Privacy Unpacked
Menu

Report · updated daily

State of Data Breaches 2026

Data breaches in 2026 so far, from official breach registers, ransomware claims and the tracker’s own records. Figures as of 28 October 2026.

Breach notices: 470 in California so far this year #

Organisations filed 470 data breach notices with California’s Attorney General between 1 January and 28 October 2026, +3% on the same date in 2025 (456). Washington’s Attorney General received 182, −4% (189).

2014: 156 156 ’142015: 182 182 ’152016: 205 205 ’162017: 265 265 ’172018: 204 204 ’182019: 209 209 ’192020: 310 310 ’202021: 392 392 ’212022: 377 377 ’222023: 519 519 ’232024: 514 514 ’242025: 456 456 ’252026: 470 470 ’26
Notices filed with California’s Attorney General from 1 January to 28 October, each year
2017: 88 88 20172018: 54 54 20182019: 60 60 20192020: 196 196 20202021: 171 171 20212022: 161 161 20222023: 216 216 20232024: 206 206 20242025: 189 189 20252026: 182 182 2026
Notices filed with Washington’s Attorney General from 1 January to 28 October, each year

California publishes every notice sent to more than 500 Californians, Washington every notice sent to more than 500 Washingtonians. California’s register goes back to 2012 and Washington’s to 2015, so the same dates each year compare like with like.

Washingtonians notified: 2,464,504 so far #

Washington’s register gives a count of residents for every notice, back to 2015. Its residents received 2,464,504 breach notices in 2026 so far, after 4,612,934 in all of 2025. One person can be counted more than once: every notice is counted.

2017: 4.2M 4.2M 20172018: 225,371 225,371 20182019: 1.4M 1.4M 20192020: 4.7M 4.7M 20202021: 4.8M 4.8M 20212022: 2.7M 2.7M 20222023: 5.5M 5.5M 20232024: 7.0M 7.0M 20242025: 4.6M 4.6M 20252026: 2.5M 2.5M 2026
Washington residents notified of a data breach, each year (the current year so far)

Time to tell: a median of 155 days #

From the day a breach began to the day it was reported to California, the median over the last 12 months was 155 days, and 70% of breaches took more than 90 days. In 2014 it was 60 days; in 2025, 186.

2014: 60 days 60 ’142015: 89 days 89 ’152016: 81 days 81 ’162017: 100 days 100 ’172018: 126 days 126 ’182019: 145 days 145 ’192020: 142 days 142 ’202021: 130 days 130 ’212022: 161 days 161 ’222023: 126 days 126 ’232024: 175 days 175 ’242025: 186 days 186 ’252026: 152 days 152 ’26
Median days from the start of a breach to its notice in California, by year of notice

Notices that give both dates: 4,770 since 2013. The law asks for notice “in the most expedient time possible and without unreasonable delay”.

Ransomware claims: 7,766 in January–September #

Ransomware gangs named 7,766 organisations on their leak sites from January–September 2026, +34% on the same months of 2025 (5,796). The most active was Qilin, with 1,064 claims. At least 33% of all claims since 2020 name an organisation in the United States.

  1. Qilin 1,064
  2. The Gentlemen 833
  3. Akira 393
  4. INC Ransom 353
  5. DragonForce 322
  6. LockBit 5.0 259
  7. Cl0p 240
  8. NightSpire 227

When a claimed organisation later filed an official breach notice (381 cases matched by name), the notice came a median of 98 days after the gang’s claim.

A claim is the gang’s word, not a confirmed breach. Counted from ransomware.live’s list of leak-site claims. Every gang →

The largest confirmed breaches since 23 July 2026 #

The tracker has recorded 722 confirmed or reported breaches in 24 countries since 23 July 2026, when it began. The largest, by the count in the notice, the company’s statement or the breach database:

  1. LimeLeads 17,838,396 accounts 22 September 2026
  2. Carhartt 12,933,413 accounts 25 August 2026 · United States
  3. Capcom 12,000,000 accounts 22 October 2026 · Japan
  4. Manchester Airports Group 8,849,657 accounts 2 September 2026 · United Kingdom
  5. Danish Central Person Register (CPR) 8,800,000 people 5 October 2026 · Denmark
  6. iRhythm Technologies Inc. 8,179,772 patients 3 October 2026 · United States
  7. Angel One 6,765,054 accounts 7 October 2026 · India
  8. Park24 Co. 6,620,000 accounts 23 October 2026 · Japan
  9. Chess.com (2026) 4,653,212 accounts 13 September 2026
  10. Change Holdings 4,454,097 customers 26 October 2026

What was taken: names in 56% #

Of the 540 breaches since 23 July 2026 whose source says what was exposed:

  • Names30256%
  • Health and medical information26749%
  • Social Security numbers25647%
  • Dates of birth17332%
  • Addresses16330%
  • Financial account and card details15529%
  • Driver’s license numbers13625%
  • Government ID numbers11822%

After the breach #

  • Data protection regulators we follow took 10 actions after breaches in 2026, including 2 UK fines totalling £1,211,490. What regulators did →
  • 52 data breach class-action settlements are open for claims; the next deadline is 2 November 2026 (ConnectOnCall.com). Settlements →

Use these figures

Every figure here is free to use with credit, under CC BY 4.0. Each heading’s # links to that figure. Please cite:

Privacy Unpacked, “State of Data Breaches 2026”, https://privacyunpacked.com/breaches/report/, figures as of 28 October 2026. Licensed CC BY 4.0.

The records behind the tracker are in the open data (CSV and JSON). How each source is read is described on the tracker. Journalists and researchers who need a figure we do not show can ask us.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.