Data breach notices 2026 have already topped last year’s total

Data breach notices 2026 have already exceeded last year’s full-year total, according to the Identity Theft Resource Center. For consumers, the figure is a reason to pay attention to account security, but it does not mean 471.2 million distinct people were affected or that every notice came from a separate hack.

The nonprofit counted an estimated 471.2 million victim notices in the first six months of 2026, versus 297.5 million notices in all of 2025. A notice is the communication sent after a company reports that personal information may have been exposed. One person can receive more than one, and a single incident can produce notices at an unusually large scale.

The biggest example was a compromise involving Instructure Holdings’ Canvas education platform. It generated an estimated 275 million notices, or 58% of the first-half total, according to the ITRC’s H1 report. That estimate reflects reported victims globally, and a U.S. victim count had not been confirmed.

Why are data breach notices so high in 2026?

The notice jump is concentrated in a small number of wide-reaching events. ITRC said supply-chain attacks, where an intrusion at a vendor can spread to its customers, produced 280.6 million notices from 38 initial incidents and ultimately affected 206 entities. Publicly traded companies accounted for 10.3% of compromised organizations but generated 83.4% of notices, the group added.

Reported compromises rose as well, though by far less than the notice total. ITRC tracked 1,803 compromises in the first half, compared with 1,732 in the same period of 2025, CNBC reported. The organization said the current pace would imply roughly 3,600 compromises for the year, above 2025’s 3,321, but that is a pace-based estimate rather than a certain outcome.

For investors following a public company’s cyber disclosure, the Canvas case shows why the number of notices and the number of reported incidents measure different things. A single event can account for a large share of notices, particularly when a widely used platform or supplier is involved.

What role is AI playing in data breaches?

The available data does not establish that artificial intelligence caused the overall increase in notices. ITRC said AI tools partly helped fuel zero-day attacks, which exploit a software flaw before a fix is available, by finding vulnerabilities faster than people can. It counted 14 such attacks in the first half, close to the 17 recorded during all of 2025.

Separately, CNBC reported that an IBM study found one in four breaches between March 2025 and February 2026 was AI-enabled, up 56% from the prior year. IBM describes AI as both a tool that attackers can use and one companies can use in their defenses.

The data also leave major gaps. Only 24% of first-half notices disclosed the attack vector, or the method used to gain access, ITRC said. That was its lowest recorded disclosure rate and limits broad conclusions about how the incidents happened.

Insider wrongdoing rose separately from the AI trend. ITRC recorded 21 such events in the first half, compared with three in all of 2025, citing technology-sector layoffs and nation-state recruitment schemes. An insider event involves someone with organizational access misusing it to take data.

What should consumers do after a breach notice?

ITRC recommends freezing credit files, using passkeys where available and enabling multifactor authentication. It also advises reviewing credit reports and acting promptly with financial institutions, credit bureaus and other relevant parties if identity theft is suspected. These steps cannot erase an exposure, but they can make fraudulent new-account opening and account takeovers harder.

This story draws on original reporting from CNBC.