Monthly edition · July 2026
Published
Data breaches in July 2026
147 data breaches were reported in July 2026, from 227 notices filed with US regulators plus new entries on Have I Been Pwned. Official notices put the number of people affected at 23.1 million or more, and 89.1 million leaked accounts were added to Have I Been Pwned. Healthcare is behind nearly all of the people count, and Aesto alone reported 9.54 million. Suno is more than half of the leaked accounts.
CTO
Reviewed by Shkumbin Hasani
Principal Engineer
Key takeaways
- 147 breaches in July 2026, down 3% on June 2026 counting the same sources.
- The largest was Aesto: 9.54 million people affected, per its notice to the U.S. Department of Health and Human Services.
- Names leaked in 97% of the 58 breaches whose notices listed the data.
- Half of the breaches reached a regulator 100 days or more after they began.
- 77 health breaches went to HHS, affecting 19.6 million people.
- Breaches
- 147
- −3% vs June 2026+20% vs July 2025
- People affected
- 23,145,270
- −40% vs June 2026−8% vs July 2025
- Official notices
- Accounts leaked
- 89,085,270
- +385% vs June 2026+18,485% vs July 2025
- Have I Been Pwned
| Metric | July 2026 | vs June 2026 | vs July 2025 |
|---|---|---|---|
| Breaches | 147 | −3% | +20% |
| People affected | 23,145,270 | −40% | −8% |
| Accounts leaked | 89,085,270 | +385% | +18,485% |
147 data breaches were reported in July 2026, down 3% from June 2026
Changes use the same sources in both periods. People and accounts are never added together.
What happened in July 2026
We counted 147 breaches in July 2026: 227 official notices to state attorneys general, HHS and the SEC, plus breaches added to Have I Been Pwned. One organization filing in several states counts once. The count is down 3% on June 2026 and up 20% on July 2025, comparing the same sources. So far in 2026 we've counted 997 breaches, with at least 118.9 million people affected.
July's 147 breaches sit in the upper half of the last 12 months, which ranged from 101 to 157 a month. People affected fell 40% on June counting the same sources. Aesto and AdaptHealth were the largest notices. On the accounts side, Suno is more than half of a total that rose 385% on the same basis.
July was 12% above the 12-month average
Breaches
People affected (official notices)
| Month | Breaches | People affected | Accounts leaked |
|---|---|---|---|
| August 2025 | 109 | 8,541,829 | 2,065,798 |
| September 2025 | 115 | 6,097,257 | 9,852,406 |
| October 2025 | 101 | 64,447,513 | 32,527,739 |
| November 2025 | 124 | 4,019,169 | 1,967,402,864 |
| December 2025 | 145 | 28,203,810 | 5,593,947 |
| January 2026 | 129 | 7,872,485 | 131,149,791 |
| February 2026 | 147 | 14,010,403 | 61,381,576 |
| March 2026 | 150 | 16,301,650 | 5,528,583 |
| April 2026 | 116 | 9,892,466 | 41,790,763 |
| May 2026 | 157 | 9,332,239 | 50,334,737 |
| June 2026 | 151 | 38,348,637 | 18,383,353 |
| July 2026 | 147 | 23,145,270 | 89,085,270 |
The biggest breaches
Ranked by people affected, from official notices:
Aesto was the largest breach, with 9.5M people affected
| Organization | People affected | Reported | Breach date | Source |
|---|---|---|---|---|
| Aesto | 9,540,683 | 31 Jul 2026 | 2 Dec 2025 | U.S. Department of Health and Human Services |
| AdaptHealth | 4,115,802 | 2 Jul 2026 | 5 Jun 2026 | U.S. Department of Health and Human Services |
| Unlimited Technology Systems | 3,836,316 | 21 Jul 2026 | 2 Oct 2025 | Texas Attorney General |
| Everside Health | 1,389,758 | 31 Jul 2026 | 2 Dec 2025 | Texas Attorney General |
| Wilmer Cutler Pickering Hale and Dorr | 911,658 | 10 Jul 2026 | 8 May 2026 | Texas Attorney General |
| Quantum Health | 625,945 | 29 Jul 2026 | 26 May 2026 | Texas Attorney General |
| Lifespan Physician Group of Massachusetts | 311,760 | 16 Jul 2026 | n/a | U.S. Department of Health and Human Services |
| Lake Region Healthcare | 167,617 | 3 Jul 2026 | 19 May 2025 | Texas Attorney General |
| Fiesta Insurance Franchise | 160,151 | 13 Jul 2026 | 9 Jun 2025 | Texas Attorney General |
| The Moody Bible Institute of Chicago | 155,226 | 23 Jul 2026 | 12 Jun 2026 | Texas Attorney General |
Aesto, in healthcare, dates its breach to December 2, 2025. Its notice to HHS doesn't say what data was involved. AdaptHealth's breach began on June 5, and its notice lists names, addresses, dates of birth and medical and health insurance information.
