Monthly edition · May 2026

Published

Data breaches in May 2026

157 data breaches were reported in May 2026, from 215 notices filed with US regulators plus new entries on Have I Been Pwned. Official notices put the number of people affected at 9.33 million or more, and 50.3 million leaked accounts were added to Have I Been Pwned. Two entries carry most of it: Lumexa Imaging's notice accounts for 5.83 million of the people affected, and Addi for 34.5 million of the leaked accounts.

By Argjent Sahiti

CTO

Reviewed by Shkumbin Hasani

Principal Engineer

Key takeaways

  • 157 breaches in May 2026, up 35% on April 2026 counting the same sources.
  • The largest was Lumexa Imaging: 5.83 million people affected, per its notice to the U.S. Department of Health and Human Services.
  • Names leaked in 91% of the 80 breaches whose notices listed the data.
  • Half of the breaches reached a regulator 103 days or more after they began.
  • 60 health breaches went to HHS, affecting 7.08 million people.
Breaches
157
+35% vs April 2026+10% vs May 2025
People affected
9,332,239
−6% vs April 2026+40% vs May 2025
Official notices
Accounts leaked
50,334,737
+20% vs April 2026+229% vs May 2025
Have I Been Pwned
May 2026 in numbers
MetricMay 2026vs April 2026vs May 2025
Breaches 157+35%+10%
People affected 9,332,239−6%+40%
Accounts leaked 50,334,737+20%+229%

157 data breaches were reported in May 2026, up 35% from April 2026

Changes use the same sources in both periods. People and accounts are never added together.

Source: Official breach notices and Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download This month in numbers
Embed this chart

What happened in May 2026

We counted 157 breaches in May 2026: 215 official notices to state attorneys general, HHS and the SEC, plus breaches added to Have I Been Pwned. One organization filing in several states counts once. The count is up 35% on April 2026 and up 10% on May 2025, comparing the same sources. So far in 2026 we've counted 699 breaches, with at least 57.4 million people affected.

May's 157 breaches are the most in the last 12 months, which ranged from 101 to 157 a month. People affected fell 6% on April counting the same sources, even though Lumexa Imaging alone is more than half of this month's total.

May had the most breaches in 12 months

Breaches

People affected (official notices)

Breaches, people affected and accounts leaked per month
MonthBreachesPeople affectedAccounts leaked
June 2025 12030,681,4992,311,398
July 2025 10730,185,837479,329
August 2025 1098,541,8292,065,798
September 2025 1156,097,2579,852,406
October 2025 10164,447,51332,527,739
November 2025 1244,019,1691,967,402,864
December 2025 14528,203,8105,593,947
January 2026 1297,872,485131,149,791
February 2026 14714,010,40361,381,576
March 2026 15016,301,6505,528,583
April 2026 1169,892,46641,790,763
May 2026 1579,332,23950,334,737
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download The last 12 months
Embed this chart

The biggest breaches

Ranked by people affected, from official notices:

Lumexa Imaging was the largest breach, with 5.8M people affected

Largest breaches by people affected
OrganizationPeople affectedReportedBreach dateSource
Lumexa Imaging 5,830,94915 May 202631 Mar 2026U.S. Department of Health and Human Services
IMA Diligence Services 525,30629 May 20268 Dec 2025Texas Attorney General
Networking Technology 353,84429 May 20261 Mar 2026U.S. Department of Health and Human Services
Educational Employees Credit Union 201,18529 May 202615 Dec 2025Texas Attorney General
Frost Bank 200,27120 May 20266 Dec 2025Texas Attorney General
Eyemart Express 189,45012 May 202612 Feb 2026Texas Attorney General
The Beacon Mutual Insurance 162,43918 May 20267 Jan 2026Texas Attorney General
Cardinal Services 142,32320 May 202625 Jun 2025Texas Attorney General
American Lending Center 123,15811 May 202624 Jul 2025Texas Attorney General
Western Orthopaedics 113,3301 May 202617 Sept 2025U.S. Department of Health and Human Services
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download Largest breaches by people affected
Embed this chart

Lumexa Imaging, a healthcare company, says its breach started on March 31 and included names and Social Security numbers. Medical and health insurance details were in it too. IMA Diligence Services, a ransomware case, dates its breach to December 8, 2025. Its notice lists Social Security numbers and driver's licenses, along with financial account numbers. On the accounts side, Addi's leak lists credit scores and income levels.

Ranked by leaked accounts, from Have I Been Pwned:

Addi exposed the most accounts: 34.5M

Largest leaks by accounts exposed
OrganizationAccounts exposedReportedBreach dateSource
Addi 34,532,94118 May 202625 Mar 2026Have I Been Pwned
ZenBusiness 5,118,1842 May 202627 Mar 2026Have I Been Pwned
Charter 4,851,51728 May 202623 May 2026Have I Been Pwned
Marcus & Millichap 1,837,0783 May 20267 Apr 2026Have I Been Pwned
Abrigo 711,09914 May 202614 Apr 2026Have I Been Pwned
Ameriprise 502,59726 May 20262 Mar 2026Have I Been Pwned
CTT 468,12419 May 202626 Apr 2026Have I Been Pwned
Woflow 447,5937 May 20264 Mar 2026Have I Been Pwned
Cushman & Wakefield 310,43112 May 202621 Apr 2026Have I Been Pwned
Kemper 269,29928 May 202615 Apr 2026Have I Been Pwned
Source: Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download Largest leaks by accounts exposed
Embed this chart

People affected and leaked accounts are counted separately and never added together.

