The Uptime report

Author: chrisomo

  • CVE Statistics 2026: How Many Vulnerabilities Are Published Each Year, and Why the Count Keeps Climbing

    Uptime Report Research · Chart Essay

    CVE Statistics 2026: How Many Vulnerabilities Are Published Each Year, and Why the Count Keeps Climbing

    Original analysis of the NIST National Vulnerability Database · Last updated October 2026

    CVE statistics tell a simple story with a complicated footnote. The National Vulnerability Database published 49,972 CVEs in 2025, about 2.6 times the 19,222 published in 2020, and 2026 is running 103% ahead of 2025 with 74,838 through September 30, 2026. The footnote is that NIST itself now scores only a small fraction of new CVEs, which makes NVD-based counts of “critical” flaws badly misleading.

    CVEs published to the NVD per quarter04,0008,00012,00016,00020,00024,00028,00032,00036,00040,0002020202120222023202420252026Peak quarter: 37,712 (2026 Q3)NIST scores fewer new CVEs itselfBlue: all CVEs by publish date. Red: CVEs with a CVSS v3 severity of Critical. Last quarter partial (to 2026-10-03). Source: NIST NVD API 2.0. Analysis: The Uptime Report.

    How many CVEs are published each year?

    Year CVEs published CVSS v3 Critical CVSS v3 High
    2020 19,222 2,681 7,283
    2021 21,950 2,545 7,454
    2022 26,431 4,153 9,195
    2023 30,949 4,396 9,897
    2024 40,704 3,037 8,256
    2025 49,972 3,365 4,992
    2026* 75,746 2,098 5,048

    *2026 through 2026-10-03. Severity counts use the NVD API filter, which tracks NIST-assigned scores and is understated from 2024 onward; see below.

    The peak quarter in this period is 2026 Q3, with 37,712 CVEs. The 2026 increase was not a single bulk release: monthly publications rose every month from April (5,885) through May (6,985), June (8,001), July (9,919), and August (12,719) to September (15,074). In our August sample, the largest single publishing source accounted for about one in eight records.

    Why is the count rising?

    CVE counts depend on who assigns identifiers. The CVE Program’s published list of CVE Numbering Authorities, the organizations authorized to assign CVE IDs, has 554 entries, and 453 of them are classified as vendors, which assign identifiers to flaws in their own products. A rising count can therefore reflect more disclosure as well as more vulnerabilities, so the CVE total is a measure of disclosure activity as much as of risk.

    Why do critical counts fall while totals rise?

    Because NIST has stopped scoring most new CVEs itself. Each NVD record can carry a CVSS score from NIST (a “Primary” score) and scores supplied by the organization that published the CVE. We checked a sample of 2,000 CVEs published in the first quarter of 2023 and 2,000 published in August 2026. In 2023, 82% carried a NIST score. In August 2026, 10% did, and the most common NVD status was “Deferred”, meaning NIST has set the record aside without its own analysis.

    The effect on severity counts is large. In the August 2026 sample, 30 CVEs were rated Critical by NIST’s own scores, but 280 were rated Critical when scores from the publishing organizations are included. In the 2023 sample the two measures were close (379 and 413). The NVD API’s severity filter returned 403 Critical CVEs for the third quarter of 2026, a count consistent with NIST-assigned scores only.

    Practical consequence: a chart of “critical CVEs per year” built from the NVD severity filter shows a collapse in 2026 that reflects NIST’s scoring capacity, not safer software. Use scores from the publishing organization, or compare totals.

    What should IT teams take from this?

    The volume makes patch-everything impossible, and missing severity scores make severity alone an unreliable filter. Many teams pair CVSS with evidence of real-world exploitation, such as the CISA Known Exploited Vulnerabilities catalog, which lists only a small fraction of published CVEs. This is general context, not security advice for any environment.

    Frequently asked questions

    How many CVEs were published in 2025?

    49,972 CVEs were published to the NIST National Vulnerability Database in 2025, by publish date.

    How many CVEs have been published in 2026?

    74,838 through September 30, 2026, 103% more than in the same period of 2025.

    Is the number of vulnerabilities increasing?

    Yes. Annual CVE publications rose from 19,222 in 2020 to 49,972 in 2025, about 2.6 times as many.

    Why don’t severity counts track the total?

    NIST now assigns its own score to few new CVEs. In our samples, 82% of CVEs published in early 2023 carried a NIST score, versus 10% in August 2026; severity filters based on NIST scores therefore undercount.

    What is the NVD?

    The National Vulnerability Database, run by NIST, is the U.S. government repository of publicly disclosed vulnerabilities, keyed by CVE identifier.

    Should every CVE be patched immediately?

    No organization can patch everything at once. Many teams combine severity with evidence of exploitation, such as the CISA Known Exploited Vulnerabilities catalog, to set priorities. This is general context, not security advice.

    Download the data. nvd-cve-counts-by-quarter-2020-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. NIST National Vulnerability Database, CVE API 2.0, queried October 2026 by publish date (pubStartDate and pubEndDate) in calendar-quarter windows from January 2020 to 2026-10-03. Totals are the API’s totalResults for each window. Critical and High counts add the cvssV3Severity filter.

    Scoring sample. We retrieved the first 2,000 CVEs (by publish date) from the first quarter of 2023 and the first 2,000 from August 2026, and counted records with a CVSS v3 metric of type Primary (assigned by NIST), Critical ratings under Primary scores only and under any source, and the vulnStatus field. Samples cover the earliest-published records in each window and may not represent the full period.

    Limitations. CVE counts include rejected or disputed entries only where the API returns them by default. Severity counts reflect CVSS v3 only and miss CVEs scored solely under CVSS v4 or not yet scored. Totals reflect disclosure activity and CVE Numbering Authority growth, not a direct measure of software security.

    Not advice. This is published vulnerability data, not security advice.

    Cite as:The Uptime Report. "CVE Statistics 2026: How Many Vulnerabilities Are Published Each Year, and Why the Count Keeps Climbing." October 2026. https://theuptimereport.com/cve-statistics-2026/

    References

    1. NIST NVD, CVE API 2.0 documentation. Accessed October 2026.
    2. NIST National Vulnerability Database. Accessed October 2026.
    3. CVE Program, published CNA list (CNAsList.json). Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • The Tech Job Market in 2026: Openings, Quits, Hires, and Layoffs in the Information Sector

    Uptime Report Research · Labor Dashboard

    The Tech Job Market in 2026: Openings, Quits, Hires, and Layoffs in the Information Sector

    The tech job market in 2026 is slow on every side. Averaged over January through Aug 2026, the information sector posted openings at a lower rate than the economy as a whole, its workers quit and were hired at lower rates, and its layoff rate ran above the national rate, according to the Bureau of Labor Statistics Job Openings and Labor Turnover Survey.

    Information sector All employers (total nonfarm) · monthly, seasonally adjusted, January 2019 to Aug 2026

    Job openings rateAug 2026: 4.3%all employers: 4.3%2019202120232025
    Hires rateAug 2026: 1.6%all employers: 3.3%2019202120232025
    Quits rateAug 2026: 1.1%all employers: 1.9%2019202120232025
    Layoffs and discharges rateAug 2026: 1.0%all employers: 1.0%2019202120232025

    How far have tech job openings fallen?

    Monthly figures are volatile; the latest month can sit close to the national rate even when the year’s average does not. The information sector had 123 thousand job openings in Aug 2026, down 55% from its peak of 274 thousand in Apr 2022. Its openings rate averaged 3.09% in 2026 so far, against 4.36% for all employers. In 2022 the two were nearly equal (6.81% and 6.85%).

    Are tech workers staying put?

    Yes. The information sector quits rate averaged 1.15% in 2026, compared with 1.95% for all employers, and the hires rate averaged 2.61% against 3.31%. Low quits and low hires together describe a labor market where people hold onto jobs and few new positions open, often called a low-churn market.

    Are tech layoffs rising?

    The information sector layoffs and discharges rate averaged 1.74% in 2026 through Aug 2026, the highest annual average since 2020 (2.02%) and above the all-employer rate of 1.07%. In 2021 and 2022, the sector’s layoff rate was close to the national rate.

    Annual averages, 2019 to 2026

    Year Openings rate Hires rate Quits rate Layoffs rate
    Info All Info All Info All Info All
    2019 4.68 4.52 3.31 3.87 1.6 2.32 1.35 1.21
    2020 3.92 4.28 3.01 4.26 1.31 2.08 2.02 2.4
    2021 5.82 6.38 3.92 4.34 1.79 2.71 1.05 0.97
    2022 6.81 6.85 3.47 4.2 1.66 2.76 1.21 0.96
    2023 4.35 5.62 2.42 3.76 1.35 2.37 1.11 1.07
    2024 4.04 4.65 2.58 3.42 1.46 2.07 1.15 1.06
    2025 4.03 4.28 2.63 3.32 1.29 2.02 1.31 1.12
    2026* 3.09 4.36 2.61 3.31 1.15 1.95 1.74 1.07

    Percent, average of monthly seasonally adjusted rates. *2026 is January through Aug 2026; the latest month is preliminary.

    What this means for MSPs and IT employers

    A low-quit, low-hire market cuts both ways for managed service providers. Retention pressure is lower than in 2021 and 2022, and experienced candidates released by information sector layoffs are available. Note that JOLTS places most MSPs and IT consultancies in professional and business services rather than the information sector, so these figures describe the broader tech labor pool MSPs hire from, not MSP staffing directly.

