Privacy Unpacked
Menu

Year

Data breaches in 2024

The 860 confirmed or reported breaches first made public in 2024 on the tracker, the largest first, each linked to its notices.

Breaches on record
860
A million or more
49
Countries
16
Busiest month
March

The biggest data breaches of 2024, by their total count

  1. National Public Data 133,957,569 accounts 12 August 2024 · United States
  2. DemandScience by Pure Incubation 121,796,165 accounts 13 November 2024
  3. Advance Auto Parts 79,243,727 accounts 24 June 2024
  4. The Post Millennial 56,973,345 accounts 10 May 2024
  5. Hot Topic 56,904,909 accounts 11 November 2024
  6. AT&T Inc. 49,102,176 accounts 19 March 2024 · United States
  7. Neiman Marcus 31,152,842 accounts 24 June 2024
  8. Internet Archive 31,081,179 accounts 9 October 2024
  9. French Citizens 28,445,106 accounts 20 December 2024
  10. Hopamedia 23,835,870 accounts 16 December 2024
  11. Cutout.Pro 19,972,829 accounts 28 February 2024
  12. Trello 15,111,945 accounts 22 January 2024
  13. Z-lib 9,737,374 accounts 4 November 2024
  14. Explore Talent (August 2024) 8,929,384 accounts 25 July 2024
  15. boAt 7,528,985 accounts 8 April 2024
  16. MovieBoxPro 6,009,014 accounts 30 April 2024
  17. MyPertamina 5,970,416 accounts 27 January 2024 · Indonesia
  18. Lookiero 4,981,760 accounts 30 August 2024
  19. Hathway 4,670,080 accounts 12 January 2024
  20. SurveyLama 4,426,879 accounts 2 April 2024
  21. Legendas.TV 3,869,181 accounts 4 January 2024
  22. Online Trade (Онлайн Трейд) 3,805,265 accounts 7 March 2024 · Russia
  23. ClickASnap 3,262,980 accounts 13 March 2024
  24. Sport 2000 3,189,643 accounts 28 August 2024 · France
  25. Blooms Today 3,184,010 accounts 3 September 2024

By the count in the notice, the company’s statement or the breach database, confirmed breaches only. Stealer-log and credential-stuffing compilations are left out: they gather accounts from many places and are not one organisation’s breach. Counts are in their own unit: people, accounts or records are not the same thing, and one person can be in several breaches. A count of one state’s residents is left out here: it is not the breach’s size.

Told to many states, with no total

These breaches were notified to several US states’ registers, each with its own residents’ count, but no notice on the tracker gives the total, so they cannot be ranked above. Some were among the year’s largest.

Month by month

  • January66
  • February70
  • March99
  • April73
  • May92
  • June64
  • July64
  • August78
  • September54
  • October74
  • November62
  • December64

By sector

The sector is read from the organisation’s name and the register it filed with; a name that says nothing has none, so these are floors.

By country

Every notice, register by register

What is counted

A breach counts in the year it was first made public. For 2024, the tracker’s records are the official US registers (state attorneys general, the US health department and the SEC) and the breach databases; the tracker began reading the news worldwide in 2026, so 2024 counts mostly breaches in the United States. Attackers’ own claims are never counted. Each breach links to its page, with every notice and its source.

Other years: 2025, 2023 · this year so far: State of Data Breaches 2026.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.