Data Breach Statistics: What the Numbers Show

Updated 5 November 2026 · Standard formula, shown below

Data breach statistics depend on what is counted: exposed records, confirmed incidents, affected people, or the financial cost of response. Recent reports put the typical breach cost in the millions of dollars, but no single figure captures how often breaches occur or how many people they affect.

What Data Breach Statistics Measure

A data breach is generally an incident in which information is accessed, disclosed, altered, or taken without authorization. Statistics can describe very different parts of that event. A report might count one company incident as a single breach even if millions of records were involved, while another dataset counts each exposed record or each affected person.

Common measures include:

Incident count: the number of reported or confirmed breach events.
Records exposed: the number of data entries involved; a record is not necessarily a unique person.
People affected: individuals whose information may have been compromised, sometimes reported under legal notification rules.
Time to identify and contain: how long an organization takes to discover a breach and stop it.
Cost: investigation, recovery, customer support, lost business, legal work, and other measured expenses.

These figures are not interchangeable. A single breach can expose many records, and one person can have multiple records in the same incident or across different incidents.

Recent Cost and Incident Findings

IBM’s Cost of a Data Breach Report 2024 estimated the global average cost of a breach at US$4.88 million, up 10% from the prior year and the highest average in that report’s series. It also reported an average of 258 days to identify and contain a breach. Those numbers refer to the study’s surveyed organizations and costing method; they are not a prediction of what any particular business will pay.

Another widely cited source, Verizon’s 2024 Data Breach Investigations Report, analyzed 30,458 security incidents, of which 10,626 were confirmed data breaches. Its findings emphasize that breaches have varied causes, including credential abuse, exploitation of vulnerabilities, and human involvement. The report’s incident sample is not a census of every breach worldwide.

Differences between the two reports are expected. IBM focuses heavily on breach costs among organizations that participated in its research. Verizon analyzes incident patterns using contributed cases and other sources. Their totals answer distinct questions, so combining them as if they were measurements from one common population would be misleading.

How Breaches Happen

Statistics often group breaches by the way attackers gained access or by the type of mistake that exposed information. These categories can overlap: a criminal may steal a password and then exploit a system weakness, while an employee’s mistake may make an attacker’s job easier.

Stolen or misused credentials: passwords or access tokens obtained through phishing, password reuse, malware, or other means.
Vulnerability exploitation: attackers take advantage of a flaw in internet-facing software or an unpatched system.
Social engineering: a person is tricked into revealing information, approving access, or sending money or data.
Misconfiguration or accidental disclosure: data is left accessible through an improperly configured system, cloud storage, or sharing permission.
Insider activity: an authorized person misuses access, intentionally or accidentally.
Third-party compromise: an organization’s data is exposed through a supplier, contractor, or service provider.

“Human error” does not always mean carelessness. Complex systems, unclear procedures, and excessive access permissions can make mistakes more likely and more damaging.

Why the Numbers Vary

There is no universal worldwide database that captures every data breach consistently. Organizations may discover incidents months after they begin; some events are never detected or publicly disclosed. Notification laws and reporting practices differ by jurisdiction, sector, and type of information, so public counts are shaped by rules as well as by the underlying events.

Researchers also use different definitions. Some count attempted attacks; others include only confirmed access to data. A security incident can disrupt systems without exposing personal information, while a breach may involve information that was accessed but not publicly posted. Record totals can be especially uncertain when attackers publish incomplete, duplicated, or fabricated data.

When comparing statistics, check the report’s year, geographic scope, sample, definition of “breach,” and method of estimating cost or affected people. A percentage increase may reflect better detection or broader reporting, not necessarily a matching increase in the true number of attacks.

What Breach Statistics Mean for Individuals

A large breach does not mean every affected person will experience identity theft, and a small breach can still be serious if it exposes sensitive credentials or financial information. The type of data matters. A leaked email address has different implications from a government identifier, account password, or medical record.

If an organization says your information may have been involved, use the organization’s official website or contact details you already trust to verify the notice. Do not click links in an unexpected message. Depending on what was exposed, useful steps may include changing a reused password, enabling multifactor authentication, reviewing account activity, and watching for suspicious messages that use details from the incident.

Be cautious about treating a breach notification as proof of fraud—or ignoring it because no misuse is immediately visible. Data can be retained and used later. Follow the specific guidance in a verified notice, and use relevant government or financial-institution resources when the exposed information warrants further action.

How Organizations Can Reduce Risk

Statistics describe past events, but basic security measures can reduce both the likelihood and impact of future ones. No single control prevents every breach; organizations generally need overlapping safeguards and a tested response plan.

Require multifactor authentication, especially for administrative and remote access.
Use unique passwords and managed credentials; limit and review access privileges.
Apply security updates promptly and track systems exposed to the internet.
Encrypt sensitive information and remove data that is no longer needed.
Train staff to verify unusual requests and report suspected incidents quickly.
Monitor systems, maintain protected backups, and rehearse incident response.
Assess vendors’ access and security practices, not just internal systems.

These measures help manage risk; they do not guarantee that a breach will not occur. Planning for detection and containment matters because limiting the time an intruder has access can reduce harm.

Frequently Asked Questions

How many data breaches happen each year?
There is no complete global count. Published totals depend on the source, definition, reporting requirements, and whether the figures cover confirmed breaches, security incidents, or exposed records.

What was the average cost of a data breach in 2024?
IBM’s 2024 report estimated a global average of US$4.88 million for the breaches in its study. It is a study-specific average, not a standard cost or an estimate for every organization.

What is the difference between a data breach and a data leak?
Usage varies. “Breach” often refers to unauthorized access or disclosure, while “leak” can describe information becoming exposed, including through accidental publication. Reports may use the terms differently, so check each source’s definitions.

Does a breach mean my identity will be stolen?
No. A breach creates risk, but misuse is not inevitable. The likely consequences depend on which information was exposed, whether it can be used to access accounts, and what protective steps are taken.

Are breach statistics reliable?
They can be useful when the source explains its methods and limitations. Treat totals as estimates or reported cases rather than a perfect count, and compare only statistics with compatible definitions and coverage.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.