    Frequently asked questions

    Is the tech job market getting better in 2026?

    Not by JOLTS measures. Through Aug 2026, the information sector’s 2026 average job openings rate was 3.09%, below the 4.36% for all employers, and its layoffs rate averaged 1.74%, above the 1.07% for all employers.

    How many tech job openings are there?

    The information sector had 123 thousand openings in Aug 2026, seasonally adjusted, down 55% from 274 thousand in Apr 2022.

    Are tech workers quitting less?

    Yes. The information sector’s quits rate averaged 1.15% in 2026, compared with 1.95% for all employers.

    Are tech layoffs rising?

    The information sector layoffs and discharges rate averaged 1.74% in 2026 so far, its highest annual average since 2020 and above the all-employer rate of 1.07%.

    What is the information sector in JOLTS?

    NAICS 51: publishing including software publishers, telecommunications, data processing and hosting, broadcasting, and other information services. It is the closest JOLTS industry to the tech sector but excludes computer systems design firms, which fall under professional and business services.

    Where does this data come from?

    The BLS Job Openings and Labor Turnover Survey (JOLTS), seasonally adjusted monthly estimates.

    Download the data. jolts-information-sector-2019-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. Bureau of Labor Statistics, Job Openings and Labor Turnover Survey (JOLTS), retrieved through the BLS Public Data API in October 2026. Series: JTS510000000000000 (information) and JTS000000000000000 (total nonfarm) for job openings rate, hires rate, quits rate, layoffs and discharges rate, and job openings level; professional and business services (JTS540099) is included in the download.

    Calculations. Annual figures are simple averages of monthly seasonally adjusted rates. The decline in openings compares the latest month with the series peak since January 2019.

    Limitations. JOLTS estimates are revised; the latest month is preliminary. The information sector (NAICS 51) is not the same as “tech”: it includes telecommunications and media and excludes computer systems design (NAICS 5415). Rates are national, not state-level.

    Not advice. This is published labor data, not career or hiring advice.

    Cite as:The Uptime Report. "The Tech Job Market in 2026: Openings, Quits, Hires, and Layoffs in the Information Sector." October 2026. https://theuptimereport.com/tech-job-market-2026-jolts/

    References

    1. BLS, Job Openings and Labor Turnover Survey. Accessed October 2026.
    2. BLS Public Data API. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • How Long Do Companies Take to Report a Data Breach? Evidence From 1,675 Washington Notices

    Uptime Report Research · Breach Anatomy

    How Long Do Companies Take to Report a Data Breach? Evidence From 1,675 Washington Notices

    How long do companies take to report a data breach? Longer every year. In notices filed with the Washington State Attorney General in 2025, the median time from discovering a breach to filing notice was 134 days, up from 36 days in 2020, and 87% of notices came more than 30 days after discovery, the window set by state law.

    134 daysmedian from discovery to notice, 2025 filings
    80%of all 1,652 timed notices filed after day 30
    16 daysmedian from breach start to discovery

    Anatomy of a typical breach notice (medians, all notices)16d68 days from discovery to noticeBreach begins → discovered after a median 16 days → notice filed a median 68 days after discoverySource: Washington State Office of the Attorney General, Data Breach Notifications dataset (updated 2026-10-04). Medians computed separately.

    What does Washington law require?

    Under RCW 19.255.010, notice to affected consumers must be made “in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered.” When more than 500 Washington residents are affected, the Attorney General must be notified within the same 30 days. Delays are permitted at the request of law enforcement or when needed “to determine the scope of the breach and restore the reasonable integrity of the data system.”

    Those exceptions matter for reading this data. A notice filed after day 30 is outside the default window, but this dataset does not record whether an exception applied, so it cannot show how many late notices were permitted.

    How long after discovery are breaches reported?

    Days from discovery to notice, all 1,652 notices with timing data33630 days or less43531 to 6020561 to 9035591 to 180245181 to 36576More than a yearBlue: within the statutory 30-day window. Red: beyond it (statutory exceptions may apply).

    Of 1,652 notices with timing data, 336 (20%) were filed within 30 days of discovery. 76 were filed more than a year after discovery.

    Is breach reporting getting slower?

    Median days from discovery to notice, by year notice was filed30-day statutory window44201936202072202183202267202311020241342025992026**2026 through 2026-10-04. Source: Washington AGO Data Breach Notifications.

    Year filed Notices Median days to notice Over 30 days Ransomware notices WA residents affected
    2019 60 44 68% 4 562,218
    2020 204 36 59% 117 4,789,657
    2021 186 72 80% 63 5,657,355
    2022 171 83 87% 56 4,260,467
    2023 253 67 85% 84 11,495,105
    2024 228 110 93% 110 7,217,047
    2025 209 134 87% 95 6,108,131
    2026 155 99 90% 63 1,958,301

    The median rose from 36 days in 2020 to 134 days in 2025. The slowdown is concentrated in ransomware notices. Their median went from 36 days in notices filed in 2020 and 2021 to 165 days in 2024 to 2026, while other cyberattacks moved from 74 to 84 days and non-cyber breaches from 63 to 74 days. Ransomware notices did not become more numerous; they became slower.

    Notice type Median days, filed 2020-2021 Median days, filed 2024-2026
    Ransomware 36 (n=176) 165 (n=268)
    Other cyberattacks 74 (n=133) 84 (n=166)
    Non-cyber (unauthorized access, theft, mistake) 63 (n=75) 74 (n=158)

    The dataset does not record why a notice took longer. A plausible reading is that ransomware with data theft now requires extended forensic review to establish which records were taken, which the statute’s scope exception allows, but that is an interpretation, not a measured cause. A single third-party incident can also generate many notices with similar timing and shift a period’s median.

    Which sectors take longest?

    Industry (as reported) Median days to notice, 2023 to 2026 Notices
    Business 104 355
    Health 86 205
    Finance 73 157
    Education 140 70
    Non-Profit/Charity 111 32
    Government 121 26

    What causes the breaches?

    1,207 of the 1,675 notices (72%) were cyberattacks, 377 unauthorized access, and 91 theft or mistake. Among cyberattacks, ransomware was the most common type (592), followed by malware (224) and phishing (112).

    Frequently asked questions

    How long do companies have to report a data breach in Washington?

    RCW 19.255.010 requires notice to affected consumers, and to the Attorney General when more than 500 Washington residents are affected, no more than 30 days after the breach is discovered, with exceptions for law enforcement requests and measures needed to determine the breach’s scope.

    How long do companies actually take to report breaches?

    In 2025 notices filed with the Washington Attorney General, the median was 134 days from discovery to notice, and 87% exceeded 30 days.

    Is reporting getting faster or slower?

    Slower. The median rose from 36 days for notices filed in 2020 to 134 days in 2025, driven mainly by ransomware notices, whose median went from 36 to 165 days.

    How long does it take to discover a breach?

    The median across Washington notices is 16 days from the start of the breach to discovery, with a long tail of breaches found months later.

    What causes most reported breaches?

    Cyberattacks, 1,207 of 1,675 notices; ransomware is the most common cyberattack type, with 592 notices.

    Does a notice after 30 days mean the company broke the law?

    Not necessarily. The statute allows delays requested by law enforcement and delays needed to determine the scope of the breach and restore system integrity. This data does not show which exception applied.

    Download the data. wa-breach-notification-timing-2015-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. Washington State Office of the Attorney General, “Data Breach Notifications Affecting Washington Residents” (data.wa.gov dataset sb4j-ca4h), 1,675 notices, data updated 2026-10-04, downloaded October 2026. Notices are required when more than 500 Washington residents are affected.

    Measures. “Days from discovery to notice” is the dataset’s dayselapsedbeforenotification field, which we confirmed equals the date the notice was submitted to the Attorney General minus the date the entity became aware of the breach, for all 1,652 records with both dates. “Days to discovery” is the dataset’s daystoidentifybreach field. Years refer to the year the notice was submitted.

    Limitations. Dates are self-reported by notifying entities. The dataset does not record whether a statutory exception applied, so “over 30 days” does not mean a violation. Only breaches affecting more than 500 Washington residents are included. 2026 is a partial year. We report aggregates only and make no characterization of any individual organization.

    Not advice. This is published government data, not legal advice.

    Cite as:The Uptime Report. "How Long Do Companies Take to Report a Data Breach? Evidence From 1,675 Washington Notices." October 2026. https://theuptimereport.com/how-long-companies-take-to-report-data-breaches/

    References

    1. Washington AGO, Data Breach Notifications Affecting Washington Residents. Accessed October 2026.
    2. RCW 19.255.010, Disclosure, notice. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • SEC Cybersecurity Incident Disclosures: Every Form 8-K Item 1.05 Filing Since 2023

    Uptime Report Research · Disclosure Tracker

    SEC Cybersecurity Incident Disclosures: Every Form 8-K Item 1.05 Filing Since 2023

    Since the SEC’s cybersecurity incident disclosure rule took effect on December 18, 2023, public companies have filed 58 original Form 8-K Item 1.05 disclosures of material cybersecurity incidents, from 57 different companies, through 2026-09-23. Filings slowed sharply after the SEC staff steered immaterial incidents elsewhere in May 2024, then picked up again in 2026.

    What we countedEvery Form 8-K and 8-K/A on SEC EDGAR whose official item list includes Item 1.05, deduplicated by accession number.
    What we found17 original filings in the first six and a half months, 24 in the following 18 months, and 14 in the second and third quarters of 2026 alone.
    What it meansItem 1.05 now tracks incidents companies judge material. It undercounts all public-company incidents by design.

