Monthly edition · March 2026
Published
Data breaches in March 2026
150 data breaches were reported in March 2026, from 217 notices filed with US regulators plus new entries on Have I Been Pwned. Official notices put the number of people affected at 16.3 million or more, and 5.53 million leaked accounts were added to Have I Been Pwned. Healthcare accounted for 78 of the 150 breaches and 10.6 million of the people affected, led by CareCloud at 3.76 million.
CTO
Reviewed by Shkumbin Hasani
Principal Engineer
Key takeaways
- 150 breaches in March 2026, up 2% on February 2026 counting the same sources.
- The largest was CareCloud: 3.76 million people affected, per its notice to the U.S. Department of Health and Human Services.
- Names leaked in 87% of the 61 breaches whose notices listed the data.
- Half of the breaches reached a regulator 105 days or more after they began.
- 75 health breaches went to HHS, affecting 13.3 million people.
- Breaches
- 150
- +2% vs February 2026−13% vs March 2025
- People affected
- 16,301,650
- +16% vs February 2026+210% vs March 2025
- Official notices
- Accounts leaked
- 5,528,583
- −91% vs February 2026+2,504% vs March 2025
- Have I Been Pwned
| Metric | March 2026 | vs February 2026 | vs March 2025 |
|---|---|---|---|
| Breaches | 150 | +2% | −13% |
| People affected | 16,301,650 | +16% | +210% |
| Accounts leaked | 5,528,583 | −91% | +2,504% |
150 data breaches were reported in March 2026, up 2% from February 2026
Changes use the same sources in both periods. People and accounts are never added together.
What happened in March 2026
We counted 150 breaches in March 2026: 217 official notices to state attorneys general, HHS and the SEC, plus breaches added to Have I Been Pwned. One organization filing in several states counts once. The count is up 2% on February 2026 and down 13% on March 2025, comparing the same sources. So far in 2026 we've counted 426 breaches, with at least 38.2 million people affected.
March has the most breaches of the last 12 months, which ranged from 101 to 150 a month. People affected rose 16% on February 2026 counting the same sources, spread over several large notices led by CareCloud, while Have I Been Pwned added far fewer accounts than in February (down 91%, same sources).
March had the most breaches in 12 months
Breaches
People affected (official notices)
| Month | Breaches | People affected | Accounts leaked |
|---|---|---|---|
| April 2025 | 124 | 14,887,559 | 3,277,930 |
| May 2025 | 115 | 5,261,883 | 15,310,147 |
| June 2025 | 120 | 30,681,499 | 2,311,398 |
| July 2025 | 107 | 30,185,837 | 479,329 |
| August 2025 | 109 | 8,541,829 | 2,065,798 |
| September 2025 | 115 | 6,097,257 | 9,852,406 |
| October 2025 | 101 | 64,447,513 | 32,527,739 |
| November 2025 | 124 | 4,019,169 | 1,967,402,864 |
| December 2025 | 145 | 28,203,810 | 5,593,947 |
| January 2026 | 129 | 7,872,485 | 131,149,791 |
| February 2026 | 147 | 14,010,403 | 61,381,576 |
| March 2026 | 150 | 16,301,650 | 5,528,583 |
The biggest breaches
Ranked by people affected, from official notices:
CareCloud was the largest breach, with 3.8M people affected
| Organization | People affected | Reported | Breach date | Source |
|---|---|---|---|---|
| CareCloud | 3,756,469 | 27 Mar 2026 | 10 Mar 2026 | U.S. Department of Health and Human Services |
| Navia Benefit Solutions | 2,697,540 | 18 Mar 2026 | 22 Dec 2025 | Texas Attorney General |
| Nacogdoches Memorial Hospital | 2,507,073 | 30 Mar 2026 | n/a | U.S. Department of Health and Human Services |
| New York City Health and Hospitals | 1,800,000 | 24 Mar 2026 | n/a | U.S. Department of Health and Human Services |
| Kaplan North America | 1,403,060 | 17 Mar 2026 | 30 Oct 2025 | Texas Attorney General |
| OpenLoop Health | 716,000 | 17 Mar 2026 | 7 Jan 2026 | U.S. Department of Health and Human Services |
| Erie Family Health Centers | 570,000 | 27 Mar 2026 | n/a | U.S. Department of Health and Human Services |
| Gulshan Management Services | 377,082 | 16 Mar 2026 | 17 Sept 2025 | Texas Attorney General |
| Check City | 322,687 | 19 Mar 2026 | 21 Mar 2025 | Texas Attorney General |
| North Texas Behavioral Health Authority | 285,086 | 6 Mar 2026 | 13 Oct 2025 | U.S. Department of Health and Human Services |
CareCloud, a healthcare company, says its breach began on March 10 and exposed names, addresses, dates of birth, Social Security numbers, ID numbers, financial account numbers and medical and health insurance details. Navia Benefit Solutions dates its breach to December 22, 2025, and lists names, addresses, Social Security numbers and dates of birth.
