980 verified breaches
Data Breach Statistics 2026: What 980 Breaches in Have I Been Pwned Reveal About Stolen Data
Data breach statistics usually count incidents. This report looks inside them. Have I Been Pwned, the breach notification service run by security researcher Troy Hunt, publishes the data classes exposed in every breach it loads. We analyzed all 980 verified breaches in its public catalog as of 2026-09-30. The clearest finding: breaches are carrying fewer passwords and more personal contact data.
What is inside a typical breach?
HIBP records 160 distinct data classes. The median breach exposes 5 of them. Share of all 980 breaches that include each class:
- Email addresses99%
- Passwords66%
- Names54%
- Usernames48%
- IP addresses38%
- Phone numbers36%
- Physical addresses29%
- Dates of birth28%
- Genders19%
- Geographic locations15%
- Purchases9%
- Website activity8%
- Social media profiles5%
- Job titles5%
Passwords out, phone numbers in
Share of breaches added to HIBP in each year that include the data class. 2026 is January to 09/2026.
In breaches added from 2016 to 2019, 86% included passwords. In 2026 additions, 19% do, the lowest share in the catalog. Phone numbers overtook passwords in 2026 additions and reached 62% in 2026. Among 2026 additions, the most common classes after email addresses are names (77%), phone numbers, and physical addresses (57%): the profile of stolen customer records rather than login databases.
How long until breached data surfaces?
Median days from the breach date to the date HIBP added it, by year added. 32% of all breaches were added within 30 days; 34% took more than a year.
The 2026 median of 22 days is among the shortest in the series, compared with 429 days for breaches added in 2023, a year when many older breaches were loaded. Lag here is not the breached company’s disclosure time; it measures how long the stolen data took to reach a public notification service.
The largest breaches on record
| Breach | Accounts | Breach date | Added to HIBP | Data classes |
|---|---|---|---|---|
| Synthient Credential Stuffing Threat Data | 1,957M | 2025-04-11 | 2025-11-06 | 2 |
| Verifications.io | 763M | 2019-02-25 | 2019-03-09 | 10 |
| Data Enrichment Exposure From PDL Customer | 622M | 2019-10-16 | 2019-11-22 | 7 |
| 509M | 2019-08-01 | 2021-04-04 | 8 | |
| Combolists Posted to Telegram | 361M | 2024-05-28 | 2024-06-03 | 3 |
| MySpace | 359M | 2008-07-01 | 2016-05-31 | 3 |
| ALIEN TXTBASE Stealer Logs | 284M | 2025-02-15 | 2025-02-25 | 2 |
| Not SOCRadar | 282M | 2024-08-03 | 2024-08-09 | 1 |
What this means for MSPs and MSSPs
Fewer breaches with passwords does not mean less risk for clients. Exposed phone numbers, names, and employers feed SMS phishing, voice phishing, and help desk social engineering, where an attacker calls in posing as an employee. Password resets and credential monitoring remain necessary, but identity verification at the service desk deserves equal attention. The HIBP domain search lets a provider check client domains against every breach in this dataset.
Frequently asked questions
How many data breaches are in Have I Been Pwned?
980 verified breaches covering 13.2 billion breached accounts as of 2026-09-30, after excluding fabricated breaches and spam lists. One person can appear in many breaches, so accounts are not unique people.
What data is most often exposed in a breach?
Email addresses (99% of breaches), passwords (66%), names (54%), usernames (48%), and IP addresses (38%).
Are fewer breaches exposing passwords?
Among breaches added to Have I Been Pwned, yes. 86% of breaches added from 2016 to 2019 included passwords, against 19% of those added in 2026. Phone numbers moved the other way, reaching 62% in 2026.
How long does it take for a breach to become public?
For breaches loaded into Have I Been Pwned, the median time from the breach date to the date it was added is 126 days. For breaches added in 2026, the median was 22 days. This measures when the data reached HIBP, not when the breached company disclosed it.
What is the largest breach in Have I Been Pwned?
Synthient Credential Stuffing Threat Data, with 1.96 billion accounts, added on 2025-11-06.
Methodology
Source. Have I Been Pwned public breach catalog (API v3 breaches endpoint), retrieved October 2026. Data licensed under CC BY 4.0; attribution: Have I Been Pwned (haveibeenpwned.com).
Filters. Included breaches marked verified; excluded those flagged as fabricated or spam lists. Sensitive, retired, malware, and stealer log entries that are verified are included.
Calculations. Data class shares are the percentage of breaches whose DataClasses list includes the class. Lag is AddedDate minus BreachDate in days. Years are grouped by date added, because grouping by breach date would undercount long lags for recent breaches that have not surfaced yet.
Limitations. HIBP holds breaches that were obtained and verified by one person’s service, not a census of all breaches. Breach dates are often approximate. Account counts include duplicates across breaches.
Not advice. This is an analysis of a public catalog, not a security assessment.
Cite as:The Uptime Report. "Data Breach Statistics 2026: What 980 Breaches in Have I Been Pwned Reveal About Stolen Data." October 2026. https://theuptimereport.com/data-breach-statistics-2026/
References
- Have I Been Pwned, Pwned websites. Accessed October 2026.
- Have I Been Pwned, Domain search. Accessed October 2026.
- Have I Been Pwned API v3 documentation and license. Accessed October 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend
Infrastructure and uptime
- Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version
Regulation and disclosure
- SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement
Workforce and pay
- Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections
MSP market and spending
- Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas
Leave a Reply