List of data breaches


This is a list of reports about data breaches, using data compiled from various sources, including press reports, government news releases, and mainstream news articles. The list includes those involving the theft or compromise of 30,000 or more records, although many smaller breaches occur continually. Breaches of large organizations where the number of records is still unknown are also listed. In addition, the various methods used in the breaches are listed, with hacking being the most common.
As a result of data breaches, it is estimated that in first half of 2018 alone, about 4.5 billion records were exposed. In 2019, a collection of 2.7 billion identity records, consisting of 774 million unique email addresses and 21 million unique passwords, was posted on the web for sale. In January 2024, a data breach dubbed the "mother of all breaches" was uncovered. Over 26 billion records, including some from Twitter, Adobe, Canva, LinkedIn, and Dropbox, were found in the database. No organization immediately claimed responsibility.

List of data breaches involving a government or public entity

List of data breaches involving companies

EntityYearRecordsOrganization typeMethodSources
50 companies and government institutions20226,400,000variouspoor security
21st Century Oncology20152,200,000 customer's data, including names, Social Security numbers, physicians, diagnoses, insurance informationhealthcarehacked
23andMe20236,900,000consumer geneticscredential stuffing
500px202014,870,304social networkhacked
Accendo Insurance Co.2020175,350healthcarepoor security
Accenture2007
Adobe Systems Incorporated2013152,000,000techhacked
Adobe Inc.20197,500,000techpoor security
ADT Inc.202430,800, including email addresses, phone numbers and postal addresses.securityaccessing certain databases containing customer information
Advocate Medical Group20174,000,000healthcarelost / stolen media
AerServ 201875,000advertisinghacked
Affinity Health Plan, Inc.2013344,579healthcarelost / stolen media
Airtel2019320,000,000telecommunicationspoor security
Air Canada201820,000transporthacked
Air India20214,500,000, including name, date of birth, contact information, passport information, frequent flyer data, credit card data, ticket informationtransporthacked
Amazon Japan G.K.2019unknownonlineaccidentally published
TD Ameritrade2005200,000financiallost / stolen media
Ameriprise Financial2005260,000 customer recordsfinancialstolen laptop
Ancestry.com2021300,000genealogypoor security
Animal Jam202046,000,000gaminghacked
Ankle & Foot Center of Tampa Bay, Inc.2021156,000healthcarehacked
Anthem Inc.201580,000,000healthcarehacked
AOL200492,000,000webinside job
AOL200620,000,000webaccidentally published,
AOL20142,400,000webhacked
Apollo2018125,000,000tech, marketingpoor security
Apple iCloud2014photographs of celebritiestech, cloud storage
Apple, Inc./BlueToad202112,367,232tech, retailaccidentally published
Apple2013275,000techhacked
Apple Health|Apple Health Medicaid]202191,000healthcarepoor security
Ashley Madison201532,000,000datinghacked
AT&T2008113,000telecomslost / stolen computer
AT&T2010114,000telecomshacked
AT&T202172,000,000telecomsunknown
AT&T2024110,000,000telecomshacked third party service
Kido International2025Allegedly 8,000 children's and staff records exposed, including names, photographs, dates of birth, home addresses and parent contact detailsPrivate early-years education providercyberattack
Atraf2021unknowndatinghacked
Auction.co.kr200818,000,000webhacked
Australian Red Cross Blood Service2016550,000, including names, contact details, birthdates, medical details, information about "at-risk sexual behaviour"non-profitaccidentally published
Automatic Data Processing2006125,000financialpoor security
AvMed, Inc.20091,220,000healthcarelost / stolen computer
Bailey's Inc.2015250,000retailhacked
The [Bank of New York Mellon]200812,500,000, including names, addresses, birth dates, Social Security numbersfinanciallost box of data tapes
Bank of America20051,200,000financiallost / stolen media
Barnes & Noble201263 storesretailhacked
Bell Canada20171,900,000telecomspoor security
Bell Canada2018100,000telecomshacked
Bell Canada20242,200,000telecomsdata leak
Benesse201435,040,000educational serviceshacked
Betfair20102,300,000gamblinghacked
Bethesda Game Studios2011200,000gaminghacked
Bethesda Game Studios2018customer names, addresses, contact details, partial credit card numbersgamingaccidentally published
Betsson Group2020unknowngamblingunknown
Blank Media Games20187,633,234gaminghacked
Blizzard Entertainment201214,000,000gaminghacked
BlueCross BlueShield of Tennessee20091,023,039healthcarelost / stolen media
BMO and Simplii201890,000financialpoor security
Boeing2006382,000 employees transportLost/Stolen Device
British Airways cyberattack|British Airways]2018500,000transporthacked
British Airways2015tens of thousandstransporthacked
Callaway Golf Company20231,114,954, including full names, shipping addresses, email addresses, phone numbers, order histories, account passwords, answers to security questionssportshacked
