Two decades of data breaches
We analyzed 885 known data breaches from 2007 to 2026 — roughly 12.7 billion exposed accounts, more than one for every person alive. Email shows up in 99% of them, but the most dangerous payload is the password: 66% of breaches leak one — and that’s what turns a single leak into a chain of account takeovers.
Key findings
- Passwords are the real danger. 66% of breaches leak a password — and because people reuse them, one leak gets tried against all your other accounts.
- Your email is almost always in there. 99% of breaches expose an email address, the key that ties your leaked data together across incidents.
- Breaches are data-rich. The typical breach exposes about 5.2 different types of personal data — not just a login, but names, phones (38%), addresses and dates of birth.
- Exposure comes in waves. Across 2007–2026, billions of accounts leaked in the biggest years — and leaked data is resold for years afterward, so old breaches still hurt.
- 2026 has already passed 2025 on count, and the payload has changed. 76 breaches are dated to 2026 against 52 for all of 2025, but a password shows up in only 16% of them (31% a year earlier), while home addresses (63% vs 38%) and phone numbers (70% vs 48%) are in far more.
2026 so far: more breaches, less that you can reset
On 14 August 2026, CNBC and Quartz both reported that breach notifications sent out this year had already overtaken the whole of 2025, with attacks involving AI named as part of the rise. Those are US notification counts. Our dataset measures something different — breach records that reached the public breach databases, worldwide — and it moves the same way.
| 2025 | 2026 to date | |
|---|---|---|
| Breaches dated to the year | 52 | 76 |
| Accounts exposed | 2.9 billion | 262 million |
| Leaked a password | 31% | 16% |
| Leaked a home address | 38% | 63% |
| Leaked a phone number | 48% | 70% |
| Leaked a government ID number | 4% | 11% |
| Types of data per breach | 4.6 | 5.7 |
More incidents, smaller sets, richer records. The 2026 breaches carry 5.7 types of personal data each against 4.6 a year earlier, and the extra fields are the ones tied to you rather than to a login: where you live, what your number is, and in 11% of cases a government ID number. That is the signature of records lifted out of a company’s customer, order or HR systems rather than out of a login table, which is how most of this year’s extortion cases have been described by the companies themselves. It changes what a response looks like. A password you can change in a minute; an address, a phone number and a date of birth stay valid for years, and the only thing that reduces that exposure is getting the same details off the sites that republish them.
Two caveats worth stating. 2026 is still running and breach records surface months after the event, so both columns will keep growing and the gap will widen further. And the AI attribution above is the reporting’s, not ours: how an intruder got in is not recorded in these records, so nothing in this table confirms or denies it.
Accounts exposed, by year
Total accounts exposed in the known breaches dated to each year.
What actually leaks
Share of the 885 breaches whose exposed records include each type of data.
The 10 biggest breaches in the dataset
Ranked by accounts exposed — a single incident can leak hundreds of millions of records.
| # | Breach | Year | Accounts exposed | Data types |
|---|---|---|---|---|
| 1 | Synthient Credential Stuffing Threat Data | 2025 | 2 billion | 2 |
| 2 | Verifications.io | 2019 | 763 million | 10 |
| 3 | Data Enrichment Exposure From PDL Customer | 2019 | 622 million | 7 |
| 4 | 2019 | 509 million | 8 | |
| 5 | Combolists Posted to Telegram | 2024 | 361 million | 3 |
| 6 | MySpace | 2008 | 359 million | 3 |
| 7 | ALIEN TXTBASE Stealer Logs | 2025 | 284 million | 2 |
| 8 | Not SOCRadar | 2024 | 282 million | 1 |
| 9 | Wattpad | 2020 | 269 million | 11 |
| 10 | Deezer | 2019 | 229 million | 8 |
Breach, stealer log, or malware?
Not every exposure is a company being hacked. Of the 885 incidents, 874 are classic data breaches (an attacker steals a company’s user database). A growing share are stealer logs — data quietly harvested from people’s own infected devices by info-stealer malware, then compiled and sold in bulk — and the rest are other malware-harvested sets. Stealer logs are especially dangerous because they capture live passwords and session data straight from the victim’s browser, bypassing even a strong, unique password.
