Two decades of data breaches
We analyzed 874 known data breaches from 2007 to 2026 — roughly 12.7 billion exposed accounts, more than one for every person alive. Email shows up in 99% of them, but the most dangerous payload is the password: 67% of breaches leak one — and that’s what turns a single leak into a chain of account takeovers.
Key findings
- Passwords are the real danger. 67% of breaches leak a password — and because people reuse them, one leak gets tried against all your other accounts.
- Your email is almost always in there. 99% of breaches expose an email address, the key that ties your leaked data together across incidents.
- Breaches are data-rich. The typical breach exposes about 5.2 different types of personal data — not just a login, but names, phones (38%), addresses and dates of birth.
- Exposure comes in waves. Across 2007–2026, billions of accounts leaked in the biggest years — and leaked data is resold for years afterward, so old breaches still hurt.
Accounts exposed, by year
Total accounts exposed in the known breaches dated to each year.
What actually leaks
Share of the 874 breaches whose exposed records include each type of data.
The 10 biggest breaches in the dataset
Ranked by accounts exposed — a single incident can leak hundreds of millions of records.
| # | Breach | Year | Accounts exposed | Data types |
|---|---|---|---|---|
| 1 | Synthient Credential Stuffing Threat Data | 2025 | 2 billion | 2 |
| 2 | Verifications.io | 2019 | 763 million | 10 |
| 3 | Data Enrichment Exposure From PDL Customer | 2019 | 622 million | 7 |
| 4 | 2019 | 509 million | 8 | |
| 5 | Combolists Posted to Telegram | 2024 | 361 million | 3 |
| 6 | MySpace | 2008 | 359 million | 3 |
| 7 | ALIEN TXTBASE Stealer Logs | 2025 | 284 million | 2 |
| 8 | Not SOCRadar | 2024 | 282 million | 1 |
| 9 | Wattpad | 2020 | 269 million | 11 |
| 10 | Deezer | 2019 | 229 million | 8 |
Breach, stealer log, or malware?
Not every exposure is a company being hacked. Of the 874 incidents, 863 are classic data breaches (an attacker steals a company’s user database). A growing share are stealer logs — data quietly harvested from people’s own infected devices by info-stealer malware, then compiled and sold in bulk — and the rest are other malware-harvested sets. Stealer logs are especially dangerous because they capture live passwords and session data straight from the victim’s browser, bypassing even a strong, unique password.
Two decades, two halves
Breach activity accelerated sharply in the second decade — more incidents and far more accounts.
| Period | Breaches | Accounts exposed |
|---|---|---|
| 2007–2016 | 255 | 2.1 billion |
| 2017–2026 | 619 | 11 billion |
Why the password is the story
It’s tempting to read breach news as a count of incidents, but the data tells a sharper story. Email addresses leak in nearly every breach (99%) — that’s the constant that lets criminals match your records across dozens of separate dumps into one profile. The password, present in 67% of breaches, is the payload: because most people reuse passwords, a single leaked credential is immediately replayed against your email, bank and shopping accounts. That’s credential stuffing, and it’s why one old breach you’ve forgotten can still drain a current account. Leaked data also doesn’t expire — it’s copied, sold and re-posted for years, so the 12.7 billion accounts in this dataset keep circulating long after the headlines fade. The defense is unglamorous but effective: a unique password per account, two-factor authentication, and ongoing monitoring so you know the moment your details resurface.
What to do if your data is in a breach
- Change the password on the breached account — and everywhere you reused it. Reuse is what turns one leak into many.
- Turn on two-factor authentication (an authenticator app or passkey beats SMS) so a stolen password alone can’t get in.
- Use a password manager to give every account a unique, strong password you don’t have to remember.
- Watch for breach-themed phishing. Scammers reference real breaches to look legitimate — never act on an unsolicited “reset” link; go to the site directly.
- Monitor for re-exposure. Leaked data is resold for years, so a one-time fix isn’t enough. Check your email and keep watching.
Key terms
Methodology
This analysis covers 874 known, verified data breaches catalogued in public breach databases, dated 2007–2026(snapshot current as of July 2026). “Prevalence” is the share of breaches whose exposed-data classes include a given category; account totals are the breach owners’ reported figures and are approximate. We excluded entries flagged as sensitive, fabricated, retired or spam. Browse the underlying breaches in our data breach directory.
Sources & further reading
- FTC — IdentityTheft.gov: official recovery steps after identity theft.
- CISA — Secure Our World: strong passwords, MFA and phishing guidance.
- NIST SP 800-63B: federal digital-identity and password guidelines.
- PersProtect data breach directory: the underlying breaches analyzed here.
Use this data
Free to cite under Creative Commons BY 4.0 with a link back. Copy the snippet to embed a headline stat:
<p>According to PersProtect's analysis of 874 data breaches, 67% leak passwords. <a href="https://persprotect.com/research/two-decades-of-data-breaches">Read the study</a>.</p>Journalists: email support@persprotect.com for the full breakdown.
Cite this report
Free to share and cite under a Creative Commons BY 4.0 license, with attribution and a link back. Suggested citation:
PersProtect. (2026). Two Decades of Data Breaches. Retrieved from https://persprotect.com/research/two-decades-of-data-breachesJournalists & researchers: email support@persprotect.com for the underlying data or an interview.
Is your password in one of these breaches?
Check your email against known breach and dark-web databases for free — in seconds, no account needed. Then we help you lock down what’s exposed and watch for new leaks.
See also: data breach directory · data-broker opt-out · more research
About this study
What is the most commonly leaked data in a breach?
Across 874 known breaches, email addresses appear in 99% — but the most dangerous item is the password: 67% of breaches leak one. Names (55%) and phone numbers (38%) are also common.
How many accounts have been exposed in data breaches?
The 874 known breaches in our dataset span 2007–2026 and total roughly 12.7 billion exposed accounts — more than one for every person on Earth. The typical breach exposes about 5.2 different types of personal data.
Why are leaked passwords so dangerous?
Because people reuse them. A password leaked from one breach is immediately tried against your other accounts (credential stuffing), so a single leak can cascade into email, banking and shopping takeovers. That’s why reused passwords turn one breach into many.
What is credential stuffing?
Credential stuffing is when attackers take username and password pairs leaked in one breach and automatically try them on other sites — banking, email, shopping. It works because so many people reuse the same password, so one leak can unlock many accounts.
How long does leaked data stay dangerous?
Indefinitely. Breached data is copied, sold and re-posted across forums and dark-web markets for years, so an old breach you have forgotten can still be used against you. That is why ongoing monitoring matters more than a one-time cleanup.
Should I change my password after a breach?
Yes — change it on the breached account and anywhere you reused it, and turn on two-factor authentication. Using a password manager to give every account a unique password is the single most effective defense against credential stuffing.
Can I cite or reuse this data?
Yes — under a Creative Commons BY 4.0 license, with a link back. Email support@persprotect.com for the underlying breakdown.