2026 breach statistics and what to do
Data breach figures for 2026 only (January to October 2026), each with its source, and what to do if it happens to you. We do not estimate or fill gaps, and we do not show older years.
2026 in numbers
83
Data breaches that happened in 2026
218 million
Accounts exposed in those breaches
8,314
Ransomware claims in 2026 so far
152
Countries named in ransomware claims in 2026
If your business has a data breach
The rules depend on where you operate and where the affected people live, and you may have to meet more than one regime. Check the regulator's guidance for each place that applies to you.
Contain it
Stop the breach from getting worse. Cut off the access, recover what you can and change the passwords or keys involved.
Assess it
Work out what was exposed, who it affects and how likely it is to harm them. Do this quickly: some deadlines are counted in hours or days from when you become aware.
Notify
Where the law requires it, tell the regulator and the people affected. Say what happened, what was exposed and what they can do.
Review
Find the cause, fix it and check your controls so it does not happen again. Keep a record of what you decided and why.
Who to tell
- The people affected. Tell them what happened, what was exposed and what to do next, in plain words.
- The regulator. Many countries require notice to a data protection or cyber authority. Some of the main regimes are in the table below.
- Your bank, insurer and any affected suppliers. They may need to act too, and your cyber insurance may have notice rules.
- The police or your national cyber crime reporting service if a crime such as hacking, ransomware or fraud is involved.
| Where | Regime | In summary |
|---|---|---|
| EU and UK | GDPR and UK GDPR | Generally, notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to put people at risk (in the UK, the ICO; in the EU, your national data protection authority). High-risk breaches must also be told to the people affected. |
| United States | State breach notification laws; SEC rules | Every state has its own breach notification law, with different triggers and deadlines. Companies listed in the US generally must disclose a material cybersecurity incident within four business days of deciding it is material (SEC). |
| Australia | Notifiable Data Breaches scheme | For organisations covered by the Privacy Act: assess a suspected breach within 30 days, and notify the people affected and the OAIC if it is likely to cause serious harm. |
| India | CERT-In directions; DPDP Act | Report specified cyber incidents to CERT-In within 6 hours of noticing them. The Digital Personal Data Protection Act adds duties to notify the Data Protection Board and affected people; check the current rules. |
| Canada | PIPEDA | Report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner and the people affected as soon as feasible, and keep a record of every breach. Some provinces have their own laws. |
| Singapore | PDPA | Once you assess a breach as notifiable, generally notify the PDPC within 3 calendar days. |
Checklist
- Write down the time you found out and what you know. Keep adding to it.
- Contain the breach: disable the accounts, close the access, preserve the evidence.
- List what was exposed, whose it is and where those people live.
- Work out which notification rules apply and their deadlines. Some run in hours or days; others, such as Australia's, expect an assessment within 30 days.
- Where required, notify the regulator and the people affected.
- Reset passwords and keys, and turn on two-step sign-in.
- Find the cause, fix it and record what you learned.