Data Breaches by Year: 2026 Sets a New Record in Our Catalog

Seventy-nine. That’s how many breaches in our catalog happened in 2026, and it’s the most of any year we track, going back to 2007.

The old record was 78, set in 2020, with 2016 right behind on 77.

And 2026 got past both by September. There are still three months of the year to go.

The 79th went into our catalog on 28 September, a breach from April that only surfaced now. I’d been checking the count most mornings for a week (a backlog of new breaches was still loading, and I wanted to be sure before saying “record”).

Quick context if you’re new here. I run XposedOrNot, a free, open-source service: type in an email address and it tells you which public breaches it turns up in. Behind that sits a catalog of 786 breaches holding 11,626,309,365 records, and every figure below comes from it, pulled on 29 September 2026.

The short version

• 2026 has 79 breaches in our catalog, beating 2020 (78) and 2016 (77). It got there by September, with a quarter of the year still to go.
• It’s a record for breaches, not for records. 2026’s 79 breaches exposed 283,805,951 records, 2.4% of everything we hold. 45 of the 79 are under a million records each.
• What leaks has flipped. Passwords were in 85% of 2016’s breaches and 12% of 2026’s. Phone numbers went from 7% to 73%, home addresses from 10% to 67%.

Two definitions first. A breach is one incident at one organisation where personal data got out and later became searchable. A record is one entry in it. You probably turn up in several breaches yourself, which is why records aren’t people.

And we file each breach under the year it actually happened (its breachedDate), not the year it reached us. That matters later.

How many data breaches happen each year?

Every year in our catalog from 2011 on, counted that way:

Two peaks stand out before this year. 2016 was the forum-and-gaming era, when password databases got dumped by the dozen. 2020 leaned on shops instead (retail was 23 of its 78).

Then the valleys. 2023 had 32, 2025 had 36. So a record right after a quiet year is quite a jump, and it’s worth asking whether it’s real (we’ll get to that, honestly).

One note on scope. These are breaches whose data surfaced somewhere searchable, the subset that can actually land on your email address.

2026 got there by September

What surprised me wasn’t the number itself. It was how fast 2026 got there.

Look at March and April. 2026 added 35 breaches in those two months, more than all of 2023.

By the end of April it had 48. 2020 didn’t get there until July.

So what happened in spring? Half of it, 18 of those 35, is attributed in our catalog entries to one extortion group, ShinyHunters (36 of the year’s 79 name them).

More than half of those (20 of 36) are still the group’s claims, not confirmed disclosures. That’s why I’m not naming the companies.

The pattern matters more than the names anyway. One group, dozens of companies, a few weeks.

If it’s a record year, why does it feel quiet?

Because most of 2026’s breaches are small, and small breaches don’t make the news.

2016’s 77 breaches exposed 1.7 billion records. 2020’s 78 exposed 983 million. 2026’s 79 exposed just 284 million, about a sixth of 2016.

The biggest single 2026 entry is 49,295,990 records. 2016 had one at 592 million.

Line up all 79 by size and the picture gets clearer still.

45 of the 79 sit under a million records. The median 2026 breach exposed 862,530. Nobody writes a headline about a breach that size, but if your details were in it, it’s your breach all the same.

That’s the trap with how breaches get reported: the giants get the coverage, the dozens of mid-sized ones slip past. We covered that gap between the average and the typical breach in how big a data breach really is.

What leaks in a record year now

Now put the three record years side by side, ten years apart.

2016 was about logins. Think forum and gaming-site passwords, the kind that got cracked and then tried everywhere for years. The fix back then was mostly about logins too: a new password and two-factor.

2026 isn’t like that. The typical breach this year is a customer list: your name, your phone number, your home address, the company you deal with. Only 10 of the 79 contained passwords at all.

And you can’t reset any of that. A password takes a minute to change, but your phone number or your home is a different story.

Why does it matter? Because a message that already knows who you are works far better than a generic one. In a peer-reviewed field study at Indiana University, phishing emails that appeared to come from someone the target knew fooled 72% of recipients, against 16% for the same email from a stranger (Jagatic et al., Communications of the ACM, 2007).

A customer list works the same way. The scammer doesn’t need a friend’s name. Your name, your bank or courier, and your number are enough to sound like the real thing.

Does it cost real money? Ask the FTC.

Scams that began with a text took $470 million off people in 2024, going by what they reported, and that’s five times the 2020 figure (FTC, April 2025). Across every kind of fraud, people reported losing $15.9 billion to the FTC in 2025, up from over $12 billion the year before (FTC testimony, March 2026). We walked through why a leaked number hurts more than a leaked email in our phone number post.

So the useful question after a breach alert has changed. It used to be “which password do I change?” Now it’s “what did they get, and who’s going to pretend to be someone I trust?”

Who got breached in 2026?

Finance, mostly, with tech and retail close behind.

Another shift. 2016’s most-hit industry was entertainment (42 of 77, mostly forums and games), and 2020’s was retail.

In 2026 it’s finance, with 14: lenders, fintech apps, payment and business-services platforms.

Finance at the top helps explain why these scams land. A text that says “your bank” is far more convincing when the sender knows you actually bank there. The long-run picture is in the most breached industries.

