Monthly data breach statistics
Last updated
Recent data breaches in 2026: monthly statistics
The Serus Data Breach Report tracks the latest data breaches made public in the US each month, with data breach statistics from official notices and Have I Been Pwned. In September 2026, 146 breaches were reported, with 48,891,580 people affected in official notices and 35,723,266 accounts leaked.
Looking for a specific breach? Every data breach in 2026, by name, is on the full list.
CTO
Reviewed by Shkumbin Hasani
Principal Engineer
Data breaches in September 2026
Latest edition
Data breach statistics for September 2026
Published 18 Oct 2026
- Breaches
- 146
- +8% vs August 2026−8% vs September 2025
- People affected
- 48,891,580
- +338% vs August 2026−80% vs September 2025
- Official notices
- Accounts leaked
- 35,723,266
- +85% vs August 2026+263% vs September 2025
- Have I Been Pwned
| Metric | September 2026 | vs August 2026 | vs September 2025 |
|---|---|---|---|
| Breaches | 146 | +8% | −8% |
| People affected | 48,891,580 | +338% | −80% |
| Accounts leaked | 35,723,266 | +85% | +263% |
146 data breaches were reported in September 2026, up 8% from August 2026
Changes use the same sources in both periods. People and accounts are never added together.
Year to date: January to September 2026
- Breaches
- 1,278
- −3% vs the same months of 2025
- People affected
- 178,970,053
- +3% vs the same months of 2025
- Official notices
- Accounts leaked
- 452,701,072
- +135% vs the same months of 2025
- Have I Been Pwned
Changes compare the same sources in both years (how we count).
September was 7% above the 12-month average
Breaches
People affected (official notices)
| Month | Breaches | People affected | Accounts leaked |
|---|---|---|---|
| October 2025 | 101 | 64,447,513 | 32,527,739 |
| November 2025 | 124 | 4,019,169 | 1,967,402,864 |
| December 2025 | 145 | 28,203,810 | 5,593,947 |
| January 2026 | 129 | 7,872,485 | 131,149,791 |
| February 2026 | 147 | 14,010,403 | 61,381,576 |
| March 2026 | 150 | 16,301,650 | 5,528,583 |
| April 2026 | 116 | 9,892,466 | 41,790,763 |
| May 2026 | 157 | 9,332,239 | 50,334,737 |
| June 2026 | 151 | 38,348,637 | 18,383,353 |
| July 2026 | 147 | 23,145,270 | 89,085,270 |
| August 2026 | 135 | 11,175,323 | 19,323,733 |
| September 2026 | 146 | 48,891,580 | 35,723,266 |
Every edition
Questions
How many data breaches were there in September 2026?
We counted 146 breaches from 214 official notices and Have I Been Pwned, affecting at least 48.9 million people.
What was the biggest data breach in September 2026?
DriveWealth, with 30,000,000 people affected according to its notice to the Texas Attorney General. The largest by leaked accounts was LimeLeads, with 17,838,396 accounts in Have I Been Pwned.
What data leaked most often?
Names: 95% of the 78 breaches with known data types. Social Security numbers followed at 77%.
How long do companies take to report a data breach?
In September 2026 the median was 150 days from the start of the breach to the first public notice, across the 101 breaches with both dates.
Can I get my data removed from a breach?
No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.
Author
Argjent SahitiCTO
Leads engineering at Serus, building the systems that find and remove exposure at scale.
Reviewed by
Shkumbin HasaniAbout the data
Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in 2026 so far (CSV).
How we count
- A breach is one incident at one organization; it counts in the month it was first made public.
- People affected come from official notices, accounts leaked from Have I Been Pwned. They're never added together.
- Totals are "at least": many breaches are never reported, and late filings revise past months.
Sources (7)
- Have I Been Pwned (CC BY 4.0): 5 records, retrieved 18 Oct 2026
- California Attorney General: 55 records, retrieved 18 Oct 2026
- Washington Attorney General: 10 records, retrieved 18 Oct 2026
- U.S. Department of Health and Human Services (Public domain (U.S. government work)): 43 records, retrieved 18 Oct 2026
- Texas Attorney General: 79 records, retrieved 18 Oct 2026
- U.S. Securities and Exchange Commission (Public domain (U.S. government work)): 3 records, retrieved 18 Oct 2026
- Oregon Department of Justice: 24 records, retrieved 18 Oct 2026
Check if you're exposed in a breach with Serus
Find your leaks. Get alerted to new ones.