BreachCensus

2025 — Year in review

Years are assigned by disclosure date, falling back to discovery, then occurrence date.

2,927Confirmed incidents
2,353Organizations affected
55Regulator actions opened

Breach Census recorded 2,927 confirmed incidents in 2025. That is up from 2,640 in 2024, a rise of 287 incidents (10.9%). Incidents are assigned to a year by disclosure date, falling back to discovery, then occurrence date, and totals for the most recent years can still grow as new sources are confirmed and published.

The largest confirmed incident by records affected was at Change Healthcare Inc., which affected 192,700,000 records. Healthcare was the most common sector, with 480 of the 540 incidents that had a sector assigned. The most common attack type among incidents with one recorded was Hacking/IT Incident, in 348 incidents.

Regulators issued fines totaling 18,732,283 GBP across 8 actions and 6,054,000 EUR across 21 actions in 2025. The most-reported jurisdictions were US-MA (1,782), US-CA (376), and US-WA (207).

Regulator fines by currency

Totals are not summed across currencies.

CurrencyActionsTotal
GBP818,732,283 GBP
EUR216,054,000 EUR

By sector

SectorConfirmed incidents
Unclassified2,387
Healthcare480
Finance12
Technology12
Professional Services10
Retail7
Manufacturing5
Insurance4
Pharma4
Hospitality2
Media2
Real Estate1
Telecoms1

Top jurisdictions

JurisdictionConfirmed incidents
US-MA1,782
US-CA376
US-WA207
US-TX186
US-IA45
US-DE33
US-FL32
US-NY23
US-PA18
US-OH14
US14
US-MN12
US-IL11
US-MD11
US-WI11

Largest incidents by records affected

OrganizationDisclosedJurisdictionRecords affected
Change Healthcare Inc.October 14, 2025US-TX192,700,000
Conduent Business Services LLCOctober 8, 2025US-NJ62,224,658
Aflac IncorporatedDecember 22, 2025US-TX22,653,844
Cerner CorporationJuly 25, 2025US-WA18,565,730
Aflac Incorporated (“Aflac”)August 8, 2025US-GA13,924,906
Prosper Marketplace, IncDecember 10, 2025US-TX13,076,476
Episource, LLCJune 6, 2025US-CA6,725,572
Episource, LLCJune 6, 2025US-WA6,725,572
700Credit, LLCDecember 16, 2025US-TX5,836,521
TransUnion LLCSeptember 4, 2025US-TX4,461,511
University of Phoenix, Inc.December 21, 2025US-WA3,489,274
Columbia UniversityAugust 7, 2025US-WA3,067,242
PIH Health, Inc.January 31, 2025US-CA2,947,264
DaVita Inc.August 1, 2025US-CO2,689,826
Veradigm LLCSeptember 22, 2025US-IL2,672,036
Veradigm LLCDecember 2, 2025US-WA2,672,036
Anne Arundel DermatologyJuly 11, 2025US-MD1,905,000
Kettering Adventist HealthcareJuly 21, 2025US-OH1,695,382
Allianz Life Insurance Company of North AmericaJuly 25, 2025US-WA1,497,036
Radiology Associates of Richmond, Inc.July 1, 2025US-VA1,419,091
DermCare ManagementMay 2, 2025US-FL1,361,735
SimonMed ImagingOctober 14, 2025US-TX1,275,669
Absolute Dental Group, LLCMay 2, 2025US-NV1,223,635
WestJetOctober 3, 2025US-WA1,200,000
Southeast Series of Lockton Companies, LLC (Lockton)February 28, 2025US-GA1,124,727

Questions and answers

How many confirmed data breaches were disclosed in 2025?

Breach Census recorded 2,927 confirmed data breach incidents for 2025, assigned by disclosure date, falling back to discovery, then occurrence date.

What was the largest breach disclosed in 2025 on Breach Census?

The largest confirmed incident in 2025 was at Change Healthcare Inc., which affected 192,700,000 records.

Which sector reported the most breaches in 2025?

Healthcare reported the most confirmed breaches in 2025, with 480 of the 540 incidents that had a sector assigned.

Why can the 2025 total change?

Incidents are assigned to a year by disclosure date, falling back to discovery, then occurrence date, and new sources continue to be confirmed and published, so the 2025 total can still rise after this page is first generated.