Data Breaches in America Hit All-Time Record High in 2025

The number of U.S. organizations that reported a data breach last year reached an all-time high, fueling worries of “breach fatigue” by a jaded populace even as critics decry an increasingly lackadaisical approach to disclosure by corporations.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

An annual tally of breach data collated by the nonprofit Identity Theft Resource Center counted 3,322 American data breaches in 2025 – an increase of 4% from 2024, and up 79% compared to 2020.

Here’s what many attackers are targeting: Two-thirds of breach reports last year listed Social Security numbers as among the exposed information. One-third of breach notifications listed bank accounts, driver’s license numbers or both as being exposed.

Criminals prize “static identifiers that facilitate long-term identity fraud over easily replaceable data, such as credit card numbers,” ITRC said.

Financial services firms reported the greatest number of breaches, followed by the healthcare, professional services, manufacturing and education sectors. Eighty percent of organizations said a cyberattack was the breach culprit, followed distantly by companies fingering system or human error, physical attacks or supply chain attacks.

Breached organizations collectively issued about 279 million notifications to victims, down from 1.4 billion in 2024, the report says. That isn’t a complete count, as 8% of 2025 breach notices didn’t include a count of either victims or the number of notices issued. But the overall decline in notifications parallels a drop in the number of mega-breaches that occurred in 2025, compared to the prior year (see: Mega-Breaches Bump Up 2024 Victim Count).

All U.S. states and territories since 2018 have in place mandatory breach-notification rules, although they often differ. Many state laws don’t require a breach notification if the incident doesn’t meet a victim-count threshold or if the organization doesn’t believe the exposed data poses any risk to an individual.

The report says these organizations reported the five biggest breaches last year, based on the number of victim notifications they issued:

• PowerSchool: 71.9 million;
• AT&T data from 2021 exposed in 2025: 44 million;
• Aflac: 22.7 million;
• Prosper Funding: 17.6 million;
• Conduent Business Services: 14.8 million, although that preliminary count looks set to rise.

Rounding out the count of top 10 organizations reporting the most breaches, based on victim count: law firm Comyns, Smith, McCleary & Deaver, auto finance technology provider 700Credit, Yale New Haven Health System, UnitedHealth Group’s Episource and Blue Shield of California (see: 2025 in Health Data Breaches and Predictions for 2026).

The center found fewer mentions of ransomware in breach notifications, a consequence of a shift by cybercrime groups to stealing data without bothering to encrypt victim systems. Digital criminals are also combing previously exposed data to launch new attacks. “Hackers are using AI to repackage old stolen records to launch new attacks, including account takeover and new account creation,” its report says.

Supply-chain attacks as a culprit are on the rise, having doubled since 2021. Nearly one-third of breached organizations last year traced a breach to an incident at a third party.

One challenge repeatedly cited by security researchers and consumer advocates is a decrease in security incident transparency. Whereas nearly every U.S. breach notification in 2020 detailed an attack vector, the vast majority – 70% – of breach notifications in 2025 lacked such detail, the report says.

Of the 607 organizations that cited a cyberattack as the cause, 459 offered no further detail. For the 148 organizations that did, 15% blamed phishing, SMS phishing or business email compromise, 6% blamed ransomware, while nine organizations pointed to a zero-day attack, seven to malware and two to attackers exploiting an unpatched known vulnerability.

“We’re seeing less and less transparency, basically as a result of the judicial system in the United States, where we’re very litigious, and if you have a data breach, you’re pretty much guaranteed – if you’re an organization of any size – you’re going to be sued,” ITRC President James E. Lee told Information Security Media Group.

Many cases never go to trial, but still result in significant further expenses for a breached business. “So the advice that companies are given these days is, don’t share any information that you aren’t required to,” he said.

Survey Says: Consumers Seek Breach Details

Data breach notifications risk becoming background noise to doing business online.

Eighty percent of 1,040 U.S. consumers recently surveyed by the ITRC reported receiving at least one breach notice over the past 12 months, while 40% received three to five such notices. More than half of consumers reported experiencing anxiety or frustration as a result, not least over concerns that the breach might lead to fraud, and nearly half of surveyed individuals reported “breach fatigue.”

On the upside, after receiving a breach notification, 60% of consumers said that they changed their password for the affected account, 49% said they set also up a passkey – a security measure experts have been pushing more users to adopt – and 47% claimed to stop reusing passwords.

On the downside, 46% reported taking no action, “feeling there was nothing they could do that would help protect their personal data,” the ITRC said.

Consumers reported dissatisfaction with current breach notification requirements, not least for trying to ascertain what fraud or other risks they might face as a result.

Specifically, 75% said they want to see “a specific list of the personal data that was compromised,” the study found.