of 15 November 2026.

The data is free to reuse under CC BY 4.0: a credit and a link are all we ask. For a figure that must stay checkable, cite a weekly release: the whole dataset frozen on a Monday, with checksums.

The data

• Open data: every record as JSON and CSV, an API, and feeds per country, organisation and regulator.
• The official registers we read, and what each one publishes.

How we check ourselves

• The accuracy audit: in the latest (2026 Q4), 96 of 97 sampled records agreed with their sources; 1 error was corrected. The whole sample is published, errors included.
• Corrections and changes: every change to a record, with its reason. Organisations have a right of reply.
• How the tracker works: official registers are read by code; news is read by an AI model whose every fact must be backed by a quote found in the article.

Ask us

Need a cut we do not show (by state, by sector, by size, by month), a check of one organisation’s row, or a comment on what the data does and does not show? Write to us. Found a mistake? Tell us and it is corrected in public.

What the tracker is not: a list of every breach. It holds what was notified to a register that publishes, announced by the organisation, or reported in the news, and it is strongest in the United States, where public registers exist.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.