Data breach trends

Every figure comes from the authority that received the reports, with a link to where it says so. Countries count different things: under the GDPR, European organisations must report a personal data breach to their authority unless it is unlikely to harm anyone, so European figures include small incidents such as an email sent to the wrong person; other countries count only breaches above a threshold, or only cyber attacks. That is why the total is never compared across a different set of countries: the change from one year to the next uses only the countries that report both years. Countries that do not publish a count, including the United States, Germany (whose 16 state authorities each keep their own figures) and India, are left out rather than estimated, so the real worldwide number is higher. For Europe alone, the law firm DLA Piper estimates from its own survey of the authorities that 443 breaches a day were reported in the year to January 2026, 22% more than a year earlier.

Some years are pushed up by one attack on a supplier with many customers, which leads to hundreds or thousands of reports about the same incident; the country table notes where the authority says so.