Breach research, Product updates

How Big Is a Data Breach?

September 23, 2026

Ask how big a data breach is and the two honest answers are thirteen times apart.

The average breach in our catalog exposed 14.8 million records. The median one exposed 1.13 million. Both numbers come from the same 783 breaches, and they’re telling you about two different worlds.

Quick context if this is your first time here. I run XposedOrNot, a free, open-source service that does one thing: you type in an email address and it tells you which public breaches it appears in. The engine is a catalog of 783 breaches, and for every one of them we keep three things: how many records, when it happened, and what kinds of data got out.

All of it is queryable through an API, no key needed. I pulled every figure below on 23 September 2026 (feel free to check me).

The short version

1,138,821 records for the median breach against 14,842,270 for the mean. Mind that gap; it’s the whole post.
Just under half the breaches we index (374 of 783) are under a million records. Together they hold 1.1% of all the records.
The 20 biggest entries hold 58% of 11.6 billion records. The top 14 alone hold half.
Size doesn’t predict what leaked. Passwords turn up in 58% to 68% of breaches whichever size band you pick.

Two definitions before the tables, because both get abused. A record is one exposed entry in one breach, and the same person appears in many breaches, so 11.6 billion records is nowhere near 11.6 billion people. Records, not people.

And the median? Line all 783 up by size and it’s the one in the middle, no more than that. The mean is the total divided by 783, which sounds fairer until you notice a handful of giants dragging it around.

Two honest answers, thirteen times apart

Here’s what the mean hides. Only 105 of the 783 breaches are at or above 14.8 million records. The other 678 are below the “average”.

The breach sitting exactly on the median is a 2021 retailer’s customer list: 1,138,821 records, names, email addresses, phone numbers, rough locations. No passwords. It never made a headline I can find, and in our experience that’s what the middle of the catalog looks like.

So when someone quotes an average breach size, ask which one. The mean describes where the records are. The median describes the breach that’s likely to have your address in it.

Both are true. Neither is the whole picture, and the next table is why.

Where the 11.6 billion actually sit

Split the catalog into size bands and the inversion jumps out. Nearly half the breaches are small, and they hold almost nothing. Twenty-four are huge, and they hold most of everything.

Records exposed	Breaches	Share of breaches	Records held	Share of records
Under 10,000	7	0.9%	29,459	0.0%
10,000 to 100,000	83	10.6%	4,482,115	0.0%
100,000 to 1 million	284	36.3%	126,119,312	1.1%
1 million to 10 million	278	35.5%	980,168,039	8.4%
10 million to 100 million	107	13.7%	3,278,640,937	28.2%
100 million to 1 billion	23	2.9%	6,117,754,015	52.6%
1 billion and over	1	0.1%	1,114,303,554	9.6%

Paired bar chart of the XposedOrNot catalog by breach size band: share of breaches per band against share of records per band, showing that bands under one million hold 47% of breaches and 1.1% of records while the 24 entries at 100 million or more hold 3% of breaches and 62% of records — Figure 1: Same 783 breaches, two ways of counting. The bars cross around the 10-million mark.

Read the middle two rows. 562 breaches, 71% of the catalog, land between 100,000 and 10 million records. That’s the working range of a data breach, and it’s where you’ll find most of the entries with your name on them.

Now read the bottom two. Twenty-four entries at 100 million or more carry 62% of every record we hold. So who are they?

The top 20 hold 58%

Line the catalog up biggest first and the concentration is steep.

Biggest entries	Share of all 11.6 billion records
Top 1	9.6%
Top 5	32.0%
Top 10	43.4%
Top 20	58.2%
Top 50	76.7%
Top 100	87.1%

Staircase chart of cumulative share of records held by the biggest entries in the XposedOrNot catalog: 9.6% for the top one, 32% for the top five, 43% for the top ten, 58% for the top twenty, 77% for the top fifty and 87% for the top hundred — Figure 2: Half of all the records we index sit in the top 14 entries. The bottom 391 hold 1.28%.

Fourteen entries. That’s how many it takes to reach half of everything. The smaller half of the catalog, 391 breaches, adds up to 1.28%.

And what are those twenty? Sixteen carry our breach label. Three are combolists, and one is a stealer-log collection.