    Original Item 1.05 filings per quarter (one dot per filing)May 21, 2024 SEC staff statement2023 Q422024 Q192024 Q262024 Q362024 Q432025 Q122025 Q262025 Q332025 Q442026 Q132026 Q272026 Q37Source: SEC EDGAR full-text search, filings tagged Item 1.05. 2023 Q4 covers December 18 to 31. Analysis: The Uptime Report.

    What is an Item 1.05 disclosure?

    Under rules adopted in July 2023, a public company must file a Form 8-K under Item 1.05 when it determines that a cybersecurity incident is material. The filing is generally due four business days after that determination. The requirement began on December 18, 2023, with smaller reporting companies given an additional 180 days.

    Why did filings fall after mid-2024?

    Early filers used Item 1.05 for incidents they had not yet judged material. On May 21, 2024, the SEC’s Director of Corporation Finance stated that the division encourages companies to disclose such incidents under a different item, for example Item 8.01. Original Item 1.05 filings went from 17 between December 2023 and June 2024 to 24 across July 2024 through December 2025. The drop reflects a narrower definition of what gets filed under Item 1.05, not necessarily fewer incidents.

    Is the pace rising again?

    Yes, modestly. There were 7 original filings in the second quarter of 2026 and 7 in the third, the highest two-quarter total since the first half of 2024. Because counts are small, a few filings move the trend.

    Which industries and states file most?

    SIC code Industry Original filings
    3841 Surgical and medical instruments 5
    7372 Prepackaged software 4
    6022 State commercial banks 4
    4813 Telephone communications 2
    7389 Business services, not elsewhere classified 2

    By business address, the most common states are CA (10), WA (7), TX (7), PA (6), FL (3). Medical device makers, software companies, and banks lead, but no single industry dominates: the 58 filings span 44 SIC codes.

    How often are disclosures amended?

    Companies filed 26 Item 1.05 amendments. The median gap between a company’s previous filing and its amendment was 22 days. The rule expects companies to amend once information that was not available at the time of the original filing becomes known, such as the incident’s financial impact.

    Every original Item 1.05 filing, by quarter

    Each entry links to the filing on SEC EDGAR. The list is a neutral record of public filings.

    2026 Q3 7

    2026 Q2 7

    2026 Q1 3

    2025 Q4 4

    2025 Q3 3

    2025 Q2 6

    2025 Q1 2

    2024 Q4 3

    2024 Q3 6

    2024 Q2 6

    2024 Q1 9

    2023 Q4 2

    Frequently asked questions

    What is Form 8-K Item 1.05?

    A disclosure requirement, effective December 18, 2023, under which public companies must report a cybersecurity incident they determine to be material, generally within four business days of that determination.

    How many companies have filed an Item 1.05?

    58 original Item 1.05 filings by 57 companies from December 18, 2023 through 2026-09-23, per SEC EDGAR.

    Why did Item 1.05 filings drop in 2025?

    After a May 21, 2024 SEC staff statement, companies were encouraged to report incidents not yet determined to be material under Item 8.01 instead. Item 1.05 counts after mid-2024 therefore reflect a narrower set of incidents.

    How often do companies amend Item 1.05 filings?

    26 amendments (8-K/A) were filed, a median of 22 days after the company’s prior filing; the rule expects amendments as information that was unavailable becomes known.

    Which industries file the most?

    The most common SIC code among filers is 3841 (Surgical and medical instruments), with 5 filings.

    Does an Item 1.05 filing mean a company did something wrong?

    No. It means the company determined an incident was material to investors. It is a disclosure, not a finding of fault.

    Download the data. sec-8k-item-105-cyber-disclosures.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. SEC EDGAR full-text search for “Item 1.05” across forms 8-K and 8-K/A, retrieved October 2026. A filing was included only if Item 1.05 appears in its official item list. Results were deduplicated by accession number, since search returns individual documents.

    Coverage. December 18, 2023 through 2026-09-23. 58 original filings and 26 amendments.

    Limitations. Item 1.05 captures only incidents a company deems material. Incidents disclosed under Item 8.01, in periodic reports, or not at all are excluded. Industry uses the filer’s primary SIC code. Foreign private issuers reporting on Form 6-K are excluded.

    Not advice. This is a record of public filings, not legal or investment advice, and inclusion implies no wrongdoing.

    Update cadence. Rechecked against EDGAR monthly. Last checked October 2026.

    Cite as:The Uptime Report. "SEC Cybersecurity Incident Disclosures: Every Form 8-K Item 1.05 Filing Since 2023." October 2026. https://theuptimereport.com/sec-cybersecurity-incident-disclosures-8k-item-105/

    References

    1. SEC press release 2023-139, cybersecurity disclosure rules. Accessed October 2026.
    2. SEC, statement on disclosure of cybersecurity incidents, May 21, 2024. Accessed October 2026.
    3. SEC EDGAR full-text search. Accessed October 2026.
    4. SEC, Standard Industrial Classification code list. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • IT Salaries by State: Security, Support, and Network Pay in 2026

    Uptime Report Research · Pay Matrix

    IT Salaries by State: Security, Support, and Network Pay in 2026

    BLS OEWS, May 2025 estimates
    Last updated October 2026

    IT salaries by state vary by nearly two to one. Information security analysts earn the most, with state medians from $81,950 in Montana to $154,940 in Washington. Computer user support specialists, the help desk role, range from $46,360 in Arkansas to $80,950 in the District of Columbia, according to Bureau of Labor Statistics May 2025 data.

    Security analysts, median of state medians: $117,205Help desk: $59,860Typical yearly raise in state medians: about 3%Security-to-help-desk pay ratio: 1.4x to 2.5x

    Pay ladder: lowest and highest paying state by role (median, May 2025)SecurityMontana $81,950Washington $154,940SysadminWest Virginia $74,490Maryland $118,290Network supportWest Virginia $46,840Washington $101,750Help deskArkansas $46,360District of Columbia $80,950White dot = median of state medians. Source: BLS OEWS May 2025, 50 states and DC. Analysis: The Uptime Report.

    What do IT jobs pay in each state?

    The matrix shows the May 2025 median annual wage for four IT occupations in every state. Darker cells are higher relative to other states for the same role, so color compares states within a column, not roles against each other.

    State Security Sysadmin Network support Help desk
    Alabama $122k $81k $61k $49k
    Alaska $114k $97k $86k $63k
    Arizona $125k $90k $68k $61k
    Arkansas $103k $81k $59k $46k
    California $138k $106k $79k $79k
    Colorado $135k $103k $82k $71k
    Connecticut $130k $105k $81k $70k
    Delaware $137k $94k $60k $62k
    District of Columbia $135k $110k $91k $80k
    Florida $124k $95k $75k $58k
    Georgia $128k $97k $79k $60k
    Hawaii $126k $101k $83k $56k
    Idaho Not published $91k $63k $59k
    Illinois $124k $100k $68k $59k
    Indiana $101k $84k $73k $56k
    Iowa $119k $84k $64k $58k
    Kansas $100k $83k $60k $56k
    Kentucky $103k $87k Not published $57k
    Louisiana $92k $90k $58k $52k
    Maine $101k $83k $72k $60k
    Maryland $139k $118k $96k $64k
    Massachusetts $136k $110k $88k $75k
    Michigan $106k $92k $65k $56k
    Minnesota $130k $101k $76k $63k
    Mississippi $87k $79k $63k $52k
    Missouri $103k $80k $72k $59k
    Montana $81k $80k $61k $58k
    Nebraska $92k $84k $65k $60k
    Nevada $106k $103k $85k $57k
    New Hampshire $124k $100k $72k $60k
    New Jersey $134k $116k $87k $64k
    New Mexico $130k $90k $64k $53k
    New York $134k $105k $77k $72k
    North Carolina $131k $95k Not published $60k
    North Dakota $107k $86k $73k $61k
    Ohio $110k $97k $70k $59k
    Oklahoma $94k $83k $78k $52k
    Oregon Not published $102k $68k $62k
    Pennsylvania $117k $86k $78k $58k
    Rhode Island $109k $103k $82k $62k
    South Carolina $105k $92k $76k $52k
    South Dakota $116k $75k $53k $48k
    Tennessee $115k $88k $77k $55k
    Texas $129k $101k $66k $59k
    Utah $99k $95k Not published $61k
    Vermont $109k $86k $72k $63k
    Virginia $134k $109k $76k $65k
    Washington $154k $103k $101k $75k
    West Virginia Not published $74k $46k $55k
    Wisconsin $101k $83k $81k $58k
    Wyoming $98k $75k $61k $65k

    Median annual wage, all industries. “Not published” means BLS withheld the estimate.

    Highest and lowest paying states by role

    Role Highest median Lowest median Median of states Typical change since May 2024 States
    Information security analysts Washington ($154,940) Montana ($81,950) $117,205 +2.7% 36 up / 11 down
    Network and computer systems administrators Maryland ($118,290) West Virginia ($74,490) $92,750 +3.2% 39 up / 12 down
    Computer network support specialists Washington ($101,750) West Virginia ($46,840) $73,045 +3.5% 33 up / 14 down
    Computer user support specialists District of Columbia ($80,950) Arkansas ($46,360) $59,860 +3.2% 42 up / 9 down

    Did IT pay rise in 2025?

    In most states, yes. Comparing May 2025 with May 2024 state medians, the typical state saw security analyst pay change +2.7%, sysadmin pay +3.2%, network support +3.5%, and help desk +3.2%. Help desk pay rose in 42 states and fell in 9. Single-year state medians move with sample changes, so a decline in one state is not by itself evidence of falling pay there.

