Data Breach Statistics

Key findings

• 20% of breaches that exposed passwords stored at least some of them in plaintext, and 34% used fast unsalted hashes like MD5 or SHA-1 that crack in seconds.
• 73% of all breaches exposed passwords; 40% exposed phone numbers and 10% government ID numbers.
• United States has the most breached organizations (549), followed by Russia, France and India.
• E-commerce & Retail is the most breached sector, with 1,208 breaches.

Data breaches by year

Breaches in our index by the year they happened, since 2008. The last few years are likely undercounted: breaches often surface on forums and markets years after they happen.

Breaches per year, by breach date. 624 breaches have no known date.

How breached companies stored passwords

Of the 5,159 breaches that exposed passwords, this is how they were stored. A breach can appear in more than one row when it mixes formats.

Darker is worse: plaintext and fast hashes are recovered almost instantly with commodity GPUs.

Most exposed data types

Share of all breaches that included each type of personal data.

Most breached industries

Countries with the most breaches

By the country of the breached organization, where known.

Largest breaches

Methodology

These figures cover the 6,875 breaches publicly listed in the SynScan breach index and are computed from each breach's metadata, never from individual records. Record and email counts add up each breach's own totals, so a person exposed in several breaches is counted once per breach. Country and industry refer to the breached organization. Updated daily; last updated 2026-10-06.

Use this data

You are free to use these statistics in articles, reports and presentations under CC BY 4.0. Please credit SynScan and link to https://synscan.net/breach-statistics.