Read the board’s last column, though. A few of those sixteen are scrapes, a disputed claim and one leaked breach-index, so the compilation share is a floor.

That matters, because a combolist isn’t a breach of anyone. It’s a pile of older breaches stitched together and re-sold, and we’ve written before about why the three kinds of leak carry different risks. The two biggest entries in our whole catalog, 1.11 billion and 790 million records, are both compilations.

Strip out everything we don’t label a breach (five combolists, the stealer-log set and one scraped profile set) and the median barely twitches: 1,114,599 records across the 776 that remain. The mean drops to 11.1 million. The middle of the catalog doesn’t care what’s at the top.

One more thing, since people will ask. This isn’t a list of the world’s biggest breaches by reported headcount.

Our record count is the number of unique email addresses we actually hold for each entry, and our list of the 100 largest breaches by reported figures looks quite different. The full top 20 is in the board near the end.

Is the typical breach getting bigger?

No. The giants cluster in one window, and every year dated 2023 or later has a median under a million.

Breach dated	Breaches	Median records	Mean records	Under 1 million	Largest
2007 to 2015	162	831,023	9,979,781	85	232,857,074
2016 to 2019	236	1,920,554	28,340,175	97	1,114,303,554
2020 to 2022	188	1,412,456	9,469,804	75	268,113,400
2023 to 2025	121	583,267	10,389,868	74	299,646,818
2026 so far	76	869,836	3,670,973	43	49,295,990

Bar chart of the median breach size in the XposedOrNot catalog by period: 831 thousand for 2007 to 2015, 1.92 million for 2016 to 2019, 1.41 million for 2020 to 2022, 583 thousand for 2023 to 2025 and 870 thousand for 2026 so far, with the number of breaches under each bar — Figure 3: The median peaked with the 2016 to 2019 breaches. Every period since sits lower, and every single year since 2023 is under a million.

2016 through 2019 is where the giants live. Median 1.9 million, and every entry above half a billion records is dated inside that window.

Of the 76 breaches dated this year, 43 are under a million records, 8 are over ten million, and the largest is 49 million. Not one has crossed 100 million.

I’d hold that last line loosely. Big breaches surface late, sometimes years late (we measured the lag at more than four years for the typical entry), so 2026’s largest may not have reached our catalog yet.

Still, two things survive that caveat, and one table carries both: not one year since 2022 has a median anywhere near a million, and 2026 isn’t finished yet.

Breach year	Breaches	Median records
2016 to 2019, the whole window	236	1,920,554
2022	51	1,117,409
2023	32	230,056
2024	53	701,054
2025	36	669,225
2026, to 23 September	76	869,836

Smaller breaches, or slower ones to surface? I’ll know in a couple of years.

Does a small breach leak less?

You’d hope so. It doesn’t.

Breach size	Breaches	Exposed passwords	Exposed phone numbers	Exposed dates of birth
10,000 to 100,000	83	66%	34%	26%
100,000 to 1 million	284	68%	35%	24%
1 million to 10 million	278	63%	39%	25%
10 million to 100 million	107	66%	30%	25%
100 million and over	24	58%	20%	20%

(The seven entries under 10,000 records are left out; too few to turn into a percentage.)

Passwords show up in roughly two thirds of breaches in every band but the top one, where it’s 58%. Dates of birth in a quarter. The giants actually leak slightly less per breach, because several of them are email-and-password compilations and scraped profile sets rather than full customer databases.

So the record count on a breach notice tells you how many people share your problem. It tells you nothing about how bad your problem is. For that you need the list of what leaked, and some of those things are worse than a password.

What to do with this

If you’re reading this because a breach notice landed: ignore the headline number. Run your email through XposedOrNot and read the data classes on each result, not the record count. A 200,000-record breach carrying your date of birth and home address is a bigger day than a 700-million-record combolist carrying a password you retired in 2016.

Run a domain? Then the median is your number.

A 1.1-million-record breach doesn’t make the national news. In our experience most breaches at that size get one trade-press story, if that, and the people in them find out from a phishing email months later.

That’s the case for watching your own domain rather than the headlines. Domain monitoring on our side is free: verify you own the domain and you’ll hear when any address on it turns up, at whatever size the breach happens to be.