    How wide is the security premium?

    In every state with both estimates, security analysts out-earn help desk staff by a wide margin. The ratio of the two medians ranges from 1.40 in Montana to 2.47 in Alabama. For a managed service provider, that premium is the cost of moving a client from help desk support to managed security, and it varies by market.

    Frequently asked questions

    Which state pays the most for cybersecurity analysts?

    Washington, with a median of $154,940 for information security analysts in May 2025 (BLS).

    Which state pays the most for IT support?

    the District of Columbia, with a median of $80,950 for computer user support specialists in May 2025 (BLS).

    Did IT salaries go up in 2025?

    Mostly yes. Across states, the median change in median pay from May 2024 to May 2025 was +2.7% for security analysts and +3.2% for help desk roles.

    How much more do security analysts earn than help desk staff?

    Between 1.4 and 2.5 times as much, depending on the state; the widest gap is in Alabama.

    Why are some states missing values?

    BLS does not publish estimates that fail its reliability or confidentiality standards; those cells are marked not published.

    Where does this data come from?

    The BLS Occupational Employment and Wage Statistics program, May 2025 state estimates, released in 2026.

    Download the data. it-wages-by-state-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics (OEWS), state estimates for May 2025 and May 2024, downloaded October 2026 (files state_M2025_dl and state_M2024_dl).

    Occupations. SOC 15-1212 information security analysts, 15-1244 network and computer systems administrators, 15-1231 computer network support specialists, 15-1232 computer user support specialists. All industries, all ownerships.

    Derived metrics. “Median of states” is the median of the 50 state and DC medians, not a national median. Year-over-year change compares each state’s May 2025 and May 2024 medians. The security-to-help-desk ratio divides the two state medians.

    Limitations. OEWS medians are survey estimates with sampling error. BLS suppresses some state estimates (15-1212: Idaho, Oregon, 15-1244: none, 15-1231: Kentucky, North Carolina, Utah, 15-1232: none). Territories are excluded from rankings but included in the download. Wages are not adjusted for cost of living.

    Not advice. This is published wage data, not salary or career advice.

    Cite as:The Uptime Report. "IT Salaries by State: Security, Support, and Network Pay in 2026." October 2026. https://theuptimereport.com/it-salaries-by-state-2026/

    References

    1. BLS, OEWS tables and downloadable data. Accessed October 2026.
    2. BLS, OEWS national estimates and methodology. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • HIPAA Enforcement Tracker: Every OCR Penalty and Settlement, 2016 to 2026

    Uptime Report Research · Enforcement Ledger

    HIPAA Enforcement Tracker: Every OCR Penalty and Settlement, 2016 to 2026

    HIPAA enforcement by the HHS Office for Civil Rights reached a record 25 actions in 2025, and 17 of those 25 were announced as ransomware, hacking, phishing, or Security Rule cases. Penalties are also getting smaller: the median verified amount fell from $1,600,000 in 2016 to 2019 to $240,000 in 2024 to 2026, a decline of 85%.

    Every amount checked against the HHS source document · Ledger last checked October 2026

    162OCR resolution agreements and civil money penalties listed since July 2008
    25actions in 2025, the most of any year
    85%lower median amount, 2024-2026 vs 2016-2019
    14actions naming ransomware since the first on 2023-10-31

    OCR enforcement actions per year (bars) and median amount (below)122016$2,200k102017$2,300k82018$999k112019$1,600k152020$160k102021$70k72022$301k142023$80k152024$250k252025$225k62026$450k2026 through September 17. Medians use verified amounts only. Source: HHS OCR resolution agreements and civil money penalties list.

    How has HIPAA enforcement changed?

    OCR now brings more cases with smaller amounts. Between 2016 and 2019, the median verified HIPAA settlement or penalty was $1,600,000 (n=39). Between 2024 and 2026, it was $240,000 (n=37). Total dollars collected peaked in 2018 at $25,635,400, the year of the $16 million Anthem settlement, while 2025 produced the most actions on record with $8,580,316 in verified amounts.

    Part of the volume increase comes from OCR initiatives that target specific obligations at scale, first patient right of access and, more recently, ransomware and Security Rule cases. These initiatives produce many smaller resolutions rather than a few large ones.

    Is ransomware driving HIPAA enforcement?

    Increasingly, by OCR’s own announcements. The first enforcement action with “ransomware” in its HHS title was announced on 2023-10-31. Since then, 14 actions have named ransomware. In 2025, 17 of 25 actions were announced as ransomware, hacking, phishing, or Security Rule cases.

    Why this matters for providers and their IT partners. We were able to read the full resolution documents for three of the ransomware actions (October 2023, May 2025, and July 2026). All three cite the HIPAA Security Rule risk analysis requirement. For an MSP serving healthcare, a documented, current risk analysis is the control the public record points to most directly. This is an observation from the public record, not legal advice.

    Year-by-year summary

    Year Actions With verified amount Total verified Median Security-named
    2016 12 10 $21,919,600 $2,200,000 1
    2017 10 10 $17,250,418 $2,300,000 0
    2018 8 8 $25,635,400 $999,000 0
    2019 11 11 $15,285,000 $1,600,000 0
    2020 15 14 $13,418,400 $160,000 2
    2021 10 9 $5,650,000 $70,000 1
    2022 7 4 $1,218,640 $300,640 1
    2023 14 13 $2,966,500 $80,000 3
    2024 15 11 $8,723,265 $250,000 8
    2025 25 20 $8,580,316 $225,000 17
    2026 6 6 $2,007,250 $450,000 2

    “Security-named” counts actions whose HHS title names ransomware, phishing, hacking, cybersecurity, malware, a malicious insider, or the Security Rule. Older HHS titles named causes less consistently, so this column is not comparable across the full period.

    The ledger: every action since January 2024

    Each entry links to the HHS source document. Rows with a red edge were announced as security cases.

    Date Action (HHS title) Amount Evidence
    2026-09-17 Ambry Genetics to Pay $700,000 After Phishing Attack Exposed 225,000 Patients’ Health Data $700,000 Verified in agreement text
    2026-08-27 HHS’ Office for Civil Rights Settles HIPAA Right of Access Investigation with Azul Vision, Inc. $50,000 Verified in agreement text
    2026-07-29 HHS’ Office for Civil Rights Settles Ransomware Investigation with Healthcare System $552,250 Verified in agreement text
    2026-05-20 Spencer Gifts LLC Resolution Agreement $450,000 Verified in agreement text
    2026-03-05 HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach $10,000 Verified in agreement text
    2026-01-22 SG Health Plan Resolution Agreement and Corrective Action Plan $245,000 Verified in agreement text
    2025-12-18 Consociate, Inc. Resolution Agreement and Corrective Action Plan $225,000 Verified in agreement text
    2025-12-05 Assured Imaging Resolution Agreement and Corrective Action Plan $375,000 Verified in agreement text
    2025-08-28 Regional Women’s Health Group, LLC Resolution Agreement and Corrective Action Plan $320,000 Verified in agreement text
    2025-08-18 HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP $175,000 Verified in agreement text
    2025-07-23 HHS’ Office for Civil Rights Settles HIPAA Ransomware Investigation with Syracuse ASC $250,000 Verified in agreement text
    2025-07-07 HHS’ Office for Civil Rights Settles HIPAA Privacy and Security Rule Investigation with a Behavioral Health Provider Not quantified Not quantified (no amount in source text)
    2025-06-06 Top of the World Ranch Treatment Center, LLC Resolution Agreement $103,000 Verified in agreement text
    2025-05-30 HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Comstar, LLC $75,000 Verified in agreement text
    2025-05-28 HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with a Florida Health Care Provider $800,000 Verified in agreement text
    2025-05-15 HHS Office for Civil Rights Settles HIPAA Cybersecurity Investigation with Vision Upright MRI $25,000 Verified in agreement text
    2025-04-30 Concentra Settlement Agreement $112,500 Verified in agreement text
    2025-04-25 HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Neurology Practice $25,000 Verified in agreement text
    2025-04-23 HHS Office for Civil Rights Settles Phishing Attack Breach with Health Care Network for $600,000 $600,000 Verified in agreement text
    2025-04-22 Cadia Rehabilitation Resolution Agreement $182,000 Verified in agreement text
    2025-04-17 HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Public Hospital $25,000 Verified in agreement text
    2025-04-04 HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with Northeast Radiology $350,000 Verified in agreement text
    2025-03-21 HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Health Fitness Corporation $227,816 Verified in agreement text
    2025-03-06 HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records $200,000 Verified in agreement text
    2025-02-20 HHS Office for Civil Rights Imposes a $1,500,000 Civil Money Penalty Against Warby Parker in HIPAA Cybersecurity Hacking Investigation $1,500,000 Verified in agreement text
    2025-01-15 HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $10,000 $10,000 Verified in agreement text
    2025-01-15 HHS Office for Civil Rights Settles HIPAA Case Against Memorial Healthcare System Over Patient Access to Records Not quantified Not quantified (source archived)
    2025-01-14 HHS Office for Civil Rights Settles HIPAA Phishing Cybersecurity Investigation with Solara Medical Supplies, LLC for $3,000,000 $3,000,000 Stated in HHS headline
    2025-01-08 HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with USR Holdings, LLC Concerning the Deletion of Electronic Protected Health Information Not quantified Not quantified (source archived)
    2025-01-07 HHS Office for Civil Rights Settles 9th Ransomware Investigation with Virtual Private Network Solutions Not quantified Not quantified (source archived)
    2025-01-07 HHS Office for Civil Rights Settles 8th Ransomware Investigation with Elgon Information Systems Not quantified Not quantified (source archived)
    2024-12-10 HHS Office for Civil Rights Settles with Health Care Clearinghouse, Inmediata Health Group, Over HIPAA Impermissible Disclosure Not quantified Not quantified (source archived)
    2024-12-05 HHS Office for Civil Rights Imposes a $548,265 Penalty Against Children’s Hospital Colorado for HIPAA Privacy and Security Rules Violations $548,265 Stated in HHS headline
    2024-12-03 HHS Office for Civil Rights Imposes a $1.19 Million Penalty Against Gulf Coast Pain Consultants for HIPAA Security Rule Violations $1,190,000 Stated in HHS headline
    2024-11-26 HHS Office for Civil Rights Settles with Holy Redeemer Family Medicine Over Disclosure of Patient’s Protected Health Information, Including Reproductive Health Information Not quantified Not quantified (source archived)
    2024-11-19 HHS Office for Civil Rights Imposes a $100,000 Penalty Against Mental Health Center for Failure to Provide Timely Access to Patient Records $100,000 Verified in agreement text
    2024-10-31 HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $90,000 $90,000 Verified in agreement text
    2024-10-31 HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation for $500,000 $500,000 Verified in agreement text
    2024-10-17 HHS Office for Civil Rights Imposes a $70,000 Civil Monetary Penalty Against Gums Dental Care for Failure to Provide Timely Access to Patient Records $70,000 Verified in agreement text
    2024-10-03 HHS Office for Civil Rights Imposes a $240,000 Civil Monetary Penalty Against Providence Medical Institute in HIPAA Ransomware Cybersecurity Investigation $240,000 Verified in agreement text
    2024-09-26 HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation under HIPAA Security Rule for $250,000 $250,000 Verified in agreement text
    2024-07-01 HHS Office for Civil Rights Settles HIPAA Security Rule Failures for $950,000 $950,000 Stated in HHS headline
    2024-04-01 HHS OCR Imposes a CMP on NJ Nursing Facility for Failing to Provide Timely Access to Patient Records Not quantified Not quantified (source shows proposed amount only)
    2024-03-29 HHS’ OCR Settles HIPAA Investigation with Phoenix Healthcare $35,000 Verified in agreement text
    2024-03-05 HHS OCR Work with Hospital to Improve Access to Kosher Electronic Devices Use for Virtual Patient Visitation Non-monetary Verified in agreement text
    2024-02-06 HHS’ Office for Civil Rights Settles Malicious Insider Cybersecurity Investigation for $4.75 Million $4,750,000 Verified in agreement text

