Monthly edition · April 2026

Published

Data breaches in April 2026

116 data breaches were reported in April 2026, from 175 notices filed with US regulators plus new entries on Have I Been Pwned. Official notices put the number of people affected at 9.89 million or more, and 41.8 million leaked accounts were added to Have I Been Pwned. One notice dominates: Carnival reported 5,995,277 people affected, more than half of the month's total, and the same breach is in Have I Been Pwned with 7,531,359 accounts.

By Argjent Sahiti

CTO

Reviewed by Shkumbin Hasani

Principal Engineer

Key takeaways

  • 116 breaches in April 2026, down 23% on March 2026 counting the same sources.
  • The largest was Carnival: 6 million people affected, per its notice to the Texas Attorney General.
  • Names leaked in 86% of the 50 breaches whose notices listed the data.
  • Half of the breaches reached a regulator 102 days or more after they began.
  • 48 health breaches went to HHS, affecting 1.38 million people.
Breaches
116
−23% vs March 2026−23% vs April 2025
People affected
9,892,466
−39% vs March 2026−89% vs April 2025
Official notices
Accounts leaked
41,790,763
+656% vs March 2026+1,175% vs April 2025
Have I Been Pwned
April 2026 in numbers
MetricApril 2026vs March 2026vs April 2025
Breaches 116−23%−23%
People affected 9,892,466−39%−89%
Accounts leaked 41,790,763+656%+1,175%

116 data breaches were reported in April 2026, down 23% from March 2026

Changes use the same sources in both periods. People and accounts are never added together.

Source: Official breach notices and Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download This month in numbers
Embed this chart

What happened in April 2026

We counted 116 breaches in April 2026: 175 official notices to state attorneys general, HHS and the SEC, plus breaches added to Have I Been Pwned. One organization filing in several states counts once. The count is down 23% on March 2026 and down 23% on April 2025, comparing the same sources. So far in 2026 we've counted 542 breaches, with at least 48.1 million people affected.

April's 116 breaches sit in the lower half of the last 12 months, which ranged from 101 to 150 a month. People affected fell 39% on March counting the same sources, while leaked accounts rose 656% on the same basis, mostly from McGraw Hill (13.5 million) and Pitney Bowes (8.24 million).

April was 6% below the 12-month average

Breaches

People affected (official notices)

Breaches, people affected and accounts leaked per month
MonthBreachesPeople affectedAccounts leaked
May 2025 1155,261,88315,310,147
June 2025 12030,681,4992,311,398
July 2025 10730,185,837479,329
August 2025 1098,541,8292,065,798
September 2025 1156,097,2579,852,406
October 2025 10164,447,51332,527,739
November 2025 1244,019,1691,967,402,864
December 2025 14528,203,8105,593,947
January 2026 1297,872,485131,149,791
February 2026 14714,010,40361,381,576
March 2026 15016,301,6505,528,583
April 2026 1169,892,46641,790,763
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download The last 12 months
Embed this chart

The biggest breaches

Ranked by people affected, from official notices:

Carnival was the largest breach, with 6M people affected

Largest breaches by people affected
OrganizationPeople affectedReportedBreach dateSource
Carnival 5,995,27724 Apr 202610 Apr 2026Texas Attorney General
Texas Tech University Health Sciences Center 813,8929 Apr 202617 Sept 2024Texas Attorney General
ADT 331,53627 Apr 202620 Apr 2026Texas Attorney General
Pediatric Products 305,18714 Apr 202627 Jan 2026Texas Attorney General
Florida Physician Specialists 276,49824 Apr 2026n/aU.S. Department of Health and Human Services
Heritage Bank 185,28823 Apr 20265 Feb 2026Texas Attorney General
Southern Illinois Dermatology 160,3122 Apr 2026n/aU.S. Department of Health and Human Services
City of Suffolk, Virginia 157,72522 Apr 202624 Feb 2026Texas Attorney General
Laurel Eye Clinic 145,22122 Apr 2026n/aU.S. Department of Health and Human Services
Innovative Scientific Solutions 143,84217 Apr 202630 Aug 2025U.S. Department of Health and Human Services
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download Largest breaches by people affected
Embed this chart

Carnival says its breach began on April 10 and exposed names, addresses, dates of birth, email addresses and loyalty program details. Texas Tech University Health Sciences Center reported a breach dating back to September 17, 2024, with Social Security numbers, medical and health insurance information and financial account numbers in it.

Ranked by leaked accounts, from Have I Been Pwned:

McGraw Hill exposed the most accounts: 13.5M

Largest leaks by accounts exposed
OrganizationAccounts exposedReportedBreach dateSource
McGraw Hill 13,500,13616 Apr 202610 Apr 2026Have I Been Pwned
Pitney Bowes 8,243,98927 Apr 202620 Apr 2026Have I Been Pwned
Carnival 7,531,35924 Apr 202610 Apr 2026Have I Been Pwned
ADT 5,488,88827 Apr 202620 Apr 2026Have I Been Pwned
Amtrak 2,147,67917 Apr 20263 Apr 2026Have I Been Pwned
Hallmark 1,736,52012 Apr 202631 Mar 2026Have I Been Pwned
Udemy 1,401,25926 Apr 202624 Apr 2026Have I Been Pwned
Crunchyroll 1,195,6844 Apr 202612 Mar 2026Have I Been Pwned
SongTrivia2 291,7394 Apr 20262 Apr 2026Have I Been Pwned
SUCCESS 253,5101 Apr 20264 Mar 2026Have I Been Pwned
Source: Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download Largest leaks by accounts exposed
Embed this chart

People affected and leaked accounts are counted separately and never added together.