The full board: the 20 biggest entries in our catalog

Ranked by the records we hold. The catalog entry name is ours; “what it is” is our label too, and four of the twenty carry our unverified flag, meaning we hold the data but couldn’t independently confirm where it came from or that it’s what it claims to be.

Rank	Catalog entry	Records we hold	Breach dated	What it is
1	1.4BillionRecords	1,114,303,554	March 2017	Combolist
2	Collection-1	790,803,860	January 2019	Combolist
3	Verifications	762,579,945	February 2019	Breach (email verification service)
4	ExploitIN	592,919,058	October 2016	Breach (forum), unverified
5	AntiPublicCombo	457,399,902	December 2016	Combolist, unverified
6	AlienStealerLogs	299,646,818	February 2025	Stealer-log collection
7	Alleged-SOCRadar	282,977,267	August 2024	Claimed leak, disputed by the company
8	Wattpad	268,113,400	June 2020	Breach
9	Deezer	244,007,616	April 2019	Breach (via a third party)
10	NetEase	232,857,074	October 2015	Breach, unverified
11	Cit0day	226,803,683	November 2020	Leaked breach-index (data from other breaches), unverified
12	Twitter-Scraped	208,918,735	January 2021	Scraped profiles with emails
13	PeopleDataLabs	179,117,119	January 2019	Exposed database, attributed to a data broker
14	Zynga	172,817,913	September 2019	Breach
15	AdultFriendFinder	169,745,941	October 2016	Breach
16	Dubsmash	161,835,382	December 2018	Breach
17	LinkedIn	160,042,644	May 2012	Breach
18	Adobe	152,403,035	October 2013	Breach
19	MyFitnessPal	143,570,814	February 2018	Breach
20	Canva	137,504,762	May 2019	Breach

Twenty entries, 6,758,368,522 records between them. Everything else in the catalog, 763 breaches, shares the remaining 4.86 billion.

The caveats

Our catalog is public breaches we’ve indexed and loaded, not every breach that happened. Quiet ones, and ones nobody dumped, aren’t counted, and those skew small.
“Records” here means the unique email addresses we extracted from each entry. That can run above or below the figure the company or the press reported, so don’t expect our top 20 to match a list built from disclosures.
Compilations inflate the top. Five combolists hold 21.9% of all records in the catalog, and one stealer-log collection holds another 2.6%. The median ignores them; the mean doesn’t.
749 of the 783 entries carry our verified flag. Four of the top 20 don’t, and one is a claim the named company disputes. They’re in the board because they’re in the catalog, labelled as such.
Breach dates are recorded to the month, and recent years fill in late as breaches surface. The 2026 row will grow.
Records, not people. Nothing here is a headcount.

FAQ

How big is the average data breach?

Two answers, and they’re thirteen times apart. Take the 783 public breaches in the XposedOrNot catalog as of September 2026: the mean works out at 14.8 million records, the median at 1.13 million, and the gap exists because 24 giant entries hold 62% of every record. If you want to know what the breach with your email in it probably looks like, use the median.

What is the biggest data breach in the XposedOrNot catalog?

Our largest entry is 1,114,303,554 records, and it isn’t one company’s breach at all, it’s a compilation of older leaks that first surfaced in 2017. Among breaches of a single named service, verifications.io in 2019 tops the catalog with 762,579,945 records. Bear in mind we count the unique email addresses we actually hold, which is why our figures won’t match the numbers reported at the time.

How many records does a typical data breach expose?

Roughly a million. Line the catalog up as of September 2026 and the middle breach holds 1,138,821 records, with 374 of the 783 under a million and 562 landing somewhere between 100,000 and 10 million. Above 10 million is the rare one, 131 breaches, so about one in six.

Check it yourself

The endpoint is public: api.xposedornot.com/v1/breaches. Four fields did all the work here (exposedRecords, breachedDate, breachType, exposedData), pulled on 23 September 2026, and since the catalog grows most weeks your own run will land a little higher than mine.

Want to know which size of breach you’re actually in? Ten seconds at xposedornot.com, free, no signup.

And if this was useful, a star on GitHub helps other people find the project. Honestly, it makes our day.