    The full ledger back to 2008 is in the downloadable dataset below.

    Frequently asked questions

    How many HIPAA enforcement actions were there in 2025?

    25, the highest annual count on the HHS OCR resolution agreements and civil money penalties list.

    What is the average HIPAA penalty?

    The median verified amount for 2024 to 2026 was $240,000. Medians are more representative than averages because a few large settlements skew the mean.

    What is the largest HIPAA settlement?

    Anthem’s $16 million settlement in October 2018, after what HHS described as the largest health data breach in history, which exposed the electronic protected health information of almost 79 million people.

    Does OCR penalize ransomware victims?

    OCR has resolved 14 investigations naming ransomware since October 2023. In the three ransomware resolution documents we could read in full, OCR cited the Security Rule risk analysis requirement rather than the attack itself.

    How often does OCR announce enforcement actions?

    Irregularly; 2025 averaged about two a month.

    Where does this data come from?

    The HHS Office for Civil Rights list of resolution agreements and civil money penalties, and the agreement documents linked from it.

    Why are some amounts “not quantified”?

    Some source pages have moved to an archive service, some are scanned images, and some announcements bundle several cases. We report an amount only when it appears in an HHS source we could read.

    Is this legal advice?

    No. It is a record of public enforcement data.

    Methodology

    Source. HHS Office for Civil Rights, “Resolution Agreements and Civil Money Penalties” list, retrieved October 2026, and each linked agreement or press release. 162 enforcement entries were extracted after removing one regulatory fact sheet and one duplicate listing of the same Montefiore settlement.

    Amounts. An amount is recorded only if it appears in an HHS headline or in the binding text of the linked document (“Resolution Amount”, “Settlement Amount”, or “agreed to pay”). Proposed penalties later reduced or settled were replaced with the final amount. Amounts not found in a readable HHS source are marked “not quantified”.

    Not quantified since 2024 (8): 2025-07-07 HHS’ Office for Civil Rights Settles HIPAA Privacy and Security Rule I; 2025-01-15 HHS Office for Civil Rights Settles HIPAA Case Against Memorial Health; 2025-01-08 HHS Office for Civil Rights Settles HIPAA Security Rule Investigation ; 2025-01-07 HHS Office for Civil Rights Settles 9th Ransomware Investigation with ; 2025-01-07 HHS Office for Civil Rights Settles 8th Ransomware Investigation with ; 2024-12-10 HHS Office for Civil Rights Settles with Health Care Clearinghouse, In; 2024-11-26 HHS Office for Civil Rights Settles with Holy Redeemer Family Medicine; 2024-04-01 HHS OCR Imposes a CMP on NJ Nursing Facility for Failing to Provide Ti.

    Limitations. The list covers formal resolutions and penalties only; most OCR investigations close with technical assistance and do not appear. Medians exclude unquantified actions. Headline-based categories understate security cases in earlier years.

    Update cadence. This ledger is rechecked when OCR announces new actions. Last checked October 2026.

    Cite as:The Uptime Report. "HIPAA Enforcement Tracker: Every OCR Penalty and Settlement, 2016 to 2026." October 2026. https://theuptimereport.com/hipaa-enforcement-tracker-2026/

    Download the data. hipaa-enforcement-actions-2008-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    References

    1. HHS OCR, Resolution Agreements and Civil Money Penalties. Accessed October 2026.
    2. HHS OCR, Anthem resolution agreement. Accessed October 2026.
    3. HHS, The HIPAA Security Rule. Accessed October 2026.
    4. Individual agreement documents, linked in the ledger above. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • IT Services Firms by State: A Census Atlas of the Managed IT Industry

    Uptime Report Research · State Atlas

    IT Services Firms by State: A Census Atlas of the Managed IT Industry

    The United States had 145,813 computer services establishments in 2023, employing 2,050,626 people at an average annual pay of $122,296, according to Census Bureau County Business Patterns. The firms are heavily concentrated: Virginia, Maryland, and the District of Columbia lead on density, while the category closest to managed service providers shrank 7.2% in a single year.

    Original analysis of U.S. Census Bureau data · Last updated October 2026

    145,813computer services establishments, 2023 (NAICS 5415)
    43.3establishments per 100,000 U.S. residents
    $122,296average annual pay per employee
    -7.2%change in computer facilities management firms (NAICS 541513), 2022 to 2023

    Computer services establishments per 100,000 residents, 2023AK26ME28VT40NH47WA47ID33MT35ND23MN48IL48WI29MI30NY39RI33MA47OR34NV42WY82SD28IA22IN26OH29PA34NJ68CT35CA53UT47CO72NE33MO27KY20WV14VA108MD84DE136AZ35NM22KS33AR18TN21NC37SC24DC122OK22LA18MS13AL21GA51HI28TX48FL45under 2525 to 3535 to 5050 to 8080 and over

    Source: U.S. Census Bureau, County Business Patterns 2023; population from Census Vintage 2024 estimates (July 1, 2023). Analysis: The Uptime Report.

    Where are IT services firms most concentrated?

    Measured per resident, the densest IT services markets are Delaware (135.8 establishments per 100,000 residents), District of Columbia (122.1), and Virginia (108.1), against a national figure of 43.3. The cluster around Washington, D.C. reflects federal contracting, which supports a large base of systems integrators and managed IT providers. Delaware’s high ratio comes from a small population; it has 1,407 establishments in total. At the other end, Mississippi has 12.6 establishments per 100,000 residents, about one tenth of the leading state’s density.

    Most establishments (total)

    1. California: 20,696
    2. Texas: 14,905
    3. Florida: 10,395
    4. Virginia: 9,439
    5. New York: 7,670

    Highest average pay

    1. California: $167,821
    2. Massachusetts: $157,013
    3. Delaware: $140,102
    4. New York: $132,834
    5. Washington: $131,659

    How much do IT services employers pay by state?

    Average annual pay in computer services ranges from $167,821 in California to $68,177 in Mississippi, a ratio of 2.5 to 1. The national average is $122,296. These figures are total annual payroll divided by employees, so they include all roles from technicians to executives and are not comparable to occupation-specific wage data.

    Is the MSP segment consolidating?

    The Census code closest to managed service providers, NAICS 541513 (computer facilities management services), fell from 6,872 establishments in 2022 to 6,374 in 2023, a decline of 7.2%. Over the same period, NAICS 541519 (other computer related services) grew 10.7% and NAICS 541512 (computer systems design) changed -0.3%. The broad computer services sector was nearly flat at +0.4%.

    The decline was broad: 43 of 51 jurisdictions recorded fewer 541513 establishments. The largest losses were in California (-92), Florida (-72), Virginia (-40), Maryland (-40).