Ranked by leaked accounts, from Have I Been Pwned:
Baydöner exposed the most accounts: 1.3M
| Organization | Accounts exposed | Reported | Breach date | Source |
|---|---|---|---|---|
| Baydöner | 1,266,822 | 15 Mar 2026 | 8 Mar 2026 | Have I Been Pwned |
| KomikoAI | 1,060,191 | 2 Mar 2026 | 25 Feb 2026 | Have I Been Pwned |
| Aura | 903,080 | 18 Mar 2026 | 6 Mar 2026 | Have I Been Pwned |
| Provecho | 712,904 | 3 Mar 2026 | 30 Jan 2026 | Have I Been Pwned |
| Lovora | 495,556 | 2 Mar 2026 | 25 Feb 2026 | Have I Been Pwned |
| BreachForums Version 5 | 339,778 | 27 Mar 2026 | 26 Mar 2026 | Have I Been Pwned |
| Sound Radix | 292,993 | 26 Mar 2026 | 25 Mar 2026 | Have I Been Pwned |
| RuneScape Boards | 222,762 | 23 Mar 2026 | 26 Dec 2011 | Have I Been Pwned |
| Scuf Gaming | 128,683 | 26 Mar 2026 | 5 Jun 2015 | Have I Been Pwned |
| Divine Skins | 105,814 | 15 Mar 2026 | 13 Mar 2026 | Have I Been Pwned |
People affected and leaked accounts are counted separately and never added together.
What leaked
Of the 61 breaches where the notice or Have I Been Pwned listed the data involved:
Names leaked in 87% of breaches
Share of the 61 breaches where the data types are known
| Data type | Share of breaches | Breaches |
|---|---|---|
| Names | 87% | 53 |
| Social Security numbers | 66% | 40 |
| Dates of birth | 46% | 28 |
| Driver's licenses and government IDs | 46% | 28 |
| Physical addresses | 46% | 28 |
| Financial account or card numbers | 43% | 26 |
| Medical information | 38% | 23 |
| Health insurance information | 36% | 22 |
| Email addresses | 16% | 10 |
| Passwords | 8.2% | 5 |
| Usernames | 8.2% | 5 |
| IP addresses | 4.9% | 3 |
A Social Security number plus a date of birth is enough to open credit in your name. Add a driver's license number, which turned up in close to half of these breaches, and someone can pass an identity check as you.
2.25 million of the leaked accounts (41%) came with passwords.
Sectors and causes
Healthcare had the most breaches: 78
33 breaches had no sector.
| Sector | Breaches | People affected |
|---|---|---|
| Healthcare | 78 | 10,641,472 |
| Retail | 13 | 494,546 |
| Other | 10 | 2,823,717 |
| Finance | 9 | 700,542 |
| Education | 3 | 1,474,754 |
| Manufacturing | 2 | 4,910 |
| Government | 1 | 160,830 |
| Nonprofit | 1 | 879 |
Notices gave a cause for 87 breaches:
Hacking or IT incident was the most common cause, behind 86% of breaches
Share of the 87 breaches with a reported cause
- Hacking or IT incident 86%
- Unauthorized access 6.9%
- Ransomware 4.6%
- Insider 1.1%
- Theft or loss 1.1%
| Cause | Share of breaches | Breaches |
|---|---|---|
| Hacking or IT incident | 86% | 75 |
| Unauthorized access | 6.9% | 6 |
| Ransomware | 4.6% | 4 |
| Insider | 1.1% | 1 |
| Theft or loss | 1.1% | 1 |
Healthcare filed more than half of the breaches and most of the people affected, and where a notice gave a cause, it was nearly always hacking or an IT incident.
