What is taken: Social Security numbers, not passwords

Why the two look so different

They are two different sets of breaches. Have I Been Pwned collects stolen data that circulates online, which is mostly account lists: email addresses and passwords from websites and apps. A state register holds what the law makes a company report, and US state laws require a notice only when certain kinds of data are involved: typically a name together with a Social Security number, a driver’s license or other ID number, financial account details and, in many states, medical or health insurance information. A breach of email addresses and passwords alone often needs no filing with a state at all, which is one reason passwords are rare in the registers.

So neither set is “all breaches”. But the registers are the breaches people get a letter about, and those letters are mostly about data that cannot be reset.

What that means if you get a letter

Changing a password does nothing for a Social Security number. When a notice lists a Social Security number, the step that protects you is a credit freeze with each of the three US credit bureaus, which is free by federal law and stops new credit being opened in your name. Each breach on the tracker has its own plan, built from what that breach exposed: find the company on the tracker, or see My breaches.

How it is counted

Every breach on the tracker that was reported in the last twelve months and has a notice on a US state register (the attorneys general of California, Washington, Texas, Vermont, Indiana, Iowa and Delaware, Oregon’s Department of Justice, Wisconsin’s consumer protection department). The federal health department’s breach portal is left out: it does not list what was exposed. The kinds of data are the ones the register lists for the notice or, where the register publishes the letter, the ones the letter names. They are grouped into the tracker’s plain categories; a notice that lists none is left out. Attackers’ claims are never counted.

The comparison column is every breach added to Have I Been Pwned in the same months that is on the tracker from that source alone, with the data classes it publishes. Registers differ in what they publish and in which breaches must be filed, so the shares describe these notices, not every breach in the United States.

For journalists and researchers

• Download every notice counted (CSV): the organisation, the day reported, the registers, what was exposed, and a link to its page with the sources.
• Free to use with credit, under CC BY 4.0. Please cite: Privacy Unpacked, “What is taken: Social Security numbers, not passwords”, https://privacyunpacked.com/breaches/whats-taken/, figures as of 15 November 2026.
• The figures move as notices are filed: quote them with their date. For a cut we do not show (by state, by sector, by size), write to us. How we check our own records: the accuracy audit.