Sectors

Data breaches by sector

Which kinds of organisations are breached, how many people each sector exposed, and how long they took to tell.

Sector	Last 30 days	2026 so far	On record	People exposed	Median days to tell
Healthcare	42	444	754	35.1M	182
Banks and finance	23	163	337	39.3M	133
Education	32	116	332	25M	92
Industry, energy and transport	14	112	184	6.2M	111
Technology and telecom	23	89	199	89.4M	135
Government	9	71	122	1.9M	162
Law and accounting	2	60	94	543.5K	144
Non-profits and associations	5	51	78	196.4K	129
Insurance	6	50	125	920.1K	126
Travel and hospitality	14	34	51	3.3M	137
Retail and e-commerce	3	17	33	198.3K	117

People exposed: the largest count each organisation reported, leaving out counts of accounts or records and a single state’s residents. Days to tell: from the day a breach began to its first notice, where the notice gives a start date (at least 10 per sector).

How the sector is decided

A sector is read from the organisation’s own name (“Mercy Hospital”, “First National Bank”, “Lincoln School District”) and from the register it filed with (every notice on the US health department’s breach portal is a health organisation’s). A name that says nothing has no sector, and a name can mislead now and then, so these figures are a floor. Found one in the wrong place? Tell us.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.