    One reading is consolidation, as acquisitions absorb independent providers. The data cannot confirm that on its own: establishment counts also move when businesses reclassify between codes, and some of the 541519 growth may be the same firms reporting differently. Treat this as a signal worth watching, not proof of consolidation.

    Full state table

    # State Establishments Per 100k residents Employees Avg annual pay Change 2022-23 NAICS 541513 (chg)
    1 Delaware 1,407 135.8 11,143 $140,102 +14.8% 23 (-1)
    2 District of Columbia 839 122.1 15,625 $117,080 -4.9% 30 (-9)
    3 Virginia 9,439 108.1 204,399 $118,876 +0.9% 355 (-40)
    4 Maryland 5,227 84.1 86,551 $115,750 -0.6% 236 (-40)
    5 Wyoming 477 81.5 1,554 $86,283 +12.5% 17 (-3)
    6 Colorado 4,264 72.3 55,523 $120,866 -1.2% 145 (-27)
    7 New Jersey 6,369 67.9 85,654 $112,797 -0.7% 269 (-26)
    8 California 20,696 52.8 299,029 $167,821 -0.8% 594 (-92)
    9 Georgia 5,655 51.1 92,751 $111,930 +2.6% 248 (+1)
    10 Texas 14,905 48.5 192,176 $120,677 +6.2% 499 (-25)
    11 Minnesota 2,767 48.1 29,258 $110,784 -3.5% 124 (-12)
    12 Illinois 6,023 47.6 80,067 $124,318 -1.9% 354 (-3)
    13 New Hampshire 658 46.9 7,686 $131,316 -1.6% 34 (-2)
    14 Utah 1,614 46.9 22,942 $98,991 -1.6% 52 (-16)
    15 Washington 3,684 46.9 53,995 $131,659 -1.8% 119 (-4)
    16 Massachusetts 3,291 46.6 63,043 $157,013 -2.7% 134 (-5)
    17 Florida 10,395 45.4 96,162 $103,965 -0.6% 461 (-72)
    18 Nevada 1,360 42.3 8,438 $113,472 +1.1% 58 (-1)
    19 Vermont 263 40.5 1,946 $104,709 -3.7% 14 (-5)
    20 New York 7,670 38.9 90,348 $132,834 -1.8% 300 (-24)
    21 North Carolina 4,038 37.1 49,873 $114,104 +5.4% 156 (-12)
    22 Connecticut 1,278 35.1 20,869 $115,750 +2.3% 53 (-8)
    23 Arizona 2,608 34.9 34,181 $109,374 +2.3% 116 (-17)
    24 Montana 394 34.8 2,842 $101,437 -3.4% 22 (-3)
    25 Pennsylvania 4,404 33.8 68,334 $105,825 +0.2% 222 (-5)
    26 Oregon 1,425 33.5 11,651 $112,554 -2.9% 67 (-1)
    27 Rhode Island 368 33.4 6,760 $118,383 -5.4% 21 (-4)
    28 Idaho 648 32.9 4,097 $86,254 +0.8% 34 (-2)
    29 Kansas 972 32.9 12,311 $92,327 +2.0% 73 (+2)
    30 Nebraska 649 32.6 9,689 $79,638 +2.5% 26 (-3)
    31 Michigan 3,049 30.2 45,856 $102,798 +0.4% 243 (+11)
    32 Ohio 3,456 29.2 50,324 $104,630 +0.7% 175 (-18)
    33 Wisconsin 1,719 29.0 22,141 $103,520 -0.2% 159 (+21)
    34 Maine 394 28.1 4,502 $107,869 -3.4% 20 (-3)
    35 Hawaii 403 28.0 2,937 $98,808 -1.9% 20 (-9)
    36 South Dakota 256 27.9 1,998 $89,390 +0.0% 12 (-2)
    37 Missouri 1,670 26.9 45,435 $102,763 -1.2% 123 (-1)
    38 Alaska 194 26.3 3,717 $93,768 -9.8% 24 (-1)
    39 Indiana 1,785 25.9 24,018 $82,962 +1.9% 171 (+23)
    40 South Carolina 1,322 24.5 16,888 $101,001 -1.2% 72 (-9)
    41 North Dakota 185 23.4 2,447 $75,812 +5.1% 13 (+0)
    42 Oklahoma 901 22.2 11,020 $87,595 -0.7% 66 (+1)
    43 New Mexico 466 22.0 4,146 $100,463 -2.5% 58 (+9)
    44 Iowa 705 21.9 13,761 $89,979 -3.6% 26 (-8)
    45 Tennessee 1,500 21.0 21,457 $96,568 +2.3% 84 (-1)
    46 Alabama 1,068 20.9 23,766 $99,857 -2.6% 91 (-1)
    47 Kentucky 931 20.5 14,720 $91,337 +1.7% 32 (-13)
    48 Arkansas 566 18.4 5,588 $92,804 +6.4% 33 (-7)
    49 Louisiana 837 18.2 9,526 $81,076 -2.2% 57 (-8)
    50 West Virginia 249 14.1 3,549 $94,835 +3.8% 16 (-6)
    51 Mississippi 370 12.6 3,933 $68,177 -4.6% 23 (-17)

    All columns NAICS 5415 (computer systems design and related services) unless noted. Ranked by establishments per 100,000 residents.

    Frequently asked questions

    How many IT services companies are in the United States?

    145,813 computer services establishments (NAICS 5415) in 2023, per Census County Business Patterns. An establishment is a single physical location, so multi-site firms count more than once.

    Which state has the most IT services firms?

    California, with 20,696 establishments, followed by Texas (14,905).

    Which state has the highest density of IT firms?

    Delaware, at 135.8 per 100,000 residents; among large states, Virginia leads at 108.1.

    How many managed service providers are there?

    There is no Census code for MSPs alone. The closest, NAICS 541513, counted 6,374 establishments in 2023, but many MSPs report under 541512 or 541519.

    What is the average salary at IT services firms?

    $122,296 per employee in 2023 (payroll divided by employment), from $68,177 in Mississippi to $167,821 in California.

    Are MSPs declining?

    NAICS 541513 establishments fell 7.2% from 2022 to 2023. This may reflect consolidation, reclassification, or both.

    How many people work in IT services?

    2,050,626 employees in NAICS 5415 establishments in March 2023.

    Where is this data from?

    U.S. Census Bureau County Business Patterns, the official count of business establishments, employment, and payroll by industry.

    Methodology

    Sources. U.S. Census Bureau County Business Patterns, state files for 2023 (cbp23st) and 2022 (cbp22st), all legal forms of organization. Population: Census Vintage 2024 state estimates, July 1, 2023 values.

    Industry codes. NAICS 5415 covers computer systems design and related services; we break out 541512 (systems design), 541513 (facilities management, closest to MSPs), and 541519 (other computer related services).

    Derived metrics. Density = establishments / population x 100,000. Average pay = annual payroll / mid-March employment. Change = (2023 – 2022) / 2022.

    Limitations. CBP excludes most self-employed operators without payroll, so one-person IT shops are undercounted. Establishments are locations, not companies. Firms choose their own NAICS code, so category boundaries are imperfect. 2023 is the latest CBP release as of October 2026.

    Not advice. This is published statistical data and derived analysis.

    Cite as:The Uptime Report. "IT Services Firms by State: A Census Atlas of the Managed IT Industry." October 2026. https://theuptimereport.com/it-services-firms-by-state-2026/

    Download the data. it-services-firms-by-state-2023.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    References

    1. U.S. Census Bureau, County Business Patterns (2022 and 2023 state files). Accessed October 2026.
    2. U.S. Census Bureau, Population Estimates Program, Vintage 2024. Accessed October 2026.
    3. U.S. Census Bureau, North American Industry Classification System. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Known Exploited Vulnerabilities: An Analysis of the CISA KEV Catalog, 2026

    Uptime Report Research · Catalog Analysis

    Known Exploited Vulnerabilities: An Analysis of the CISA KEV Catalog, 2026

    Original analysis of the full CISA catalog, version 2026.10.02 · Last updated October 2026

    CISA’s Known Exploited Vulnerabilities catalog lists 1,733 vulnerabilities confirmed as exploited in the wild as of 2026-10-02. Our analysis of every entry finds 2026 on a record pace: 249 additions year to date, already more than the 245 added in all of 2025, and 32% ahead of the same period last year.

    1,733known exploited vulnerabilities in the catalog
    249added in 2026 through 2026-10-02
    361tagged as used in ransomware campaigns
    53.3%of all entries come from 10 vendors
    Vendors with the most entries in the CISA KEV catalog (all years)
    1Microsoft389
    2Cisco100
    3Apple95
    4Adobe82
    5Google75
    6Oracle46
    7Apache40
    8Ivanti35
    9Fortinet31
    10Linux31
    Source: CISA Known Exploited Vulnerabilities Catalog, version 2026.10.02. Analysis: The Uptime Report.

    What is the CISA KEV catalog?

    The Known Exploited Vulnerabilities catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency of software flaws with reliable evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate listed vulnerabilities by a set due date. Private organizations are not bound by the directive, but CISA recommends that all organizations use the catalog to prioritize patching. Because inclusion requires evidence of real-world exploitation, the catalog is one of the most direct public signals of which flaws attackers actually use.

    Is exploitation accelerating in 2026?

    Yes, by the measure of catalog additions. CISA added 249 entries between January 1 and 2026-10-02, compared with 188 in the same period of 2025, an increase of 32%. The 2026 year-to-date count already exceeds the 245 entries added in all of 2025. Additions are not a perfect measure of exploitation volume, because they depend on CISA’s evidence threshold and review capacity, but the direction is clear.

