Incidents by year

Each year page below breaks down Breach Census's confirmed incident totals for that year: the largest incidents, the most-affected sectors and attack types, regulator fines, and the top jurisdictions. A year is assigned by disclosure date, falling back to discovery, then occurrence date, so every confirmed incident is counted in exactly one year. Coverage is uneven for the earliest years: many incidents are matched from state attorney general breach-notification registers, whose own digital archives do not extend indefinitely into the past, so early years are likely undercounted relative to more recent ones.