BreachCensus

Breach Census by the numbers

22,879 confirmed incidents across 6 source registers, recomputed on every request.

Every table on this page is a live query against the same confirmed, non-hidden incidents every other page on this site counts — there is no separate "stats" database, so these figures can never drift from what /year, /sector, /country and the organisation pages themselves show.

Most confirmed incidents come from US state attorney general breach-notification registers, which publish how many residents of that one state were notified, not a national or global total. That is the main reason the records-affected coverage figure below is low: a state register entry can confirm an incident happened without ever giving Breach Census a usable overall affected-count to store.

The disclosure-delay table below reuses the exact definition the disclosure_metric materialized view uses on /sector pages (days from occurred_on to disclosed_on, confirmed incidents only), but combines every sector into one site-wide row per jurisdiction and year, and only shows a row once at least 10 incidents support it.

Confirmed incidents by year

Years are assigned by disclosure date, falling back to discovery, then occurrence date.

YearConfirmed incidents
20262,840
20252,924
20242,640
20232,871
20222,457
20212,816
20202,517
20191,986
2018326
2017411
2016289
2015236
2014214
2013187
2012135

Organisations and incidents by source register

Counts are of confirmed, non-hidden incidents only — a register row that never resolved to a confirmed incident is not counted here.

Source registerOrganisationsConfirmed incidents
US state attorney general notices14,76822,028
HHS OCR breach portal (US)804814
SEC EDGAR filings (US)5859
UK ICO enforcement actions3636
UK FCA fines44
UK PRA actions44

How much is known

Share of the 22,879 confirmed, non-hidden incidents that carry each field.

FieldIncidents with a valueCoverage
Records affected1,5176.6%
Data types5,29923.2%
Attack type2,38910.4%

Median days from occurrence to disclosure

Every sector combined, by jurisdiction and the year the incident occurred — shown only where at least 10 confirmed incidents support the figure.

JurisdictionYear occurredIncidents (n)Median days
US-CA2023445153
US-CA2024373155
US-CA2020363152
US-CA2021363136
US-TX2025288200
US-WA2023280121
US-CA2022275147
US-CA2025251129
US-CA201723768
US-WA2020222200.5
US-CA2019220153
US-WA2024220160.5
US-CA201621793
US-CA2018213131
US-CA201416992
US-CA201515379
US-WA2021153137
US-TX202614379
US-WA2025140137
US-CA201313670.5
US-WA2022121119
US-CA201211456.5
US-CA202611473.5
US-WA201669272
US-WA201962162
US-WA20266080
US-DE202359108
US-WA201754171.5
US-WA201843159
US-DE202439118
US-TX202438439
US-WI20173730
US-DE202035143
US-DE202230100
US-DE202129182
US-CA201125417
US-WA201522230.5
US-WI20161928
US-DE202517131
US-DE20191688.5
US-WI20141553
US-WI20131327
US-WI201813114
US-WI20211152

Regulator fines by year and currency

Totals are not summed across currencies.

YearCurrencyActionsTotal
2026EUR547,026,000 EUR
2026GBP616,213,990 GBP
2025EUR216,054,000 EUR
2025GBP818,732,283 GBP
2024EUR141,065,000 EUR
2024GBP111,887,500 GBP
2023EUR1333,416,000 EUR
2023GBP1224,756,020 GBP
2022EUR84,075,000 EUR
2022GBP256,750,000 GBP
2021EUR71,825,000 EUR
2020EUR62,679,000 EUR
2019EUR3600,000 EUR
2019GBP22,665,100 GBP
2018GBP116,400,000 GBP
2014GBP114,000,000 GBP

Questions and answers

Why is records-affected coverage so low?

Most confirmed incidents come from US state attorney general registers, which publish how many residents of that one state were notified rather than a national or overall total. That confirms the incident happened without giving Breach Census a single affected-count to store, which is why the coverage figure stays well under half.

Are the regulator fine totals converted to one currency?

No. Fines are shown in their original currency and never summed across currencies, because doing so would require an exchange-rate assumption this site does not otherwise make anywhere.

How is the disclosure delay measured?

As the number of days from an incident’s occurred_on date to its disclosed_on date, for confirmed incidents where both dates are known, grouped by jurisdiction and the year it occurred, and only shown once at least 10 incidents support the figure.