Ranked by leaked accounts, from Have I Been Pwned:
Suno exposed the most accounts: 55.3M
| Organization | Accounts exposed | Reported | Breach date | Source |
|---|---|---|---|---|
| Suno | 55,282,226 | 20 Jul 2026 | 25 Nov 2025 | Have I Been Pwned |
| Paidwork | 23,272,765 | 19 Jul 2026 | 29 Mar 2026 | Have I Been Pwned |
| Goose Creek | 6,574,121 | 15 Jul 2026 | 9 Jun 2026 | Have I Been Pwned |
| Moody Bible Institute | 2,303,416 | 3 Jul 2026 | 15 Jun 2026 | Have I Been Pwned |
| Houston City College | 831,642 | 28 Jul 2026 | 16 Jun 2026 | Have I Been Pwned |
| Fluke | 821,100 | 15 Jul 2026 | 1 Jul 2026 | Have I Been Pwned |
People affected and leaked accounts are counted separately and never added together.
What leaked
Of the 58 breaches where the notice or Have I Been Pwned listed the data involved:
Names leaked in 97% of breaches
Share of the 58 breaches where the data types are known
| Data type | Share of breaches | Breaches |
|---|---|---|
| Names | 97% | 56 |
| Physical addresses | 69% | 40 |
| Social Security numbers | 66% | 38 |
| Dates of birth | 48% | 28 |
| Driver's licenses and government IDs | 48% | 28 |
| Medical information | 41% | 24 |
| Health insurance information | 36% | 21 |
| Financial account or card numbers | 34% | 20 |
| Email addresses | 10% | 6 |
| Phone numbers | 8.6% | 5 |
| Genders | 5.2% | 3 |
| Purchases | 3.5% | 2 |
Medical information was in 24 of the 58 breaches. That's the record that turns into treatment billed to your insurance, or a claim you end up disputing.
23.3 million of the leaked accounts (26%) came with passwords, all of them from Paidwork.
Sectors and causes
Healthcare had the most breaches: 82
27 breaches had no sector.
| Sector | Breaches | People affected |
|---|---|---|
| Healthcare | 82 | 21,272,715 |
| Other | 12 | 281,064 |
| Retail | 9 | 81,187 |
| Finance | 8 | 240,117 |
| Professional services | 3 | 1,107,132 |
| Government | 2 | 1,946 |
| Education | 1 | 155,226 |
| Manufacturing | 1 | 1,276 |
| Nonprofit | 1 | 511 |
| Technology | 1 | 4,096 |
Notices gave a cause for 91 breaches:
Hacking or IT incident was the most common cause, behind 79% of breaches
Share of the 91 breaches with a reported cause
- Hacking or IT incident 79%
- Unauthorized access 9.9%
- Ransomware 8.8%
- Theft or loss 2.2%
| Cause | Share of breaches | Breaches |
|---|---|---|
| Hacking or IT incident | 79% | 72 |
| Unauthorized access | 9.9% | 9 |
| Ransomware | 8.8% | 8 |
| Theft or loss | 2.2% | 2 |
Healthcare filed more than half of the breaches and holds nearly all of the people affected; hacking or an IT incident was the cause given most often.
