2026 — Year in review
Years are assigned by disclosure date, falling back to discovery, then occurrence date.
Breach Census recorded 3,118 confirmed incidents in 2026. That is up from 2,927 in 2025, a rise of 191 incidents (6.5%). Incidents are assigned to a year by disclosure date, falling back to discovery, then occurrence date, and totals for the most recent years can still grow as new sources are confirmed and published.
The largest confirmed incident by records affected was at Conduent Business Services, LLC (revised submission), which affected 62,486,662 records. Healthcare was the most common sector, with 599 of the 690 incidents that had a sector assigned. The most common attack type among incidents with one recorded was Hacking/IT Incident, in 420 incidents.
Regulators issued fines totaling 47,026,000 EUR across 5 actions and 16,213,990 GBP across 6 actions in 2026. The most-reported jurisdictions were US-MA (1,274), US-TX (500), and US-VT (386).
Regulator fines by currency
Totals are not summed across currencies.
| Currency | Actions | Total |
|---|---|---|
| EUR | 5 | 47,026,000 EUR |
| GBP | 6 | 16,213,990 GBP |
By sector
| Sector | Confirmed incidents |
|---|---|
| Unclassified | 2,428 |
| Healthcare | 599 |
| Technology | 20 |
| Finance | 19 |
| Manufacturing | 10 |
| Professional Services | 8 |
| Insurance | 7 |
| Hospitality | 7 |
| Energy | 5 |
| Real Estate | 5 |
| Pharma | 3 |
| Transport | 3 |
| Retail | 2 |
| Telecoms | 1 |
| Education | 1 |
Top jurisdictions
| Jurisdiction | Confirmed incidents |
|---|---|
| US-MA | 1,274 |
| US-TX | 500 |
| US-VT | 386 |
| US-CA | 327 |
| US-WA | 151 |
| US-NH | 91 |
| US-IA | 29 |
| US-FL | 29 |
| US-NY | 24 |
| US | 22 |
| US-IL | 17 |
| US-PA | 17 |
| US-NC | 15 |
| US-MN | 15 |
| US-MI | 15 |
Largest incidents by records affected
| Organization | Disclosed | Jurisdiction | Records affected |
|---|---|---|---|
| Conduent Business Services, LLC (revised submission) | May 20, 2026 | US-TX | 62,486,662 |
| DriveWealth | September 30, 2026 | US-CA | 30,000,000 |
| DentaQuest, LLC | July 16, 2026 | US-MA | 15,000,000 |
| DentaQuest, LLC | July 16, 2026 | US-WA | 15,000,000 |
| IDScan.net | September 21, 2026 | US-TX | 13,000,000 |
| Aesto, LLC | July 31, 2026 | US-AL | 9,540,683 |
| iRhythm Technologies Inc. | October 6, 2026 | US-TX | 8,179,772 |
| AssuranceAmerica Managing General Agency, LLC | June 17, 2026 | US-WA | 6,998,886 |
| TriZetto Provider Solutions | February 6, 2026 | US-WA | 6,974,232 |
| Carnival Corporation | May 27, 2026 | US-CA | 5,995,277 |
| Heights Finance Holdings Co. | August 14, 2026 | US-TX | 4,132,834 |
| AdaptHealth Corp. | July 2, 2026 | US | 4,115,802 |
| AdaptHealth Corp. | August 14, 2026 | US-CA | 4,115,802 |
| Unlimited Technology Systems, LLC | July 21, 2026 | US-WA | 3,836,316 |
| Medtronic Inc. | June 29, 2026 | US-WA | 3,834,294 |
| Unlimited Technology Systems, LLC | July 21, 2026 | US-OH | 3,803,750 |
| CareCloud, Inc. | July 24, 2026 | US-NJ | 3,756,469 |
| CareCloud, Inc. | August 18, 2026 | US-TX | 3,756,469 |
| TriZetto Provider Solutions | February 6, 2026 | US-MO | 3,433,965 |
| Texas Parks and Wildlife | June 26, 2026 | US-TX | 3,187,000 |
| QualDerm Partners, LLC | February 22, 2026 | US-TN | 3,117,874 |
| QualDerm Partners, LLC | February 23, 2026 | US-WA | 3,117,874 |
| Baylor Genetics | August 18, 2026 | US-TX | 2,810,878 |
| Baylor Genetics | August 14, 2026 | US-TX | 2,810,878 |
| Navia Benefit Solutions, Inc. | March 18, 2026 | US-WA | 2,697,540 |
Questions and answers
How many confirmed data breaches were disclosed in 2026?
Breach Census recorded 3,118 confirmed data breach incidents for 2026, assigned by disclosure date, falling back to discovery, then occurrence date.
What was the largest breach disclosed in 2026 on Breach Census?
The largest confirmed incident in 2026 was at Conduent Business Services, LLC (revised submission), which affected 62,486,662 records.
Which sector reported the most breaches in 2026?
Healthcare reported the most confirmed breaches in 2026, with 599 of the 690 incidents that had a sector assigned.
Why can the 2026 total change?
Incidents are assigned to a year by disclosure date, falling back to discovery, then occurrence date, and new sources continue to be confirmed and published, so the 2026 total can still rise after this page is first generated.