Two decades, two halves
Breach activity accelerated sharply in the second decade — more incidents and far more accounts.
| Period | Breaches | Accounts exposed |
|---|---|---|
| 2007–2016 | 255 | 2.1 billion |
| 2017–2026 | 630 | 11 billion |
Why the password is the story
It’s tempting to read breach news as a count of incidents, but the data tells a sharper story. Email addresses leak in nearly every breach (99%) — that’s the constant that lets criminals match your records across dozens of separate dumps into one profile. The password, present in 66% of breaches, is the payload: because most people reuse passwords, a single leaked credential is immediately replayed against your email, bank and shopping accounts. That’s credential stuffing, and it’s why one old breach you’ve forgotten can still drain a current account. Leaked data also doesn’t expire — it’s copied, sold and re-posted for years, so the 12.7 billion accounts in this dataset keep circulating long after the headlines fade. The defense is unglamorous but effective: a unique password per account, two-factor authentication, and ongoing monitoring so you know the moment your details resurface.
What to do if your data is in a breach
- Change the password on the breached account — and everywhere you reused it. Reuse is what turns one leak into many.
- Turn on two-factor authentication (an authenticator app or passkey beats SMS) so a stolen password alone can’t get in.
- Use a password manager to give every account a unique, strong password you don’t have to remember.
- Watch for breach-themed phishing. Scammers reference real breaches to look legitimate — never act on an unsolicited “reset” link; go to the site directly.
- Monitor for re-exposure. Leaked data is resold for years, so a one-time fix isn’t enough. Check your email and keep watching.
Key terms
Methodology
This analysis covers 885 known, verified data breaches catalogued in public breach databases, dated 2007–2026(snapshot current as of August 2026). “Prevalence” is the share of breaches whose exposed-data classes include a given category; account totals are the breach owners’ reported figures and are approximate. We excluded entries flagged as sensitive, fabricated, retired or spam. Browse the underlying breaches in our data breach directory.
Sources & further reading
- FTC — IdentityTheft.gov: official recovery steps after identity theft.
- CISA — Secure Our World: strong passwords, MFA and phishing guidance.
- NIST SP 800-63B: federal digital-identity and password guidelines.
- PersProtect data breach directory: the underlying breaches analyzed here.
Use this data
Free to cite under Creative Commons BY 4.0 with a link back. Copy the snippet to embed a headline stat:
<p>According to PersProtect's analysis of 885 data breaches, 66% leak passwords. <a href="https://persprotect.com/research/two-decades-of-data-breaches">Read the study</a>.</p>Journalists: email support@persprotect.com for the full breakdown.
Cite this report
Free to share and cite under a Creative Commons BY 4.0 license, with attribution and a link back. Suggested citation:
PersProtect. (2026). Two Decades of Data Breaches. Retrieved from https://persprotect.com/research/two-decades-of-data-breachesJournalists & researchers: email support@persprotect.com for the underlying data or an interview.
Is your password in one of these breaches?
Check your email against known breach and dark-web databases for free — in seconds, no account needed. Then we help you lock down what’s exposed and watch for new leaks.
See also: data breach directory · data-broker opt-out · more research
About this study
What is the most commonly leaked data in a breach?
Across 885 known breaches, email addresses appear in 99% — but the most dangerous item is the password: 66% of breaches leak one. Names (56%) and phone numbers (38%) are also common.
How many accounts have been exposed in data breaches?
The 885 known breaches in our dataset span 2007–2026 and total roughly 12.7 billion exposed accounts — more than one for every person on Earth. The typical breach exposes about 5.2 different types of personal data.
Why are leaked passwords so dangerous?
Because people reuse them. A password leaked from one breach is immediately tried against your other accounts (credential stuffing), so a single leak can cascade into email, banking and shopping takeovers. That’s why reused passwords turn one breach into many.
What is credential stuffing?
Credential stuffing is when attackers take username and password pairs leaked in one breach and automatically try them on other sites — banking, email, shopping. It works because so many people reuse the same password, so one leak can unlock many accounts.
How long does leaked data stay dangerous?
Indefinitely. Breached data is copied, sold and re-posted across forums and dark-web markets for years, so an old breach you have forgotten can still be used against you. That is why ongoing monitoring matters more than a one-time cleanup.
Should I change my password after a breach?
Yes — change it on the breached account and anywhere you reused it, and turn on two-factor authentication. Using a password manager to give every account a unique password is the single most effective defense against credential stuffing.
Can I cite or reuse this data?
Yes — under a Creative Commons BY 4.0 license, with a link back. Email support@persprotect.com for the underlying breakdown.