In 2023, the number of data compromises in the United States stood at 3,205 cases. Meanwhile, over 353 million individuals were affected in the same year by data compromises, including data breaches, leakage, and exposure. While these are three different events, they have one thing in common. As a result of all three incidents, the sensitive data is accessed by an unauthorized threat actor. Industries most vulnerable to data breaches Some industry sectors usually see more significant cases of private data violations than others. This is determined by the type and volume of the personal information organizations of these sectors store. In 2022, healthcare, financial services, and manufacturing were the three industry sectors that recorded most data breaches. The number of healthcare data breaches in the United States has gradually increased within the past few years. In the financial sector, data compromises increased almost twice between 2020 and 2022, while manufacturing saw an increase of more than three times in data compromise incidents. Largest data exposures worldwide In 2020, an adult streaming website, CAM4, experienced a leakage of nearly 11 billion records. This, by far, is the most extensive reported data leakage. This case, though, is unique because cyber security researchers found the vulnerability before the cyber criminals. The second-largest data breach is the Yahoo data breach, dating back to 2013. The company first reported about one billion exposed records, then later, in 2017, came up with an updated number of leaked records, which was three billion. In March 2018, the third biggest data breach happened, involving India’s national identification database Aadhaar. As a result of this incident, over 1.1 billion records were exposed.

During the third quarter of 2024, data breaches exposed more than 422 million records worldwide. Since the first quarter of 2020, the highest number of data records were exposed in the first quarter of 202, more than 818 million data sets. Data breaches remain among the biggest concerns of company leaders worldwide. The most common causes of sensitive information loss were operating system vulnerabilities on endpoint devices. Which industries see the most data breaches? Meanwhile, certain conditions make some industry sectors more prone to data breaches than others. According to the latest observations, the public administration experienced the highest number of data breaches between 2021 and 2022. The industry saw 495 reported data breach incidents with confirmed data loss. The second were financial institutions, with 421 data breach cases, followed by healthcare providers. Data breach cost Data breach incidents have various consequences, the most common impact being financial losses and business disruptions. As of 2023, the average data breach cost across businesses worldwide was 4.45 million U.S. dollars. Meanwhile, a leaked data record cost about 165 U.S. dollars. The United States saw the highest average breach cost globally, at 9.48 million U.S. dollars.

Between January and November 2023, California was the U.S. state with the highest number of reported data breach incidents targeting the government. In the measured period, the government agencies saw 16 cases of data breaches. Texas ranked second, with eight incidents. Overall, 137 cases of government data breaches were recorded in the United States.

In 2023, the healthcare industry in the United States remained the most targeted by cyber attacks, resulting in data compromises. Compared to 2022, the number of data compromise incidents in the U.S. healthcare industry increased more than twice. The financial services sector ranked second, with 744 data compromise incidents, representing a significant increase, too.

In 2023, around 96.75 million e-mail accounts breached originated from the United States, making it the country with the most significant number of user account exposures in the examined year. Russia ranked second, with over 78 million accounts breached, while the France followed, with approximately 10.5 million breached accounts.

In November 2023, around 11.5 million e-mail accounts of LinkedIn users were made available online, making it the most significant case of personal data compromise worldwide in 2023. This was followed by four Russian platforms, Chitai-gorod, Book24, Gloria Jeans, and SberSpasibo. As a result of these incidents, 20.2 million e-mail accounts were exposed.

As of 2024, the average cost of a data breach in the United States amounted to 9.36 million U.S. dollars, down from 9.48 million U.S. dollars in the previous year. The global average cost per data breach was 4.88 million U.S. dollars in 2024. Cost of a data breach in different countries worldwide Data breaches impose a big threat for organizations globally. The monetary damage caused by data breaches has increased in many markets in the past decade. In 2023, Canada followed the U.S. by data breach costs, with an average of 5.13 million U.S. dollars. Since 2019, the average monetary damage caused by loss of sensitive information in Canada has increased notably. In the United Kingdom, the average cost of a data breach in 2024 amounted to around 4.53 million U.S. dollars, while in Germany it stood at 5.31 million U.S. dollars. The cost of data breach by industry and segment Data breach costs vary depending on the industry and segment. For the fourth consecutive year, the global healthcare sector registered the highest costs of data breach, which in 2024 amounted to about nine million U.S. dollars. Financial institutions ranked second, with an average cost of six million U.S. dollars for a data breach. Detection and escalation was the costliest segment in data breaches worldwide, with 1.63 U.S. dollars on average. The cost for lost business ranked second, while response following a breach came across as the third-costliest segment.

The largest reported data leakage as of January 2024 was the Cam4 data breach in March 2020, which exposed more than 10 billion data records. The second-largest data breach in history so far, the Yahoo data breach, occurred in 2013. The company initially reported about one billion exposed data records, but after an investigation, the company updated the number, revealing that three billion accounts were affected. The National Public Data Breach was announced in August 2024. The incident became public when personally identifiable information of individuals became available for sale on the dark web. Overall, the security professionals estimate the leakage of nearly three billion personal records. The next significant data leakage was the March 2018 security breach of India's national ID database, Aadhaar, with over 1.1 billion records exposed. This included biometric information such as identification numbers and fingerprint scans, which could be used to open bank accounts and receive financial aid, among other government services.