    Entries added to the KEV catalog per year31120215552022187202318620242452025249*2026*2026 is year to date through 2026-10-02. Catalog launched November 2021. Source: CISA KEV.

    The 2021 and 2022 totals (311 and 555) are inflated by the catalog’s launch, when CISA loaded a backlog of older exploited vulnerabilities. Year-over-year comparisons are most meaningful from 2023 onward.

    Which vendors appear most often?

    Microsoft leads with 389 entries, more than three times the next vendor. The catalog spans 284 distinct vendors, but the ten most frequent account for 53.3% of all entries. Frequency partly reflects install base: the most widely deployed software attracts the most attacker attention and the most security research. It is not, on its own, a measure of any vendor’s relative security quality.

    Which vendors are linked to ransomware?

    CISA tags 361 entries as known to be used in ransomware campaigns. Microsoft accounts for 117 of them (32.4%). After Microsoft, the list is dominated by network-edge and remote-access products.

    Vendor Ransomware-linked entries Share of ransomware-linked
    Microsoft 117 32.4%
    Fortinet 14 3.9%
    SonicWall 13 3.6%
    Oracle 13 3.6%
    Ivanti 12 3.3%
    Adobe 11 3.0%
    VMware 9 2.5%
    QNAP 9 2.5%

    Why do edge devices matter so much?

    We grouped firewall, VPN, and remote-access gateway vendors (Fortinet, SonicWall, Ivanti, Citrix, Palo Alto Networks, F5, Zyxel, Juniper, Check Point, Pulse Secure, Array Networks, Cisco, Sophos, and WatchGuard) as “edge” vendors. These products sit at the network perimeter and are directly reachable from the internet. Edge vendors account for 274 entries (15.8% of the catalog) but 71 of the 361 ransomware-linked entries (19.7%), a higher share of ransomware use than of the full catalog.

    What the catalog implies for patch priority

    • Treat any KEV-listed vulnerability in an internet-facing edge device as an emergency change, not a scheduled one.
    • Use the catalog as a filter on top of severity scores: a medium-severity flaw that is being exploited outranks a critical one that is not.
    • Do not assume old means safe: 21.3% of entries were added five or more years after their CVE was assigned.
    • Most federal due dates give agencies 21 days (1,025 entries); that window is a reasonable outer bound for private organizations too.

    These are general operational observations drawn from the data, not security advice for any specific environment.

    Are old vulnerabilities still being exploited?

    Yes. Of all catalog entries, 369 (21.3%) were added to the KEV catalog five or more years after their CVE identifier year. Attackers continue to exploit flaws in systems that were never patched, which is why asset inventory and legacy-system coverage matter as much as fast patching of new disclosures.

    Is ransomware use declining?

    The data does not support that conclusion. The share of new entries tagged as ransomware-linked appears to fall in recent years, but the ransomware flag is frequently added months after a vulnerability enters the catalog, once campaign evidence emerges. Recent years are therefore undercounted.

    Year added Entries added Tagged ransomware-linked (as of 2026-10-02) Share
    2022 555 132 23.8%
    2023 187 43 23.0%
    2024 186 44 23.7%
    2025 245 31 12.7%
    2026 249 27 10.8%
    Read the ransomware share for 2025 and 2026 as a floor that will likely rise as CISA updates entries, not as evidence of a decline.

    Frequently asked questions

    How many vulnerabilities are in the CISA KEV catalog?

    1,733 as of catalog version 2026.10.02, released 2026-10-02.

    How many were added in 2026?

    249 through 2026-10-02, more than the 245 added in all of 2025.

    Which vendor has the most known exploited vulnerabilities?

    Microsoft, with 389 entries, followed by Cisco (100) and Apple (95).

    How many KEV entries are linked to ransomware?

    361 entries carry CISA’s “Known” ransomware campaign use tag.

    Do private companies have to follow the KEV catalog?

    No. BOD 22-01 binds federal civilian agencies. CISA recommends that all organizations use the catalog to prioritize remediation.

    What is the typical KEV remediation deadline?

    Most entries carry a 21-day federal due date; 1,025 of 1,733 entries use that window.

    Why does Microsoft appear so often?

    Its software has the largest install base, which concentrates attacker and researcher attention. Entry counts reflect exposure as much as product quality.

    Are edge devices overrepresented in ransomware?

    Edge vendors make up 15.8% of the catalog but 19.7% of ransomware-linked entries.

    How often is the KEV catalog updated?

    CISA updates it continuously, typically several times a week.

    Is this analysis reproducible?

    Yes. It is computed directly from CISA’s public JSON feed; the summary dataset is linked below.

    Methodology

    Source. CISA Known Exploited Vulnerabilities Catalog, JSON feed, version 2026.10.02, released 2026-10-02, downloaded October 2026. All 1,733 entries were analyzed. No figures were taken from secondary sources.

    Definitions. “Added” uses the catalog’s dateAdded field. “Ransomware-linked” means knownRansomwareCampaignUse equals Known. “Age when added” is the dateAdded year minus the CVE identifier year. “Edge vendors” is our grouping of perimeter and remote-access product vendors listed above; Cisco is included although part of its catalog footprint is non-edge software.

    Limitations. Catalog inclusion reflects CISA’s evidence threshold, not total exploitation. Launch-period backfill inflates 2021 and 2022. The ransomware tag lags, understating recent years. Vendor counts reflect install base and research attention, not relative product security.

    Not advice. This is data analysis, not security advice for any specific environment.

    Last updated: October 2026.

    Data and citation

    Summary dataset (CSV): yearly additions, top vendors, and ransomware-linked vendors, licensed CC BY 4.0. Cite as:
    The Uptime Report. "Known Exploited Vulnerabilities: An Analysis of the CISA KEV Catalog, 2026." October 2026. https://theuptimereport.com/cisa-known-exploited-vulnerabilities-analysis-2026/
    Download the data. cisa-kev-analysis-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    References

    1. CISA, Known Exploited Vulnerabilities Catalog. Accessed October 2026.
    2. CISA, KEV catalog JSON feed, version 2026.10.02. Accessed October 2026.
    3. CISA, Binding Operational Directive 22-01. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Ransomware Reported to the FBI: A Five-Year Trend

    The Uptime Report · Research

    Ransomware Reported to the FBI: A Five-Year Trend

    Data journalism by The Uptime Report · Based on FBI IC3 annual reports · Last updated October 2026

    Ransomware complaints to the FBI reached a four-year high in 2025. The Internet Crime Complaint Center received 3,611 ransomware reports in 2025, up from 2,385 in 2022, while reported dollar losses stayed volatile because ransom payments are chronically under-reported, according to FBI IC3 annual reports.

    Ransomware complaints to the FBI IC3, by year3,72920212,38520222,82520233,15620243,6112025Source: FBI Internet Crime Complaint Center (IC3) Annual Reports, 2021-2025.

    Five years of ransomware reported to the FBI

    2021
    3,729 complaints$1.6 billion+ reported losses

    Peak complaint year; losses inflated by a few very large incidents

    2022
    2,385 complaints$34.3 million reported losses

    Complaints dropped; reporting methodology tightened

    2023
    2,825 complaints$59.6 million reported losses

    Complaints rose 18%; losses up 74%

    2024
    3,156 complaints$12.5 million reported losses

    Complaints rose 9%; reported losses fell sharply

    2025
    3,611 complaints$32.3 million reported losses

    Complaints hit a 4-year high; losses rose 259% YoY

    What changed in 2025

    Complaints rose to 3,611, the highest since 2021 and a 14% increase over 2024. Reported ransomware losses rose 259% year over year to $32.3 million, but that figure reflects only losses victims disclosed to the FBI, a fraction of true costs. The FBI notes that most ransomware victims do not report, and reported losses exclude downtime, recovery, and third-party costs, which independent studies put far higher.

    Key findings

    • 2025 complaints hit a four-year high. The FBI IC3 received 3,611 ransomware reports in 2025, up from 3,156 in 2024, 2,825 in 2023, and 2,385 in 2022 (FBI IC3 Annual Reports).
    • Complaints have risen three years running. After bottoming at 2,385 in 2022, ransomware complaints rose each year through 2025 (FBI IC3).
    • Reported losses are volatile and understated. Reported ransomware losses swung from $1.6 billion+ in 2021 to $34.3 million in 2022, $59.6 million in 2023, $12.5 million in 2024, and $32.3 million in 2025, reflecting under-reporting rather than true cost swings (FBI IC3).
    • Ransomware is a fraction of total cybercrime reporting. The IC3 received more than 1 million complaints in total in 2025 with $20.9 billion in total reported losses, so ransomware complaints (3,611) are a small share of volume but an outsized share of operational damage (FBI IC3).
    • Healthcare leads targeted sectors. The FBI identified healthcare as the most-targeted critical infrastructure sector for ransomware, with 278 healthcare ransomware attacks tracked in 2025 (FBI IC3).

    Why reported losses understate the real cost

    The gap between complaint counts and reported losses is the most important caveat in this data. The FBI collects what victims voluntarily report, and ransomware is among the most under-reported crimes: many organizations never file, and those that do often report only the ransom demand, not the far larger costs of downtime, recovery, and lost business. Independent analyses put average ransomware incident costs in the millions, while the FBI’s reported ransomware losses for 2025 total $32.3 million across 3,611 complaints. The complaint trend is the more reliable signal of direction; the loss figures are a floor, not a measure.

