Breach statistics · October 2025 – September 2026
US data breach statistics: the last 12 months
Every number on this page comes from the breach disclosures RiversideIQ has collected from SEC filings, the Department of Health and Human Services, and state Attorneys General. It covers October 2025 – September 2026 and updates automatically each month. It isn’t a complete count of every US breach; see the note below.
Breaches tracked*
4,999
About 14 every day
Records exposed*
322M
Across breaches that reported a count
Median breach
2,080
People affected in a typical breach
Mega-breaches*
40
A million or more people each
* These figures cover the breach disclosures in RiversideIQ's database and may not include every US breach disclosed in this period. Not every state requires breach notices to be filed with a regulator or makes them public, so the true number of breaches is higher.
Most-breached industries
Healthcare accounted for 23% of the breaches we tracked, more than any other industry.
- Healthcare1,156
- Financial Services625
- Retail215
- Education168
- Technology165
- Manufacturing149
Most breaches are small
38% of breaches with a reported count affected fewer than 1,000 people. The headlines cover the giants; the typical breach hits a clinic, a credit union, or a regional firm.
- Under 1,00038%
- 1,000 – 9,99935%
- 10,000 – 99,99919%
- 100,000 – 999,9996%
- 1 million or more2%
People affected per breach
How we count
- This page counts the breach disclosures in RiversideIQ’s database, so it may not include every breach disclosed in the US during this period. Not every state requires breach notices to be filed with a regulator or makes them public, which means the true totals are higher than the numbers shown here.
- A breach is counted in the month it was disclosed in a government filing, not the month it happened.
- Each breach is counted once, even when the organization filed with several regulators or amended its notice.
- Records exposed adds up the number of people each organization reported. Someone caught in two breaches is counted twice, so this isn’t a count of unique people.
- Not every filing reports how many people were affected. Breach size figures use the filings that did.
- Totals for the most recent months can rise as late filings are added.
See the organizations behind these numbers
Search every breach by state, industry, and date, with decision-maker contacts. Free trial, no credit card.
Data breach statistics FAQ
How many data breaches happen in the US each year?
RiversideIQ tracked 4,999 data breaches disclosed to the SEC, HHS, and state Attorneys General from October 2025 through September 2026, about 14 every day. That is a floor, not a full count: not every state requires breach notices to be filed with a regulator or makes them public, so the true number is higher.
Which industry has the most data breaches?
Among the breaches RiversideIQ tracked from October 2025 through September 2026, healthcare had the most, with 1,156, or 23% of the total.
How big is a typical data breach?
Among tracked breaches that reported how many people were affected, the median was 2,080 people. 38% affected fewer than 1,000 people, while 40 affected a million or more.
Where do these numbers come from?
Every breach counted here was disclosed in a government filing: SEC filings by public companies, the HHS breach portal for healthcare organizations, and breach notices filed with state Attorneys General. These figures cover the breach disclosures in RiversideIQ's database and may not include every US breach disclosed in this period. Not every state requires breach notices to be filed with a regulator or makes them public, so the true number of breaches is higher.
Related: State breach notification laws · RiversideIQ blog