What leaked

Of the 80 breaches where the notice or Have I Been Pwned listed the data involved:

Names leaked in 91% of breaches

Share of the 80 breaches where the data types are known

What data leaked
Data typeShare of breachesBreaches
Names 91%73
Social Security numbers 69%55
Driver's licenses and government IDs 49%39
Physical addresses 49%39
Financial account or card numbers 43%34
Dates of birth 40%32
Medical information 38%30
Health insurance information 36%29
Email addresses 26%21
Phone numbers 18%14
Job titles 7.5%6
Purchases 6.3%5
Source: Official breach notices and Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download What data leaked
Embed this chart

Names alone do little harm. Social Security numbers, in 55 of the 80 breaches, are different: they let someone open credit or file a tax return in your name.

Only 246,468 of the leaked accounts came with passwords.

Sectors and causes

Healthcare had the most breaches: 64

34 breaches had no sector.

Breaches by sector
SectorBreachesPeople affected
Healthcare 647,105,711
Finance 14938,892
Other 13231,805
Retail 13170,362
Education 8131,213
Government 420,105
Professional services 3668,314
Hospitality 144,023
Manufacturing 118,517
Nonprofit 11,937
Technology 11,360
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download Breaches by sector
Embed this chart

Notices gave a cause for 82 breaches:

Hacking or IT incident was the most common cause, behind 73% of breaches

Share of the 82 breaches with a reported cause

  1. Hacking or IT incident 73%
  2. Unauthorized access 15%
  3. Ransomware 12%
What caused the breaches
CauseShare of breachesBreaches
Hacking or IT incident 73%60
Unauthorized access 15%12
Ransomware 12%10
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download What caused the breaches
Embed this chart

Healthcare filed the most breaches and holds most of the people affected, largely through Lumexa Imaging, and hacking or an IT incident was the cause given most often.

Health breaches have their own register: 60 breaches of 500 or more people reached the HHS Office for Civil Rights in May 2026, affecting 7,079,464 people. The largest was Lumexa Imaging (5,830,949 people).

Time to notify

For the 96 breaches where we know both dates, the median time from the start of the breach to the first public notice was 103 days. A quarter took 205 days or more.

In half of these breaches, the people in them heard about it more than three months after it began.

15 organizations reported more than one separate breach in the last 12 months, including 360training.com, AltaMed Health Services, Decisely Insurance Services.

What it means for you

If you got a breach letter or used one of the services above, change that password. Do the same for any account that shares it, and turn on two-step verification. Expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with each of the three bureaus (Equifax, Experian, TransUnion) is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.

Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.

Health insurance details leaked in both of the biggest notices, so check your insurer's statements for treatment you never had.

More from this edition

Time to notify
103 days
Median from breach to public notice; 75% within 205 days. 96 breaches with both dates.
Repeat breaches
15
Organizations with 2 or more breaches in the last 12 months, such as 360training.com and AltaMed Health Services.
Passwords exposed
0.5%
Of leaked accounts on Have I Been Pwned (246,468 accounts).
Health breaches
60
Reported to HHS (500+ people each), 7,079,464 people affected. Largest: Lumexa Imaging (5,830,949).

Looking for a specific breach? Every data breach in 2026 is listed by name, biggest first, on the full list, updated daily.

Questions

How many data breaches were there in May 2026?

We counted 157 breaches from 215 official notices and Have I Been Pwned, affecting at least 9.33 million people.

What was the biggest data breach in May 2026?

Lumexa Imaging, with 5,830,949 people affected according to its notice to the U.S. Department of Health and Human Services. The largest by leaked accounts was Addi, with 34,532,941 accounts in Have I Been Pwned.

What data leaked most often?

Names: 91% of the 80 breaches with known data types. Social Security numbers followed at 69%.

How long do companies take to report a data breach?

In May 2026 the median was 103 days from the start of the breach to the first public notice, across the 96 breaches with both dates.

Can I get my data removed from a breach?

No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.

Author

Argjent Sahiti

CTO

Leads engineering at Serus, building the systems that find and remove exposure at scale.

Reviewed by

Shkumbin Hasani

About the data

Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in May 2026 (CSV).

How we count

A breach is one incident at one organization; a notice is one filing with a regulator, and one breach can have several. Notices come from the California, Washington and Texas attorneys general, the Oregon Department of Justice, the HHS Office for Civil Rights and SEC 8-K Item 1.05 filings; leaked accounts come from Have I Been Pwned (CC BY 4.0). A breach counts in the month it was first reported. States only count their own residents and HHS only lists health breaches of 500 or more people, so totals are a floor. Late filings can change these numbers; changes are logged on this page. Full rules: methodology.

This edition was compiled on October 18, 2026 from the official notices available then; late filings can still change it.

The full methodology (version 1.1)

Sources (7)
Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.