Data Breach Statistics Updated November 2026

Human Written & Fact Checked · Updated

100 Data Breach Statistics for 2026

A breach count tells you little until you know what was counted. A regulator's notification, a consumer's complaint and a confirmed disclosure in an incident-response dataset describe different events. Treating them as interchangeable produces a larger headline and a weaker analysis.

This hub separates confirmed breaches, notification records, personal-data complaints and ransomware recovery. Use the observation period beside each statistic when comparing evidence: a report published this year can describe incidents from the previous year.

Headline figures

  • Australia: OAIC received 667 breach notifications in the reporting half-year (January–June 2026). (Office of the Australian Information Commissioner, Oct 2026)
  • 17-country survey: 56% of ransomware attacks encrypted victims' data (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 17-country survey: The median ransom demand was $698,000 (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 17-country survey: Mean recovery cost, excluding ransom, was $1,700,200 (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • FBI IC3 reporting population: IC3 received 67,456 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • FBI IC3 reporting population: Personal-data-breach complaints reported $1,314,923,988 in losses (2025). (FBI IC3, Apr 2026)
  • Global contributed corpus: Vulnerability exploitation accounted for 31% of initial breach access (November 2024–October 2025). (Verizon, May 2026)
  • Global contributed corpus: Ransomware appeared in 48% of confirmed breaches (November 2024–October 2025). (Verizon, May 2026)
  • Global contributed corpus: Third parties were involved in 48% of breaches (November 2024–October 2025). (Verizon, May 2026)
  • Global contributed corpus: The human element appeared in 62% of breaches (November 2024–October 2025). (Verizon, May 2026)

Browse data breach statistics

What did Australian breach notifications reveal?

Notification data captures what reaches a regulator under a particular reporting scheme. Large events deserve separate attention from the total number of notifications because an incident count does not measure the number of people exposed.

How many Australian notified breaches affected large populations?

These are notifications submitted under Australia's Notifiable Data Breaches scheme. A sector total counts notified incidents, whereas an affected-person band describes an incident's reported scale. Neither measure is a count of unique Australians whose information was exposed. Reporting requirements and an organisation's recognition of an eligible breach determine which events reach the regulator. The affected-person categories shown here are selected bands, so they should not be summed as a complete distribution.

Which Australian sectors submitted breach notifications?

These are notifications submitted under Australia's Notifiable Data Breaches scheme. A sector total counts notified incidents, whereas an affected-person band describes an incident's reported scale. Neither measure is a count of unique Australians whose information was exposed. Reporting requirements and an organisation's recognition of an eligible breach determine which events reach the regulator. The affected-person categories shown here are selected bands, so they should not be summed as a complete distribution.

How costly was ransomware recovery?

Ransom demands are only part of the recovery bill. Keep payments, demands and the cost of restoring operations separate, and distinguish victims who paid from the broader population of organisations hit by ransomware.

How did ransomware victims recover encrypted data?

  • 16% of ransomware attacks involved both encryption and data theft (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 66% of encrypted-data victims used backups to recover data (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 48% of encrypted-data victims paid ransom to recover data (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • The median reported ransom payment was $769,000 (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)

Vanson Bourne survey commissioned by Sophos; respondents were ransomware-hit organisations, not all organisations. Published July15,2026; PDF production footer is not used as publication date. Backup use and ransom payment are not mutually exclusive recovery strategies. Some organisations can use both, which prevents treating the percentages as alternative outcomes.

How did recovery costs and negotiated payments compare?

  • Median recovery cost, excluding ransom, was $375,000 (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 55% of surveyed victims recovered within a week (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 51% of paired demand/payment respondents paid below the demand (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 30% of paired demand/payment respondents paid exactly the demand (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)

Vanson Bourne survey commissioned by Sophos; respondents were ransomware-hit organisations, not all organisations. Published July15,2026; PDF production footer is not used as publication date. The paired-payment results concern respondents who supplied both figures. Recovery costs exclude the ransom, so they describe a different part of the financial burden.

How long did recovery take and how were teams affected?

  • 18% of paired demand/payment respondents paid above the demand (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 83% of ransomware victims recovered within one month (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 3% of ransomware victims required more than three months to recover (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 99% of encrypted-data victims reported IT-team repercussions (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)
  • 41% of encrypted-data victims reported increased future-attack anxiety (January–March 2026 survey; prior 12 months). (Sophos, Jul 2026)

Vanson Bourne survey commissioned by Sophos; respondents were ransomware-hit organisations, not all organisations. Published July15,2026; PDF production footer is not used as publication date.

What did personal-data-breach complaints cost?

Complaint totals describe reported harm. They cannot reveal how many compromised records existed, how many people never complained, or how many distinct organisations suffered confirmed disclosure.

What did younger IC3 complainants report about data breaches?

  • The separate organisational data-breach category recorded 3,963 complaints (2025). (FBI IC3, Apr 2026)
  • People aged 60+ filed 11,705 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • Age under 20: 2,601 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • Age under 20: $7,314,429 personal-data-breach complaint losses (2025). (FBI IC3, Apr 2026)
  • Age under 20: 21 complaints in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age under 20: $1,741,450 losses in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 20–29: 7,877 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • Age 20–29: $86,102,381 personal-data-breach complaint losses (2025). (FBI IC3, Apr 2026)

Reports received by FBI IC3; not a prevalence estimate.

