Data Breach Statistics

Key findings

• 26% of breaches that exposed passwords stored at least some of them in plaintext, and 34% used fast unsalted hashes like MD5 or SHA-1 that crack in seconds.
• 75% of all breaches exposed passwords; 41% exposed phone numbers and 13% government ID numbers.
• 123456 is still the most common password: it ranks among the most used in 75% of breaches, ahead of "123456789", "12345678" and "password".
• 3 infostealer datasets hold 58% of all leaked records, more than the 6,833 company breaches combined (21%).
• United States has the most breached organizations (607), followed by Russia, France and India.
• E-commerce & Retail is the most breached sector, with 1,225 breaches.

Where leaked records come from

Not all leaks are the same. A company breach exposes one organization's users. A combo list stitches credentials from many breaches into one file, and infostealer logs are credentials harvested straight from infected computers. A handful of stealer and combo datasets now outweigh thousands of breaches.

Data breaches by year

Breaches in our index by the year they happened, since 2008. The last few years are likely undercounted: breaches often surface on forums and markets years after they happen.

Breaches per year, by breach date. 598 breaches have no known date.

How breached companies stored passwords

Of the 5,177 breaches that exposed passwords, this is how they were stored. A breach can appear in more than one row when it mixes formats.

Darker is worse: plaintext and fast hashes are recovered almost instantly with commodity GPUs.

Most common passwords in data breaches

Each breach has its own list of most used passwords. Across the 1,007 breaches where we have it, these are the passwords that make that list most often. 123456 is among the most used passwords in 75% of them.

Most exposed data types

Share of all breaches that included each type of personal data.

Most breached industries

Countries with the most breaches

By the country of the breached organization, where known.

Largest breaches

Methodology

These figures cover the 6,875 breaches publicly listed in the SynScan breach index and are computed from each breach's metadata, never from individual records. Record and email counts add up each breach's own totals, so a person exposed in several breaches is counted once per breach. Country and industry refer to the breached organization. The password ranking uses each breach's own most-used passwords (breaches of 1,000+ records) and only lists passwords common to at least 25 breaches. Updated daily; last updated 2026-10-29.

Use this data

You are free to use these statistics in articles, reports and presentations under CC BY 4.0. Please credit SynScan and link to https://synscan.net/breach-statistics.