What leaked

Of the 50 breaches where the notice or Have I Been Pwned listed the data involved:

Names leaked in 86% of breaches

Share of the 50 breaches where the data types are known

What data leaked
Data typeShare of breachesBreaches
Names 86%43
Social Security numbers 68%34
Physical addresses 62%31
Financial account or card numbers 48%24
Driver's licenses and government IDs 44%22
Medical information 44%22
Dates of birth 38%19
Health insurance information 34%17
Email addresses 20%10
Phone numbers 12%6
Job titles 4%2
Passwords 4%2
Source: Official breach notices and Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download What data leaked
Embed this chart

Social Security numbers, in 34 of the 50 breaches, are the one to worry about: with a name and an address they're enough to open credit in your name. A leaked medical record can end up as treatment billed to your insurance.

545,249 of the leaked accounts (1%) came with passwords.

Sectors and causes

Healthcare had the most breaches: 56

21 breaches had no sector.

Breaches by sector
SectorBreachesPeople affected
Healthcare 567,690,349
Retail 13213,993
Finance 11245,866
Other 8714,005
Education 3829,928
Technology 240,455
Government 1157,725
Nonprofit 1145
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download Breaches by sector
Embed this chart

Notices gave a cause for 65 breaches:

Hacking or IT incident was the most common cause, behind 66% of breaches

Share of the 65 breaches with a reported cause

  1. Hacking or IT incident 66%
  2. Unauthorized access 25%
  3. Ransomware 7.7%
  4. Theft or loss 1.5%
What caused the breaches
CauseShare of breachesBreaches
Hacking or IT incident 66%43
Unauthorized access 25%16
Ransomware 7.7%5
Theft or loss 1.5%1
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download What caused the breaches
Embed this chart

Healthcare leads on breaches and on people affected, but most of that people count is Carnival, which our data files under healthcare; hacking or an IT incident was the most common cause given.

Health breaches have their own register: 48 breaches of 500 or more people reached the HHS Office for Civil Rights in April 2026, affecting 1,384,347 people. The largest was Florida Physician Specialists (276,498 people).

Time to notify

For the 73 breaches where we know both dates, the median time from the start of the breach to the first public notice was 102 days. A quarter took 217 days or more.

For half of these breaches, that's more than three months in which the data was out and the people in it didn't know.

16 organizations reported more than one separate breach in the last 12 months, including 360training.com, Alera, AltaMed Health Services.

What it means for you

If you got a breach letter, or you used one of the services above, change that password and any account that shares it, turn on two-step verification, and expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with Equifax, Experian and TransUnion is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.

Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.

If a notice lists your Social Security number, a credit freeze is the most useful single step: it's free and stops new accounts being opened in your name.

More from this edition

Time to notify
102 days
Median from breach to public notice; 75% within 217 days. 73 breaches with both dates.
Repeat breaches
16
Organizations with 2 or more breaches in the last 12 months, such as 360training.com and Alera.
Passwords exposed
1.3%
Of leaked accounts on Have I Been Pwned (545,249 accounts).
Health breaches
48
Reported to HHS (500+ people each), 1,384,347 people affected. Largest: Florida Physician Specialists (276,498).

Looking for a specific breach? Every data breach in 2026 is listed by name, biggest first, on the full list, updated daily.

Questions

How many data breaches were there in April 2026?

We counted 116 breaches from 175 official notices and Have I Been Pwned, affecting at least 9.89 million people.

What was the biggest data breach in April 2026?

Carnival, with 5,995,277 people affected according to its notice to the Texas Attorney General. The largest by leaked accounts was McGraw Hill, with 13,500,136 accounts in Have I Been Pwned.

What data leaked most often?

Names: 86% of the 50 breaches with known data types. Social Security numbers followed at 68%.

How long do companies take to report a data breach?

In April 2026 the median was 102 days from the start of the breach to the first public notice, across the 73 breaches with both dates.

Can I get my data removed from a breach?

No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.

Author

Argjent Sahiti

CTO

Leads engineering at Serus, building the systems that find and remove exposure at scale.

Reviewed by

Shkumbin Hasani

About the data

Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in April 2026 (CSV).

How we count

A breach is one incident at one organization; a notice is one filing with a regulator, and one breach can have several. Notices come from the California, Washington and Texas attorneys general, the Oregon Department of Justice, the HHS Office for Civil Rights and SEC 8-K Item 1.05 filings; leaked accounts come from Have I Been Pwned (CC BY 4.0). A breach counts in the month it was first reported. States only count their own residents and HHS only lists health breaches of 500 or more people, so totals are a floor. Late filings can change these numbers; changes are logged on this page. Full rules: methodology.

This edition was compiled on October 18, 2026 from the official notices available then; late filings can still change it.

The full methodology (version 1.1)

Sources (7)
Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.