Privacy Unpacked
Menu

Year

Data breaches in 2025

The 935 confirmed or reported breaches first made public in 2025 on the tracker, the largest first, each linked to its notices.

Breaches on record
935
A million or more
22
Countries
9
Busiest month
December

The biggest data breaches of 2025, by their total count

  1. 1win 96,166,543 accounts 3 February 2025
  2. Prosper 17,605,276 accounts 16 October 2025
  3. Free 13,926,173 accounts 27 May 2025 · France
  4. Zacks (2024) 11,994,223 accounts 12 February 2025
  5. Storenvy 11,052,071 accounts 16 February 2025
  6. Vietnam Airlines 7,316,915 accounts 11 October 2025
  7. China Software Developer Network 6,414,990 accounts 27 November 2025
  8. Bouygues Telecom 5,685,771 accounts 24 September 2025 · France
  9. Scholastic 4,247,768 accounts 13 January 2025
  10. MyVidster (2025) 3,864,364 accounts 27 October 2025
  11. Adpost 3,339,512 accounts 7 October 2025
  12. Thermomix Recipe World Forum 3,123,439 accounts 6 February 2025 · Germany
  13. WIRED 2,364,431 accounts 27 December 2025
  14. Boulanger 2,077,078 accounts 8 April 2025
  15. ADDA 1,829,314 accounts 23 November 2025
  16. Cultura 1,462,025 accounts 25 September 2025
  17. Allianz Life Insurance Company of North America 1,115,061 accounts 25 July 2025 · United States
  18. Allianz Life Insurance Company of North America 1,115,061 accounts 25 July 2025 · United States
  19. OnRPG 1,047,640 accounts 8 May 2025
  20. Beckett Collectibles 1,041,238 accounts 20 November 2025
  21. Giglio 1,026,468 accounts 1 September 2025
  22. Qraved 984,519 accounts 9 April 2025
  23. Youthmanual 937,912 accounts 9 February 2025
  24. WiredBucks 918,529 accounts 10 June 2025
  25. GLAMIRA 874,594 accounts 3 January 2025

By the count in the notice, the company’s statement or the breach database, confirmed breaches only. Stealer-log and credential-stuffing compilations are left out: they gather accounts from many places and are not one organisation’s breach. Counts are in their own unit: people, accounts or records are not the same thing, and one person can be in several breaches. A count of one state’s residents is left out here: it is not the breach’s size.

Told to many states, with no total

These breaches were notified to several US states’ registers, each with its own residents’ count, but no notice on the tracker gives the total, so they cannot be ranked above. Some were among the year’s largest.

Month by month

  • January69
  • February87
  • March106
  • April78
  • May68
  • June63
  • July79
  • August56
  • September61
  • October60
  • November92
  • December116

By sector

The sector is read from the organisation’s name and the register it filed with; a name that says nothing has none, so these are floors.

By country

Every notice, register by register

What is counted

A breach counts in the year it was first made public. For 2025, the tracker’s records are the official US registers (state attorneys general, the US health department and the SEC) and the breach databases; the tracker began reading the news worldwide in 2026, so 2025 counts mostly breaches in the United States. Attackers’ own claims are never counted. Each breach links to its page, with every notice and its source.

Other years: 2024, 2023 · this year so far: State of Data Breaches 2026.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.