Health breaches have their own register: 75 breaches of 500 or more people reached the HHS Office for Civil Rights in March 2026, affecting 13,336,008 people. The largest was CareCloud (3,756,469 people).
Time to notify
For the 79 breaches where we know both dates, the median time from the start of the breach to the first public notice was 105 days. A quarter took 200 days or more.
For half of these breaches, the data had been out for more than three months before anyone was told.
21 organizations reported more than one separate breach in the last 12 months, including 360training.com, Alera, AltaMed Health Services.
What it means for you
If you got a breach letter, or you used one of the services above, change that password and any account that shares it, turn on two-step verification, and expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with Equifax, Experian and TransUnion is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.
Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.
If a notice lists your Social Security number, freeze your credit with all three bureaus before anything else: it's free and it blocks new accounts, which a password change can't.
More from this edition
- Time to notify
- 105 days
- Median from breach to public notice; 75% within 200 days. 79 breaches with both dates.
- Repeat breaches
- 21
- Organizations with 2 or more breaches in the last 12 months, such as 360training.com and Alera.
- Passwords exposed
- 41%
- Of leaked accounts on Have I Been Pwned (2,251,038 accounts).
- Health breaches
- 75
- Reported to HHS (500+ people each), 13,336,008 people affected. Largest: CareCloud (3,756,469).
Looking for a specific breach? Every data breach in 2026 is listed by name, biggest first, on the full list, updated daily.
Questions
How many data breaches were there in March 2026?
We counted 150 breaches from 217 official notices and Have I Been Pwned, affecting at least 16.3 million people.
What was the biggest data breach in March 2026?
CareCloud, with 3,756,469 people affected according to its notice to the U.S. Department of Health and Human Services. The largest by leaked accounts was Baydöner, with 1,266,822 accounts in Have I Been Pwned.
What data leaked most often?
Names: 87% of the 61 breaches with known data types. Social Security numbers followed at 66%.
How long do companies take to report a data breach?
In March 2026 the median was 105 days from the start of the breach to the first public notice, across the 79 breaches with both dates.
Can I get my data removed from a breach?
No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.
Author
Argjent SahitiCTO
Leads engineering at Serus, building the systems that find and remove exposure at scale.
Reviewed by
Shkumbin HasaniAbout the data
Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in March 2026 (CSV).
How we count
A breach is one incident at one organization; a notice is one filing with a regulator, and one breach can have several. Notices come from the California, Washington and Texas attorneys general, the Oregon Department of Justice, the HHS Office for Civil Rights and SEC 8-K Item 1.05 filings; leaked accounts come from Have I Been Pwned (CC BY 4.0). A breach counts in the month it was first reported. States only count their own residents and HHS only lists health breaches of 500 or more people, so totals are a floor. Late filings can change these numbers; changes are logged on this page. Full rules: methodology.
This edition was compiled on October 18, 2026 from the official notices available then; late filings can still change it.
Sources (7)
- Have I Been Pwned (CC BY 4.0): 10 records, retrieved 18 Oct 2026
- California Attorney General: 45 records, retrieved 18 Oct 2026
- Washington Attorney General: 17 records, retrieved 18 Oct 2026
- U.S. Department of Health and Human Services (Public domain (U.S. government work)): 77 records, retrieved 18 Oct 2026
- Texas Attorney General: 56 records, retrieved 18 Oct 2026
- U.S. Securities and Exchange Commission (Public domain (U.S. government work)): 2 records, retrieved 18 Oct 2026
- Oregon Department of Justice: 20 records, retrieved 18 Oct 2026
Check if you're exposed in a breach with Serus
Find your leaks. Get alerted to new ones.