How we count data breaches

Definitions

• A breach is one incident at one organization.
• A notice is one filing with a regulator. One breach can have several notices, one per state or agency.
• People affected come from official notices only: the largest count reported for the breach.
• Accounts leaked come from Have I Been Pwned. People and accounts are different units, so they're never added together.

Counting rules

• One breach is one incident. A filing joins one of the organization's open breaches when:
  • both name breach dates within 60 days of each other, or
  • either has no breach date (HHS notices never do) and they were filed within a year of each other (late filings to another regulator are common), or
  • they report the same number of people (within 2%), whatever dates they name.
  Breach dates before 2005 are treated as unknown (placeholders). A much smaller undated filing with a different cause (under 1% of the largest count) stays separate. Otherwise, separate incidents at the same organization stay separate. The largest reported count is kept.
• A breach counts in the month it was first made public by any source (a regulator notice or Have I Been Pwned). The date the breach happened is shown alongside.
• Repeat organizations are organizations with more than one separate incident (by the same rule) first made public in the last 12 months.
• Health figures come from the edition's own breaches, so they always match the top lists.
• Industry: a known industry from a state notice is used over HHS's default of "healthcare".
• Changes are like for like. Month-over-month and year-over-year changes only use the sources that covered both periods. The year-to-date change compares this year on the same sources as the same months last year.
• The 12-month trend uses all sources. Where a source starts inside the window (Texas: complete from November 2025), each earlier month's tooltip says it's before that source's data, so a jump isn't misread as a rise.
• Shares have a base. Cause and data-type shares are out of the breaches where the cause or the data types are known, and each chart states that number. "Unknown" is not a cause in the chart.
• Time to notify runs from the breach date to the public notice, for breaches where both dates are known: the median, and the 75th percentile.
• Passwords exposed is the share of leaked Have I Been Pwned accounts whose passwords were in the leak.
• Missing data is shown as "n/a", never as zero. A zero is a real zero.
• Every number in an edition's text comes from its statistics, checked by a script before review.

Sources

• Have I Been Pwned: Leaked accounts and the data types in each leak. Licensed under CC BY 4.0, credited wherever its data appears.
• California Attorney General: Breach notices sent to California residents (no resident counts).
• Washington Attorney General: Notices affecting 500 or more Washington residents, with resident counts.
• Texas Attorney General: Notices affecting 250 or more Texans, with resident counts and data types. Texas keeps about a year of notices online, so our Texas data is complete from November 2025.
• Oregon Department of Justice: Breach notices filed in Oregon. Counted as breaches, never for people affected (see Limits).
• U.S. Department of Health and Human Services (OCR breach portal): Health data breaches affecting 500 or more people, with total people affected.
• U.S. Securities and Exchange Commission (EDGAR): Form 8-K Item 1.05 filings: material cybersecurity incidents at public companies.

Industry reports are quoted with attribution, never used as data. Claims on ransomware leak sites are only mentioned as "claimed by attackers".

Limits

• Totals are "at least": many breaches are never reported, and notices lag the breach by weeks or months.
• States only report their own residents, and only some publish resident counts, so the state chart covers those states only.
• HHS lists health breaches of 500 or more people; smaller ones are reported once a year.
• Oregon's "Number Affected" mixes Oregon residents and national totals, so Oregon notices count as breaches but never toward people affected.
• SEC 8-K/A amendments are left out: the search returns too few results when amendments are included. A company's first Item 1.05 filing is counted.
• Late filings change past months. Each change is logged in that edition's revisions, and the page shows when it was updated.

From Serus scans

Some editions add a row "Among people who ran a Serus scan": figures from Serus's own scans, such as how many exposures a first free scan finds, or how often removed listings come back. They're shown as percentages and averages only, never as user counts, and only when at least 1,000 people are behind a figure. They describe people who chose to run a scan, not everyone.

Reuse

You may reuse the charts and figures with credit and a link to the edition (CC BY 4.0). Each edition has its full dataset as a CSV, every breach counted with its source. Have I Been Pwned data is licensed under CC BY 4.0 and needs its own credit.

Revision log

• Version 1.1 (October 2026): One breach is one incident: a filing joins an organization's open breach when their breach dates are within 60 days, when either has no breach date and they were filed within a year of each other, or when they report the same number of people (within 2%), instead of every filing from one organization within 12 months being one breach. Breach dates before 2005 are treated as unknown. A breach counts in the month it was first made public by any source. Health figures come from the edition's own breaches, so they match the top lists. A known industry from a state notice is used over HHS's default of "healthcare". All editions were recomputed, so September 2026's totals changed slightly.
• Version 1.0 (October 2026): First version, used from the September 2026 edition.