Privacy UnpackedYear
Data breaches in 2023
The 889 confirmed or reported breaches first made public in 2023 on the tracker, the largest first, each linked to its notices.
- Breaches on record
- 889
- A million or more
- 37
- Countries
- 14
- Busiest month
- August
The biggest data breaches of 2023, by their total count
- Deezer 229,037,936 accounts 2 January 2023
- Twitter (200M) 211,524,284 accounts 5 January 2023
- Luxottica 77,093,812 accounts 19 May 2023
- Public Business Data 27,917,714 accounts 9 October 2023
- RailYatri 23,209,732 accounts 5 December 2023 · India
- Eye4Fraud 16,000,591 accounts 6 March 2023
- IndiHome 12,629,245 accounts 27 November 2023 · Indonesia
- Instant Checkmate 11,943,887 accounts 4 February 2023
- Zacks 8,929,503 accounts 10 June 2023
- Tunngle 8,192,928 accounts 21 October 2023
- Truth Finder 8,159,573 accounts 4 February 2023
- OMGPOP 7,071,293 accounts 20 November 2023
- AndroidLista 6,640,643 accounts 17 October 2023
- GameSprite 6,164,643 accounts 30 October 2023
- Estante Virtual 5,412,603 accounts 29 November 2023 · Brazil
- Go Ninja 4,999,001 accounts 30 November 2023 · Germany
- SoarGames 4,774,445 accounts 3 December 2023
- Gemplex 4,563,166 accounts 9 December 2023
- JoyGames 4,461,787 accounts 7 December 2023
- MemeChat 4,348,570 accounts 29 October 2023
- MalindoAir 4,328,232 accounts 14 September 2023
- Kaneva 3,901,179 accounts 9 December 2023
- PlayCyberGames 3,681,753 accounts 31 August 2023
- iMenu360 3,425,860 accounts 17 August 2023
- Avito 2,721,835 accounts 14 November 2023
By the count in the notice, the company’s statement or the breach database, confirmed breaches only. Stealer-log and credential-stuffing compilations are left out: they gather accounts from many places and are not one organisation’s breach. Counts are in their own unit: people, accounts or records are not the same thing, and one person can be in several breaches. A count of one state’s residents is left out here: it is not the breach’s size.
Told to many states, with no total
These breaches were notified to several US states’ registers, each with its own residents’ count, but no notice on the tracker gives the total, so they cannot be ranked above. Some were among the year’s largest.
- Navvis & Company told to 6 registers · 22 September 2023
- Maximus Inc told to 6 registers · 26 July 2023
- Nationstar Mortgage LLC (dba Mr. Cooper) told to 5 registers · 15 December 2023
- Harvard Pilgrim Health Care told to 5 registers · 14 June 2023
- Pension Benefit Information, LLC ("PBI") told to 5 registers · 11 July 2023
- Zeroed-In Technologies, LLC told to 5 registers · 27 November 2023
- Apria Healthcare LLC told to 5 registers · 22 May 2023
- Welltok, Inc. told to 5 registers · 17 November 2023
- LoanCare, LLC told to 5 registers · 20 December 2023
- Milliman, Inc. told to 5 registers · 17 July 2023
- NCB Management Services, Inc. told to 5 registers · 19 May 2023
- NextGen Healthcare, Inc. told to 5 registers · 28 April 2023
- The Global Atlantic Financial Group LLC (“Global Atlantic”) told to 5 registers · 28 July 2023
- ZOLL Medical Corporation told to 5 registers · 10 March 2023
- MGM Resorts International told to 5 registers · 5 October 2023
- Hartford Life and Accident Insurance Company told to 5 registers · 3 August 2023
- Talcott Resolution Life Insurance Company told to 5 registers · 23 June 2023
- F21 OpCo LLC (d/b/a Forever 21) told to 5 registers · 29 August 2023
- 1st Source Bank told to 5 registers · 10 July 2023
- UnitedHealthcare Student Resources told to 5 registers · 9 June 2023
Month by month
By sector
The sector is read from the organisation’s name and the register it filed with; a name that says nothing has none, so these are floors.
By country
Every notice, register by register
What is counted
A breach counts in the year it was first made public. For 2023, the tracker’s records are the official US registers (state attorneys general, the US health department and the SEC) and the breach databases; the tracker began reading the news worldwide in 2026, so 2023 counts mostly breaches in the United States. Attackers’ own claims are never counted. Each breach links to its page, with every notice and its source.
Other years: 2025, 2024 · this year so far: State of Data Breaches 2026.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.