Data breaches in June 2026

The biggest breaches

Ranked by people affected, from official notices:

DentaQuest, a healthcare company, says its breach began on May 17 and exposed names, addresses, dates of birth, driver's license numbers and health insurance information. It first became public on June 3, when Have I Been Pwned added 2,553,599 of its accounts; the 15 million figure comes from its notice to HHS. AssuranceAmerica Managing General Agency (finance and insurance) dates its breach to March 16, with Social Security numbers and financial account numbers among the data.

Ranked by leaked accounts, from Have I Been Pwned:

People affected and leaked accounts are counted separately and never added together.

What leaked

Of the 72 breaches where the notice or Have I Been Pwned listed the data involved:

Social Security numbers were in 54 of the 72 breaches and driver's license or ID numbers in 44. Put either next to a date of birth and someone can pass an identity check as you.

177,860 of the leaked accounts (1%) came with passwords.

Sectors and causes

Notices gave a cause for 79 breaches:

Healthcare filed the most breaches and holds most of the people affected, led by DentaQuest, while one or two large notices sit behind the finance and government people counts; hacking or an IT incident was the cause given most often.

Health breaches have their own register: 64 breaches of 500 or more people reached the HHS Office for Civil Rights in June 2026, affecting 20,524,412 people. The largest was DentaQuest (15,000,000 people).

Time to notify

For the 86 breaches where we know both dates, the median time from the start of the breach to the first public notice was 135 days. A quarter took 320 days or more.

For half of these breaches, the data was out for more than four months before the people in it heard a word.

14 organizations reported more than one separate breach in the last 12 months, including 360training.com, DentaQuest, GSPlatformCo.

What it means for you

If you got a breach letter, or you used one of the services above, change that password and any account that shares it, turn on two-step verification, and expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with Equifax, Experian and TransUnion is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.

Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.

If your notice lists both a Social Security number and a driver's license number, freeze your credit and open any mail about accounts you don't recognize.