What did working-age complainants report about data breaches?

  • Age 20–29: 135 complaints in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 20–29: $4,158,310 losses in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 30–39: 13,238 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • Age 30–39: $173,434,730 personal-data-breach complaint losses (2025). (FBI IC3, Apr 2026)
  • Age 30–39: 443 complaints in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 30–39: $72,145,136 losses in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 40–49: 13,403 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • Age 40–49: $241,244,329 personal-data-breach complaint losses (2025). (FBI IC3, Apr 2026)
  • Age 40–49: 625 complaints in the separate Data Breach category (2025). (FBI IC3, Apr 2026)

Reports received by FBI IC3; not a prevalence estimate.

What losses and AI references appeared in breach complaints?

  • Age 40–49: $64,973,932 losses in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 50–59: 9,703 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • Age 50–59: $225,239,544 personal-data-breach complaint losses (2025). (FBI IC3, Apr 2026)
  • Age 50–59: 522 complaints in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • Age 50–59: $77,385,567 losses in the separate Data Breach category (2025). (FBI IC3, Apr 2026)
  • The separate Data Breach category recorded $435,240,992 in losses (2025). (FBI IC3, Apr 2026)
  • AI was referenced in 1,204 personal-data-breach complaints (2025). (FBI IC3, Apr 2026)
  • AI-linked personal-data-breach complaints reported $18,767,964 in losses (2025). (FBI IC3, Apr 2026)
  • People aged 60+ reported $324,470,413 in personal-data-breach losses (2025). (FBI IC3, Apr 2026)

Reports received by FBI IC3; not a prevalence estimate.

How do confirmed breaches start?

The route into an organisation counts because it changes the control that would have interrupted the attack. Contributed incident datasets show recurring mechanisms, but their mix of cases can change between editions.

How do UK attack exposure and breach entry routes differ?

  • 43% of businesses identified a cyber breach or attack (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 28% of charities identified a cyber breach or attack (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • 1% of businesses identified a ransomware attack (August–December 2025 fieldwork; prior 12 months for attacks). (UK DSIT and Home Office, Apr 2026)
  • Credential abuse accounted for 13% of initial breach access (November 2024–October 2025). (Verizon, May 2026)

Weighted organisational survey; attacks include unsuccessful attempts. Contributed incident corpus; not a random population sample. Publication date corroborated on Verizon release.

What did Verizon observe about remediation and ransom outcomes?

  • 26% of observed critical known-exploited vulnerabilities were fully remediated (November 2024–October 2025). (Verizon, May 2026)
  • Median full remediation time reached 43 days (November 2024–October 2025). (Verizon, May 2026)
  • 69% of ransomware victims in the dataset did not pay (November 2024–October 2025). (Verizon, May 2026)
  • The median ransom paid in the dataset was $139,875 (November 2024–October 2025). (Verizon, May 2026)

Contributed incident corpus; not a random population sample. Publication date corroborated on Verizon release. Remediation concerns vulnerabilities in the observed estate. Ransom outcomes concern incident victims. Neither is the probability that an arbitrary business will experience a breach. Their denominators remain specific to each part of the research.

How do Australians experience breach harm and responsibility?

The consequences of exposure extend beyond a notification letter. The survey ran from 16–30 March 2026; breach-awareness and notification questions refer to the preceding year. Self-reported distress, misuse and expectations of organisational accountability measure different parts of that experience. These findings describe surveyed Australians, and do not establish that every reported harm was caused by a particular breach.

How many Australians recognised breaches and reported consequences?

Australian survey; reported harms do not establish causation.

Which personal harms did notified Australians report?

Australian survey; reported harms do not establish causation.

Who did Australians hold responsible for organisational breaches?

Survey responses describe opinions, not findings of legal responsibility.

What did US breach notices reveal?

Victim notices count communications about exposure, not unique people. Keep reported compromises separate from the people or notifications linked to them. The accompanying consumer survey describes notice recipients and must be distinguished from the incident-tracking population.

How many US compromises and notifications did ITRC record?

Public notices tracked by ITRC; notification counts are not deduplicated people. A person can receive notifications from several organisations. Notification totals therefore measure reported exposure communications instead of a deduplicated population of victims.

What consequences did surveyed breach-notice recipients report?

Original SurveyMonkey survey of1040 US consumers, skewed tech-literate and mid/high-income; not a national prevalence estimate.

How did surveyed recipients respond to breach notices?

Original SurveyMonkey survey of1040 US consumers, skewed tech-literate and mid/high-income; not a national prevalence estimate.

Glossary

IC3
FBI Internet Crime Complaint Center.

Methodology and sources

Every figure on this page comes from the organisation that produced it: regulators, statistics offices, public bodies, research institutes, and companies reporting their own data or surveys. Each one links to the original report or dataset and carries its release date. Survey results keep their population and fieldwork period, and financial figures keep the measure the producer used. Figures from different producers are not added together or ranked against each other. The page is reviewed monthly and updated when a producer releases newer data.