Cybercrime - the dark side of digitalization As the world continues its journey into the digital age, corporations and governments across the globe have been increasing their reliance on technology to collect, analyze and store personal data. This, in turn, has led to a rise in the number of cyber crimes, ranging from minor breaches to global-scale attacks impacting billions of users – such as in the case of Yahoo. Within the U.S. alone, 1802 cases of data compromise were reported in 2022. This was a marked increase from the 447 cases reported a decade prior. The high price of data protection As of 2022, the average cost of a single data breach across all industries worldwide stood at around 4.35 million U.S. dollars. This was found to be most costly in the healthcare sector, with each leak reported to have cost the affected party a hefty 10.1 million U.S. dollars. The financial segment followed closely behind. Here, each breach resulted in a loss of approximately 6 million U.S. dollars - 1.5 million more than the global average.

Between November 2022 and October 2023, organizations in the education sector worldwide saw around 872 instances of data breaches caused by hacking. The professional industry ranked second, with 603 data breach cases in the measured period. Furthermore, hacking caused 598 data breach incidents in the finance sector.

Over 24 million data breaches were recorded in Russia between October and December 2023. In the first quarter of 2022, the data breach count exceeded 42.9 million, which was the highest figure over the observed period.

Between January 2014 and November 2023, the most significant data breach incident involving the U.S. government was the 2018 breach at the U.S. Postal Service. The incident compromised 60 million records. During the data breach incident at the Office of Personnel Management in 2015, 21.5 million data records were affected.

In 2023, the most significant healthcare data breach incident in the United States was the HCA Healthcare breach. The Nashville-based company is the largest health system in the United States. During the July 2023 breach, more than 180 U.S. hospitals and 2,300 healthcare sites reported about unauthorized access. The incident impacted 11.27 million individuals in the United States. Second-ranked PJ&A data breach impacted nearly nine million individuals.

Between November 2022 and October 2023, the education saw 860 data breach cases caused by system intrusion. Basic web application attacks resulted in 161 data breaches in the finance sector. Social engineering attacks caused 158 data breaches in the construction sector.

As of January 2025, the most significant data privacy violation fine worldwide was for social media giant Meta. In May 2023, the Data Protection Commission (DPC) of Ireland decided to fine the company with 1.2 billion euros or 1.3 billion U.S. dollars. The Chinese vehicle-for rent company Didi Global ranked second. In July 2022, China's data privacy regulator fined the company 8.026 billion Chinese yuan, or 1.19 billion U.S. dollars. The 2021 Amazon fine issued by Luxembourg's data privacy regulation authorities was 877 million U.S. dollars and was the third-biggest data breach fine as of the measured month. The 2019 fine of 575 million U.S. dollars to Equifax followed. In this incident, because of unpatched vulnerabilities, nearly 150 million people were affected, which caused the American consumer credit reporting agency to pay at least 575 million U.S. dollars.

Over 41,700 data breaches were recorded in Greece between October and December 2023. In the first quarter of 2021, the data breach count exceeded 2.1 million, which was the highest figure over the observed period.

As of the first quarter of 2023, the number of data breaches in Indonesia amounted to around 89.11 thousand records. During the observed period, the number of affected data points peaked in the third quarter of 2022, before decreasing significantly from the fourth quarter of 2022 onwards.

As of the third quarter of 2023, Russia was the market with the highest data breach density in the world. As of the examined quarter, the number of data points breached per thousand individuals in the country was 49. France ranked second, with 25 breached accounts per thousand people, followed by the United States, with 24 breached data points.

During the fourth quarter of 2024, data breaches exposed more than a million user data records in the United Kingdom (UK). The figure decreased significantly from nearly 41 million in the quarter prior. Overall, the time between the first quarter of 2022 and the fourth quarter of 2023, saw the lowest number of exposed user data accounts.

As of February 2024, the United States ranked first by the average cost of a data breach, 9.36 million U.S. dollars. The average cost of data breaches in the Middle East is 8.75 million U.S. dollars. Benelux followed in the ranking, with 5.9 million U.S. dollars. In the measured period, the global average data breach cost was 4.88 million U.S. dollars. Phishing scams in the U.S. Breached data often ends up in the hands of threat actors who use it for malicious purposes, including online scams. Phishing continues to be a major threat in North America, particularly on smartphones. In the second quarter of 2023, the region recorded the highest number of phishing and malicious attack attempts globally. The United States was particularly affected, with 45 percent of U.S. citizens reporting being targeted by scam texts, e-mails, and calls on a daily basis. Additionally, phishing and spoofing were the most common types of cybercrime, impacting 298 thousand individuals in 2023. These attacks led to financial losses, with U.S. victims reporting nearly 20 billion U.S. dollars in damages throughout the year. U.S. users and data privacy Despite only 20 percent of internet users in the United States being highly knowledgeable about data privacy and cybersecurity, a significant portion of users demonstrated caution and awareness in protecting their information. In fact, over half of surveyed U.S. users reported being somewhat confident in knowing the right steps to take in the event of a cyberattack. Furthermore, 43 percent of U.S. users actively decline cookies on websites, reflecting their increasing concern for data protection. Many respondents also take additional steps to safeguard their digital privacy, such as limiting or avoiding clicking on ads as well as not answering phone calls due to cybersecurity risks.

In a 2023 survey on cybersecurity readiness, 28 percent of the surveyed senior business, tech, and security executives in India claimed the damage caused by cyberattacks within their organizations over the past three years was worth between one and nine million U.S. dollars. Meanwhile, only seven percent of respondents attested to not having experienced any data breaches over that period. The rate of cybercrime in India has increased dramatically over the past few years.