Health breaches have their own register: 77 breaches of 500 or more people reached the HHS Office for Civil Rights in July 2026, affecting 19,554,010 people. The largest was Aesto (9,540,683 people).
Time to notify
For the 84 breaches where we know both dates, the median time from the start of the breach to the first public notice was 100 days. A quarter took 190 days or more.
For half of these breaches, the data had been exposed for over three months by the time the notices went out.
16 organizations reported more than one separate breach in the last 12 months, including 360training.com, DentaQuest, Fluke.
What it means for you
If you got a breach letter or used one of the services above, change that password. Do the same for any account that shares it, and turn on two-step verification. Expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with each of the three bureaus (Equifax, Experian, TransUnion) is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.
Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.
Medical and health insurance details were in several of the biggest notices this month, so read the benefit statements from your health insurer and query any treatment you don't recognize.
More from this edition
- Time to notify
- 100 days
- Median from breach to public notice; 75% within 190 days. 84 breaches with both dates.
- Repeat breaches
- 16
- Organizations with 2 or more breaches in the last 12 months, such as 360training.com and DentaQuest.
- Passwords exposed
- 26%
- Of leaked accounts on Have I Been Pwned (23,272,765 accounts).
- Health breaches
- 77
- Reported to HHS (500+ people each), 19,554,010 people affected. Largest: Aesto (9,540,683).
Looking for a specific breach? Every data breach in 2026 is listed by name, biggest first, on the full list, updated daily.
Questions
How many data breaches were there in July 2026?
We counted 147 breaches from 227 official notices and Have I Been Pwned, affecting at least 23.1 million people.
What was the biggest data breach in July 2026?
Aesto, with 9,540,683 people affected according to its notice to the U.S. Department of Health and Human Services. The largest by leaked accounts was Suno, with 55,282,226 accounts in Have I Been Pwned.
What data leaked most often?
Names: 97% of the 58 breaches with known data types. Physical addresses followed at 69%.
How long do companies take to report a data breach?
In July 2026 the median was 100 days from the start of the breach to the first public notice, across the 84 breaches with both dates.
Can I get my data removed from a breach?
No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.
Author
Argjent SahitiCTO
Leads engineering at Serus, building the systems that find and remove exposure at scale.
Reviewed by
Shkumbin HasaniAbout the data
Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in July 2026 (CSV).
How we count
A breach is one incident at one organization; a notice is one filing with a regulator, and one breach can have several. Notices come from the California, Washington and Texas attorneys general, the Oregon Department of Justice, the HHS Office for Civil Rights and SEC 8-K Item 1.05 filings; leaked accounts come from Have I Been Pwned (CC BY 4.0). A breach counts in the month it was first reported. States only count their own residents and HHS only lists health breaches of 500 or more people, so totals are a floor. Late filings can change these numbers; changes are logged on this page. Full rules: methodology.
This edition was compiled on October 18, 2026 from the official notices available then; late filings can still change it.
Sources (7)
- Have I Been Pwned (CC BY 4.0): 7 records, retrieved 18 Oct 2026
- California Attorney General: 49 records, retrieved 18 Oct 2026
- Washington Attorney General: 20 records, retrieved 18 Oct 2026
- U.S. Department of Health and Human Services (Public domain (U.S. government work)): 77 records, retrieved 18 Oct 2026
- Texas Attorney General: 56 records, retrieved 18 Oct 2026
- U.S. Securities and Exchange Commission (Public domain (U.S. government work)): 7 records, retrieved 18 Oct 2026
- Oregon Department of Justice: 18 records, retrieved 18 Oct 2026
Check if you're exposed in a breach with Serus
Find your leaks. Get alerted to new ones.