If you run IT or security for clients in these sectors, look hard at this chart. Every box is a customer list, and some of your users may be on one. That’s what xonThreatIntel+ is built for: it watches every client domain you manage against new breaches and tells you which of their people turned up, so you can warn them before a convincing scam text reaches them.

Is it really a record, or are we just indexing faster?

Fair question. I’d ask it too.

Part of the answer is speed. The median 2026 breach reached our catalog 34 days after it happened. That’s fast, and it means 2026 is being counted while it’s still going, which older years never were.

But the other part cuts the opposite way. Older years keep growing long after they end, because breaches surface late: 18 of 2025’s 36 were only added after 2025 was over.

Our breach disclosure lag analysis put the median gap between a breach and its data surfacing at more than four years.

And one caveat on what’s inside the 79. 31 of them are still listed as alleged, meaning the data surfaced but the company hasn’t confirmed it. We count what’s searchable, because that’s what can reach your inbox.

So 2026’s 79 will almost certainly rise, from the rest of this year and from late discoveries after it. That’s why I waited for the actual crossing instead of calling it “on pace”.

It’s a record, then. Just expect the number to keep climbing for a while.

One more boundary. “Most breaches of any year in the XposedOrNot catalog” is the claim, not “most breaches on earth”. I’d rather you quote that than something bigger.

What to do in a record year

Start with the ten-second one. Check your email on XposedOrNot. No account, no signup.

Then read the data classes, not just the company names. If a breach says phone numbers and physical addresses, a password change won’t touch it.

What changes is your habit. Any text or call that knows your name and your bank gets a callback on the number printed on your card or in the official app (never the one in the message).

After that, get told about the next one. Alert Me on the homepage sends you a notification when your email shows up in a new breach, free. At this rate there’ll be an 80th before long.

If you own a domain, even a family one, domain monitoring is free for your own domain and shows every address on it that’s turned up. And if you’d rather people couldn’t search your email on our site at all, Privacy Shield hides it.

For teams managing many clients, or platforms that want this inside their own product, that’s xonThreatIntel+ and xonAPI+. The data is the same catalog you’ve just been reading about.

The full board: breaches by year

Every year in our catalog, by breach date, as of 29 September 2026. Record years in bold.

Year	Breaches	Records exposed
2007	1	2,137,660
2008	2	1,094,777
2009	2	5,774,460
2010	3	4,995,787
2011	15	125,033,472
2012	14	447,523,341
2013	27	537,958,639
2014	41	78,464,897
2015	57	413,741,564
2016	77	1,697,222,153
2017	36	1,438,684,569
2018	53	898,380,305
2019	70	2,653,994,455
2020	78	983,178,658
2021	59	650,695,698
2022	51	146,448,869
2023	32	111,722,096
2024	53	684,317,248
2025	36	461,134,766
2026 (to date)	79	283,805,951
All years	786	11,626,309,365

2019 holds the records crown (2.65 billion) with 70 breaches. 2026 holds the breach-count crown with a tenth of that.

Every figure here comes from our public API, api.xposedornot.com/v1/breaches, using the breachedDate, exposedRecords, exposedData and industry fields, pulled on 29 September 2026. Anyone can re-run it.

FAQ

How many data breaches happened in 2026?

79, as of 29 September 2026. That’s how many 2026 breaches the XposedOrNot catalog holds, beating 2020’s 78 and 2016’s 77, so it’s the busiest year we’ve seen since our records start in 2007. Expect it to climb, because late breaches keep surfacing for years.

Which year had the most data breaches?

Counting breaches, it’s 2026 with 79, just ahead of 2020 (78) and 2016 (77). Counting records, it’s 2019: only 70 breaches, but 2,653,994,455 records between them.

Are data breaches getting worse every year?

No, and honestly that surprised me too. A busy year is often followed by a quiet one (2016 had 77 and 2017 only 36; 2023 had 32, and 2026 is already on 79). What has changed steadily is what leaks, fewer passwords and far more names, phone numbers and home addresses, which are much harder to change.

Why are there fewer records exposed in 2026 if there are more breaches?

2026’s breaches are mostly mid-sized customer lists: 45 of 79 are under a million records and the median is 862,530. Earlier record years had huge password dumps, including one 2016 entry of 592 million records, so they exposed far more records from a similar number of breaches.

Appendix: Sources and references

• XposedOrNot breach catalog, public API: api.xposedornot.com/v1/breaches, pulled 29 September 2026 (786 breaches, 11,626,309,365 records)
• Jagatic, Johnson, Jakobsson and Menczer, “Social Phishing”, Communications of the ACM 50(10), 2007, doi:10.1145/1290958.1290968: full text (PDF)
• US Federal Trade Commission, “New FTC Data Show Top Text Message Scams of 2024; Overall Losses to Text Scams Hit $470 Million”, April 2025: ftc.gov
• US Federal Trade Commission, testimony before the Joint Economic Committee, March 2026: ftc.gov
• XposedOrNot, H1 2026 Data Breach Report
• XposedOrNot, How big is a data breach?
• XposedOrNot, Phone number leaked? Why it’s worse than a leaked email
• XposedOrNot, 5 things in a data breach worse than a leaked password
• XposedOrNot, Most breached industries
• XposedOrNot, Breach disclosure lag analysis
• XposedOrNot, Data breach statistics 2026

If this was useful, a star on GitHub helps other people find the project. And honestly, it makes our day.

Devanand Premkumar, founder, XposedOrNot