    What the trend means for MSPs and MSSPs

    The three-year rise in reported complaints, against a backdrop of known under-reporting, points to sustained and growing ransomware pressure. For managed providers, the operational implication is consistency with prevention economics: because true costs dwarf reported losses and downtime dominates, the value of prevention, immutable backups, email security, and monitored detection, is larger than the FBI’s loss figures alone would suggest.

    Secondary questions

    How many ransomware attacks were reported to the FBI in 2025?

    3,611 ransomware complaints were reported to the FBI IC3 in 2025, a four-year high.

    Are ransomware attacks increasing?

    Reported complaints rose each year from 2022 (2,385) through 2025 (3,611), indicating a sustained upward trend in reporting.

    How much did ransomware cost in 2025?

    Reported losses were $32.3 million across 3,611 complaints, but this figure is widely understated because ransomware is heavily under-reported and excludes downtime and recovery costs.

    Frequently asked questions

    How many ransomware complaints did the FBI receive in 2025?

    3,611, up from 3,156 in 2024 (FBI IC3 Annual Report).

    What were FBI-reported ransomware losses in 2025?

    $32.3 million, a 259% increase over 2024’s $12.5 million, though this reflects only disclosed losses.

    Why are reported ransomware losses so low compared to other estimates?

    Because the FBI collects only voluntarily reported losses, and ransomware is heavily under-reported; reported figures exclude downtime, recovery, and third-party costs.

    What year had the most ransomware complaints?

    Among recent years, 2025 had the most at 3,611, followed by 2021 at 3,729. Complaints dipped to 2,385 in 2022 before rising again.

    Which sector is most targeted by ransomware?

    Healthcare, the most-targeted critical infrastructure sector per the FBI, with 278 healthcare ransomware attacks tracked in 2025.

    How much total cybercrime loss did the FBI report in 2025?

    $20.9 billion across more than 1 million complaints, of which ransomware is a small share by count but an outsized share of operational damage.

    Is ransomware getting worse?

    By reported-complaint trend, yes: complaints rose three years running through 2025. This report states the data; it is not security advice.

    What is the FBI IC3?

    The Internet Crime Complaint Center, the FBI’s public mechanism for reporting internet-enabled crime, which publishes an annual report of complaints and losses.

    How reliable is FBI ransomware data?

    Complaint counts are a reliable directional signal; loss figures are a floor because of heavy under-reporting.

    How current is this report?

    It reflects FBI IC3 annual reports through 2025, the latest available as of October 2026.

    Methodology

    Sources. All complaint counts and reported-loss figures come from the FBI Internet Crime Complaint Center (IC3) Annual Reports for 2021 through 2025, accessed October 2026.

    Reference periods. Each figure corresponds to the calendar year of the IC3 annual report cited.

    Analysis. Year-over-year changes are computed directly from the IC3 complaint and loss figures. No figures are estimated or modeled; all are as published by the FBI.

    Limitations. IC3 data captures only voluntarily reported incidents, so both complaint counts and especially loss figures understate the true scale of ransomware. Loss figures are not comparable across years as a true cost measure because of varying reporting completeness. They should be read as a reported floor, not a total.

    Not advice. This report presents published FBI data and trend analysis. It is not security, legal, or financial advice.

    Last updated: October 2026.

    How to cite this report

    The Uptime Report. “Ransomware Reported to the FBI: A Five-Year Trend.” Accessed October 2026.
    https://theuptimereport.com/research/ransomware-reported-to-fbi-5-year-trend/
    Download the data. fbi-ic3-ransomware-2021-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    References

    1. FBI IC3, 2025 Internet Crime Report. Accessed October 2026.
    2. FBI IC3, 2024 Internet Crime Report. Accessed October 2026.
    3. FBI IC3, 2023 Internet Crime Report. Accessed October 2026.
    4. FBI IC3, 2022 Internet Crime Report. Accessed October 2026.
    5. FBI IC3, 2021 Internet Crime Report. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem

    Uptime Report Research · Healthcare Breaches

    Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem

    This healthcare data breach report is built from the HHS Office for Civil Rights breach portal itself: every breach of 500 or more records reported since 2009, exported in full in October 2026. In 2025, providers, health plans, and their vendors reported 802 large breaches, more than in any previous year, affecting 140.5 million people. Hacking caused 81% of them.

    802large breaches reported in 2025, a record
    140.5Mindividuals affected in 2025
    80.8%caused by hacking or IT incidents
    35%involved a business associate (vendor)

    Breaches and people affected, 2015 to 2025

    Large breaches reported Individuals affected (millions)

    2701532816357173681851119663207152171822745237412480225290M people

    The number of large breaches has risen almost every year, from 270 in 2015 to 802 in 2025. The number of people affected moves with a few very large incidents: 2024 reached 290 million because of the Change Healthcare breach alone. 2025 was lower by people affected but higher by count.

    Causes of 2025 breaches

    Type of breach Breaches Share Individuals affected
    Hacking/IT Incident 648 80.8% 134,332,842
    Unauthorized Access/Disclosure 142 17.7% 6,082,639
    Theft 9 1.1% 44,417
    Loss 2 0.2% 4,008
    Improper Disposal 1 0.1% 34,675

    Hacking now dominates both the count and the scale. In 2015, hacking caused 21% of large breaches; in 2025, 81%. Theft and loss, the leading causes a decade ago, account for 12 breaches in 2025.

    The vendor problem

    281 of 802 breaches in 2025 (35%) listed a business associate as present, and those breaches affected 90.1 million people, 64% of everyone affected that year. The largest breach of the year, Conduent Business Services LLC (62.2 million people), was reported by a business associate.

    Who reported 2025 breaches

    • Healthcare Provider605
    • Business Associate137
    • Health Plan58
    • Healthcare Clearing House2

    Where the data was

    • Network Server509
    • Email195
    • Paper/Films42
    • Electronic Medical Record36
    • Other18
    • Laptop11

    The ten largest breaches reported in 2025

    # Organization Type State Individuals Cause
    1 Conduent Business Services LLC Business Associate NJ 62,224,658 Hacking/IT Incident
    2 Aflac Incorporated Health Plan GA 13,924,906 Hacking/IT Incident
    3 Episource, LLC Business Associate CA 6,725,572 Hacking/IT Incident
    4 Yale New Haven Health System Healthcare Provider CT 5,556,702 Hacking/IT Incident
    5 Blue Shield of California Business Associate CA 4,700,000 Unauthorized Access/Disclosure
    6 PIH Health, Inc. Healthcare Provider CA 2,947,264 Hacking/IT Incident
    7 DaVita Inc. Healthcare Provider CO 2,689,826 Hacking/IT Incident
    8 Veradigm LLC Business Associate IL 2,672,036 Hacking/IT Incident
    9 Anne Arundel Dermatology Healthcare Provider MD 1,905,000 Hacking/IT Incident
    10 Kettering Adventist Healthcare Healthcare Provider OH 1,695,382 Hacking/IT Incident

    What this means for healthcare IT and MSPs

    Network servers and email are where breached data sat in most 2025 cases, and hacking is the cause behind four in five. For a healthcare provider or the MSP supporting it, that points at server hardening, email security, and monitored, tested backups. The vendor figures matter just as much: an MSP with access to protected health information is itself a business associate, and more than a third of 2025 breaches ran through one.

    Frequently asked questions

    How many healthcare data breaches were reported in 2025?

    802 breaches affecting 500 or more people were reported to the HHS Office for Civil Rights in 2025, the most in any year since reporting began in 2009. The figure comes from the HHS breach portal, including breaches still under investigation and those archived.

    How many people were affected by healthcare breaches in 2025?

    140,498,581 individuals, the sum of the individuals-affected figures reported for 2025 breaches. That is less than half of 2024, when breaches affected 290,054,222 people, driven by the Change Healthcare breach.

    What causes most healthcare data breaches?

    Hacking and IT incidents: 648 of 802 breaches in 2025 (80.8%), affecting 134,332,842 people.

    What was the largest healthcare data breach in 2025?

    Conduent Business Services LLC, a business associate, reported a breach affecting 62,224,658 people in 2025.

    How many healthcare breaches involve vendors?

    In 2025, 281 breaches (35%) listed a business associate as present, and those breaches affected 90,106,317 people, 64% of the total.

    How many healthcare breaches have been reported since 2009?

    8,009 breaches affecting 1,094,480,870 individuals were listed on the HHS breach portal as of 09/21/2026. Individuals can appear in more than one breach.

    Download the data. hhs-ocr-healthcare-breaches-2009-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal, CSV exports of both the Under Investigation and Archive lists, downloaded October 2026. 8,009 unique breaches after removing duplicates across the two lists; latest submission 09/21/2026.

    Calculations. Years use the breach submission date. Individuals affected are summed as reported. Business associate share counts breaches where the portal’s business-associate-present field is Yes.

    Corrections. An earlier version of this report, published October 4, 2026, used a secondary compilation of the same portal and said that 2025 set a record for people affected and that the largest 2025 breach affected more than 25 million people. The primary data show 2024 had more people affected and the largest 2025 breach affected 62.2 million. This version replaces those figures.

    Limitations. The portal lists only breaches of 500 or more records. Organizations can revise counts after submission. Individuals can be counted in several breaches.

    Not advice. This is an analysis of public breach records, not legal or compliance advice.

    Cite as:The Uptime Report. "Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem." October 2026. https://theuptimereport.com/healthcare-data-breach-report-2026/

    References

    1. HHS Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. Accessed October 2026.
    2. HHS, HIPAA Breach Notification Rule. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending