Breaches & incidents

The victims' side of the threat pictureWho is being attacked

Data breaches and cyber incidents made public — reported to regulators, disclosed by the companies themselves, or catalogued after a leak. Who was hit, when, how, and how many people or accounts were affected.

Incidents disclosed
616
last 12 months, every source
People in US health breaches
70.4M
475 breaches reported to HHS
Material incidents, US listed firms
23
SEC 8-K Item 1.05, 12 months
Accounts in new breach records
522.5M
126 breaches added to HIBP

Coverage. Mostly the United States: the cleanest public records of named victims come from US regulators. Ransomware victims worldwide, India included, are on the ransomware victims page. Every count is a lower bound — only disclosed incidents appear.

1Key findings

  • Most common attackHacking / intrusion78% of named-victim incidents in the last 24 months
  • Most targeted sectorHealthcare752 incidents in the last 24 months
  • Most people affectedConduent Business Services LLC62.2M people · 8 Oct 2025
  • Most accounts exposed1win96.2M accounts · 2 Nov 2024
  • Named most oftenFieldtex Products, Inc.in 5 disclosures, 20 Nov 2025 – 12 Dec 2025
  • Latest disclosurePark Dental Partners, Inc.Hacking / intrusion · 7 Oct 2026 · SEC 8-K

3Sectors

Who the incidents hit, where the source names a sector, and how each sector was attacked.

Most affected sectorsLast 24 months. Select one to list its incidents.
  1. Healthcare752
  2. Information28
  3. Manufacturing21
  4. Professional Services19
  5. Retail18
  6. Finance, Insurance & Real Estate6
  7. Services5
  8. Transportation4
  9. Technology4
  10. Administrative3
  11. Accommodation & Food3
  12. Other Services2
Sector against type of attackIncidents per sector (rows) and attack type (columns). Darker means more.
  • In healthcare, 91% of incidents were hacking / intrusion.
Hacking / intrusionData breach (cause not stated)Unauthorised access or disclosureRansomwareTheft or lossError / misconfiguration
Healthcare68461241
Information253
Manufacturing201
Professional Services181
Retail171
Finance, Insurance & Real Estate6
Services5
Transportation4

4Largest incidents

The last 24 months. People and accounts are counted apart: an account list can hold one person many times. Credential compilations, which name no victim, are left out.

By people affected
  1. 1
    Conduent Business Services LLC62.2M people
    8 Oct 2025 · Hacking / intrusion · Healthcare · HHS
  2. 2
    DentaQuest, LLC15.0M people
    16 Jul 2026 · Hacking / intrusion · Healthcare · HHS
  3. 3
    Aflac Incorporated (“Aflac”)13.9M people
    8 Aug 2025 · Hacking / intrusion · Healthcare · HHS
  4. 4
    Aesto, LLC9.5M people
    31 Jul 2026 · Hacking / intrusion · Healthcare · HHS
  5. 5
    Episource, LLC6.7M people
    6 Jun 2025 · Hacking / intrusion · Healthcare · HHS
  6. 6
    AdaptHealth, LLC4.1M people
    14 Aug 2026 · Hacking / intrusion · Healthcare · HHS
  7. 7
    Unlimited Technology Systems, LLC3.8M people
    21 Jul 2026 · Hacking / intrusion · Healthcare · HHS
  8. 8
    CareCloud, Inc.3.8M people
    24 Jul 2026 · Hacking / intrusion · Healthcare · HHS
By accounts exposed
  1. 1
    1win96.2M accounts
    2 Nov 2024 · Data breach (cause not stated) · HIBP
  2. 2
    Under Armour72.7M accounts
    17 Nov 2025 · Data breach (cause not stated) · HIBP
  3. 3
    Suno55.3M accounts
    25 Nov 2025 · Data breach (cause not stated) · HIBP
  4. 4
    Canadian Tire38.3M accounts
    2 Oct 2025 · Data breach (cause not stated) · HIBP
  5. 5
    Addi34.5M accounts
    25 Mar 2026 · Data breach (cause not stated) · HIBP
  6. 6
    SoundCloud29.8M accounts
    15 Dec 2025 · Data breach (cause not stated) · HIBP
  7. 7
    Speedio27.5M accounts
    24 Dec 2024 · Data breach (cause not stated) · HIBP
  8. 8
    Paidwork23.3M accounts
    29 Mar 2026 · Data breach (cause not stated) · HIBP

5Hit more than once

Organisations named in more than one disclosure in the last 5 years (30 in all). That can be separate attacks, or one incident reported to more than one place — a regulator and investors, or on behalf of several clients.

OrganisationDisclosuresFirst – latestTypes of attackSources
Fieldtex Products, Inc. · Healthcare520 Nov 2025 – 12 Dec 2025Hacking / intrusionHHS
AltaMed Health Services Corporation · Healthcare31 Jun 2023 – 26 Feb 2026Hacking / intrusionRansomwareUnauthorised access or disclosureHHS, VCDB
United Healthcare Student Resources · Finance & Insurance31 Jun 2023 – 1 Jun 2023RansomwareVCDB
DentaQuest, LLC · Healthcare223 May 2026 – 16 Jul 2026Data breach (cause not stated)Hacking / intrusionHHS, HIBP
CarMax · Retail22 May 2025 – 24 Jan 2026Data breach (cause not stated)Hacking / intrusionHIBP, VCDB
Park Dental Partners, Inc. · Healthcare228 Aug 2026 – 7 Oct 2026Hacking / intrusionSEC 8-K
WindRose Health Network · Healthcare227 Jan 2026 – 16 Sept 2026Hacking / intrusionHHS
AdaptHealth, LLC · Healthcare227 Jun 2026 – 14 Aug 2026Hacking / intrusionHHS, SEC 8-K
CareCloud, Inc. · Healthcare224 Mar 2026 – 24 Jul 2026Hacking / intrusionHHS, SEC 8-K
Clinical Registry Solutions · Healthcare29 Apr 2026 – 12 Jun 2026Hacking / intrusionHHS, VCDB
Open Arms Care Corporation · Healthcare21 Jun 2025 – 11 Jun 2026Hacking / intrusionHHS, VCDB
Gastro Health · Healthcare222 May 2026 – 22 May 2026Hacking / intrusionHHS

6All incidents

Clear

3,216 incidents match, newest first.

DateOrganisationType of attackSectorWhereAffectedSource
2017-01-01UPMC SusquehannaPhishing / social engineeringHealthcareUS1,200 recordsVCDB
2017-01-01University HospitalsTheft or lossHealthcareOH, US1 recordsVCDB
2017-01-01University of Chicago Medical CenterError / misconfigurationHealthcareIL, US—VCDB
2017-01-01University of Maryland Faculty Physicians Inc.Hacking / intrusionHealthcareMD, US1,500 recordsVCDB
2017-01-01Unnamed medical practiceTheft or lossHealthcareNJ, US1,000 recordsVCDB
2017-01-01Unnamed organisationInsider misuseHealthcareGA, US—VCDB
2017-01-01Unnamed organisationError / misconfigurationHealthcareTX, US28 recordsVCDB
2017-01-01VCU Health SystemInsider misuseHealthcareVA, US—VCDB
2017-01-01Walsall HealthTheft or lossHealthcareGB40 recordsVCDB
2017-01-01Washington DC Department of Health and Human ServicesError / misconfigurationHealthcareUnknown138 recordsVCDB
2017-01-01William Osler Health SystemInsider misuseHealthcareCA—VCDB
2017-01-01Yale New Haven HospitalInsider misuseHealthcareConneticut, US200 recordsVCDB
2017-01-01university of chicagoError / misconfigurationHealthcareUS-IL, US—VCDB
2016-12-30Emory HealthcareRansomwareHealthcareGA, US200k recordsVCDB
2016-12-30University of Pittsburgh Medical CenterInsider misuseHealthcarePA, US111 recordsVCDB
2016-12-29Denton Heart GroupTheft or lossHealthcareTX, US—VCDB
2016-12-28Brand New DayHacking / intrusionHealthcareCA, US14k recordsVCDB
2016-12-27SpaSurgicaError / misconfigurationHealthcareCA—VCDB
2016-12-21Children’s Hospital Los AngelesTheft or lossHealthcareCA, US3,600 recordsVCDB
2016-12-16Family Service RochesterRansomwareHealthcareMN, US17k recordsVCDB
2016-12-12Capital Prosthetic and Orthotic CenterTheft or lossHealthcareOH, UM1,100 recordsVCDB
2016-12-09Wonderful Center for Health InnovationTheft or lossHealthcareCA, US—VCDB
2016-12-08Family Medicine EastTheft or lossHealthcareKS, US—VCDB
2016-12-01Brigham and Women’s HospitalPhishing / social engineeringHealthcareMA, US—VCDB
2016-12-01Coney Island Hospital, New YorkError / misconfigurationHealthcareNew York, US3,500 recordsVCDB
2016-12-01Health SolutionsError / misconfigurationHealthcareIN43k recordsVCDB
2016-12-01Houston Interventional CardiologyPhishing / social engineeringHealthcareTX, US1 recordsVCDB
2016-12-01Sainte-Justine HospitalInsider misuseHealthcareCA—VCDB
2016-12-01Synergy Specialists Medical GroupHacking / intrusionHealthcareCA, US—VCDB
2016-12-01Unnamed organisationPhishing / social engineeringHealthcareNZ1 recordsVCDB
2016-11-26Quest DiagnosticsHacking / intrusionHealthcareNJ, US34k recordsVCDB
2016-11-12Central DuPage HospitalHacking / intrusionHealthcareIL, US1 recordsVCDB
2016-11-10Psychological & Counseling CenterError / misconfigurationHealthcareTN, US468 recordsVCDB
2016-11-06Meigs County EMSRansomwareHealthcareOH, US—VCDB
2016-11-01Berkshire Medical CenterInsider misuseHealthcareMA, US1,745 recordsVCDB
2016-11-01Best Health Physical Therapy, LLC (Best Health)Hacking / intrusionHealthcareConnecticut, US—VCDB
2016-11-01East Valley Community Health CenterRansomwareHealthcareCA, US—VCDB
2016-11-01Eastside Medical ClinicInsider misuseHealthcareCA18 recordsVCDB
2016-11-01Princeton Pain ManagmentHacking / intrusionHealthcareNJ, US4,668 recordsVCDB
2016-11-01Silver Cross HospitalError / misconfigurationHealthcareIL, US8,862 recordsVCDB
2016-11-01Unnamed organisationInsider misuseHealthcareMO, US1 recordsVCDB
2016-10-31NHS TrustMalwareHealthcareGB—VCDB
2016-10-30Goole NHS Foundation TrustRansomwareHealthcareGB—VCDB
2016-10-30Lincolnshire NHS TrustRansomwareHealthcareGB—VCDB
2016-10-25Brandywine Pediatrics, P.A.RansomwareHealthcareDE, US27k recordsVCDB
2016-10-15Skin Cancer Specialists, P.C.Hacking / intrusionHealthcareGA, US3,365 recordsVCDB
2016-10-12Kaiser PermanenteError / misconfigurationHealthcareCA, UM8,020 recordsVCDB
2016-10-04Western HealthError / misconfigurationHealthcareCA, US—VCDB
2016-10-01Health Access NetworkInsider misuseHealthcareME, US—VCDB
2016-10-01Lee Memorial HospitalInsider misuseHealthcareFL, US1 recordsVCDB

Sources: US HHS breach portal, SEC EDGAR, Have I Been Pwned (CC BY 4.0) and the VERIS Community Database (CC BY-SA 4.0). Updated 2026-10-14 11:55 UTC.