Data Breaches by Industry: What 7,193 Disclosures Show

This post is a snapshot of September 2025 through August 2026. For the latest rolling 12-month numbers, see our US data breach statistics page, which updates every month.

Here's the number everyone remembers from last year. In a July 2025 update to state regulators, Change Healthcare put its own estimate on the ransomware attack that hit it in February 2024:

As of July 31, 2025, Change Healthcare estimates that approximately 192.7 million individuals have been potentially impacted by this security incident.

That's a big one. It's also nothing like a normal breach.

The median breach in RiversideIQ's data involved 1,582 records. Change Healthcare's estimate is about 120,000 times that. If the breaches you hear about are the only ones you picture, you're picturing the wrong market, and if you sell security services, that's an expensive mistake.

So here's what the other 99.9% look like.

The snapshot

I took every breach event disclosed in the last 12 full months (September 2025 through August 2026) and grouped them by industry, size, and number of people affected. That's 7,193 breach events, built from SEC filings, the HHS breach portal, and state Attorney General notices.

A few ground rules so the numbers mean what they say:

• Industry shares are calculated across the 4,503 events we could confidently assign to a single industry. Organizations we couldn't confidently place in one industry are left out rather than guessed at.
• Records affected comes from the filings themselves. Some filings only report the residents of one state, so treat these figures as floors, not totals.
• Medians, not averages. One Change Healthcare wrecks an average. The median is the breach in the middle, which is the one you're most likely to run into.

Who gets breached

Industry	Breaches	Share	Median records affected
Healthcare	1,633	36.3%	3,597
Financial services	880	19.5%	1,644
Retail	415	9.2%	4,241
Education	255	5.7%	3,148
Insurance	219	4.9%	1,941
Technology	205	4.6%	613
Professional services	204	4.5%	819
Government	180	4.0%	3,051
Manufacturing	175	3.9%	847
Energy & utilities	113	2.5%	607
Nonprofit	112	2.5%	1,069
Legal	65	1.4%	1,100
Hospitality	47	1.0%	320

Healthcare leading the list won't surprise anyone. Before you conclude hospitals are uniquely bad at security, though, look at why it leads.

Healthcare is the most tightly regulated reporter in the country. Any breach of patient data affecting 500 or more people has to go to HHS, which publishes it, and it usually goes to state Attorneys General as well. Plenty of other industries only report where a state law forces them to, and state thresholds vary a lot. So part of healthcare's lead is real risk (patient data is valuable to criminals), and part of it is simply that healthcare has to tell everyone. I can't cleanly separate those two, and I'd be suspicious of anyone who says they can.

Financial services in second place has a similar story. Banks, credit unions, and lenders sit under federal rules plus state regulators like New York's Department of Financial Services, so their breaches surface reliably too.

The typical breach is small

Plenty of breach notices never state how many people were affected. Across the 3,019 that did, the picture is consistent:

• Median: 1,582 records
• 42% involved fewer than 1,000 people
• 75% involved fewer than 10,000

Look at the median column in the table again. In every industry, the middle breach affected somewhere between a few hundred and a few thousand people. That's a customer list, a year of patient files, or one compromised mailbox.

None of those make the news. A breach affecting 800 people at a regional firm gets a notice letter, a filing with the state, and silence. That silence is what makes them interesting if you sell security services.

So are the organizations

Headcount tells the same story. Among breached organizations where we could confirm employee count:

• 48% had fewer than 100 employees
• 86% had fewer than 500

I'll be upfront that headcount is easier to find for some companies than others, so this sample leans toward organizations with a public footprint. If anything that probably understates how small the typical breached organization is, since the tiniest ones are the hardest to look up.

A couple of industries stand out. The median breached insurance organization had 31 employees, and so did the median breached legal organization. That's the size of an independent insurance agency or a small law firm: businesses that hold Social Security numbers, financial records, and privileged documents, often without anyone on staff whose full-time job is IT. (Both are small samples, so treat that as a signal rather than a verdict.)

What this means if you sell security services

Your market is the breached, not the famous. Most of the organizations filing breach notices are exactly the size MSPs serve. They're too small for an in-house security team and too regulated to shrug off a breach.

Small breaches mean less competition. Every security vendor in the country knows when a Fortune 500 company gets hit. Almost nobody is watching the 900-record breach at a 40-person accounting firm. The filing is public either way.

Healthcare is the biggest pool, but it's crowded. If you already sell to clinics and dental groups, the HHS portal alone will keep you busy. If you don't, the less-watched categories (insurance agencies, law firms, professional services) are full of small organizations holding sensitive data, many without an IT department.

Read the median, ignore the headline. When someone pitches you on breach trends using total records exposed, ask what the median was. Totals are driven by a handful of giants. The median is your actual customer.

The short version

The breach that defines the year in the press has 192.7 million victims. The breach that defines the year in the filings has 1,582, at a company you've never heard of, with fewer than 500 employees.

The second one is far more common, gets almost no attention, and is a much better fit for what MSPs sell. That's the one worth tracking, and it's why we built RiversideIQ.