Canva2019140,000,000webhacked
Capcom2020350,000gaminghacked
Capital One2019106,000,000financialunsecured S3 bucket
CardSystems Solutions Inc.
200540,000,000financialhacked
Cathay Pacific Airways20189,400,000transporthacked
CareFirst BlueCross Blue Shield - Maryland20151,100,000healthcarehacked
Central Coast Credit Union201660,000financialhacked
Central Hudson Gas & Electric2013110,000energyhacked
CheckFree Corporation20095,000,000financialhacked
CGI Group2007283,000
CheckPeople202056,000,000background checkunknown
Chess.com2023800,000gamingweb scraping
China Software Developer Network20116,000,000webhacked
Chinese gaming websites 201110,000,000gaminghacked
ChoicePoint2005163,000 consumer recordsdata aggregatorintentionally selling data
Citigroup20053,900,000financiallost / stolen media
Citigroup2011360,083financialhacked
Citigroup2013150,000financialpoor security
Clearview AI2020unknown information technologyhacked
Collection No. 12019773,000,000variouscompilation of multiple data breaches
Community Health Systems20144,500,000healthcarehacked
Compass Bank20071,000,000financialinside job
Countrywide Financial Corp20082,500,000financialinsider theft
Cox Communications201640,000telecomshacked
Crescent Health Inc., Walgreens2013100,000healthcare, pharmacylost / stolen computer
Cutout.Pro202419,972,829webhacked
CVS2015millionspharmacyhacked
CyberServe20211,107,034hosting providerhacked
D. A. Davidson & Co.2007192,000 clients' names, customer account and Social Security numbers, addresses and dates of birthbroker/dealerhacked by Latvian hackers
Dai Nippon Printing20078,637,405, including names, addresses, credit card numbersprintinginside job
Data Processors International
20088,000,000financialhacked
DC Health Link202356,000healthcaremisconfigured website
Dedalus Biologie 2021500,000healthcarepoor security
Dell202449,000,000, including customer's names, addresses, order and hardware informationelectronicsbrute force attack by a "Dell partner"
Deloitte2017350 clients emailsconsulting, accountingpoor security
Desjardins20199,700,000financialinside job
Discord2025Limited numbers of names, usernames, emails, IP addresses, limited billing informationsocial networkthird-party customer support services hacked
Diskunion2022701,000retailhacked
Disney20241.2 TB of internal Slack dataentertainmenthacked with a trojan
Domino's Pizza 2014600,000restauranthacked
DonorView2023948,029charitypoor security
DoorDash20194,900,000webhacked
Dropbox201268,648,009webhacked
Drupal20131,000,000webhacked
DSW Inc.20051,400,000retailhacked
Dubsmash2018162,000,000social networkhacked
Dun & Bradstreet20131,000,000techhacked
Duolingo20232,676,696educational servicesweb scraping
Earl Enterprises
20182,000,000restauranthacked
EasyJet20199,000,000 - basic booking, 2208 transporthacked
eBay2014145,000,000e-commercehacked
Educational Credit Management Corporation20103,300,000nonprofit, financiallost / stolen media
Eisenhower Medical Center2011514,330healthcarelost / stolen computer
Elance20091.3 millionserviceshacked
ElasticSearch2019108,000,000techpoor security
Emergency Healthcare Physicians, Ltd.2010180,111healthcarelost / stolen media
Emory Healthcare2012315,000healthcarepoor security
Epic Games Fortnite2018user accountsgamingvulnerability
Epik data breach|Epik]202115,000,000webhacked
Ernst & Young2006234,000 customers of Hotels.com
Equifax2017143,000,000, including names, date of birth, Social Security numbers, addresses, credit cards, driver's licensesfinancial, credit reportingpoor security
EssilorLuxottica202177,093,812healthcare, retailhacked
Evernote201350,000,000webhacked
Evide data breach20231,000computer services for charitiesransomware hacked
Exactis2018340,000,000data brokerpoor security
Excellus BlueCross BlueShield201510,000,000healthcarehacked
Experian202023,000,000financesocial engineering
Experian - T-Mobile US201515,000,000telecomshacked
EyeWire2016unknowntechlost / stolen computer
Facebook20136,000,000social networkaccidentally published
Facebook201850,000,000social networkpoor security
Facebook201087,000,000social networkdata misuse
Facebook2019540,000,000social networkpoor security
Facebook20191,500,000social networkaccidentally uploaded
Facebook2019267,000,000social networkpoor security
Facebook Marketplace2023200,000social networkunknown
Fast Retailing2019461,091retailhacked
Fidelity National Information Services20078,500,000financialinside job
Fidelity National Financial20231,300,000financialhacked by ALPHV
Financial Business and Consumer Solutions 20244,250,000financialransomware attack
First American Corporation2019885,000,000financialpoor security
FireEye2020Unknowninformation securityhacked
Friend Finder Network2016412,214,295webpoor security / hacked
Funimation20162,500,000webhacked
Formspring2012420,000webaccidentally published
Game Freak20242,606gaminghacked
Gamigo20128,000,000webhacked
Gap Inc.2007800,000retaillost / stolen computer
Gawker20101,500,000webhacked
GE Money2008650,000 customer's data, including 150,000 Social Security numbers and in-store credit card information from retail customersfinancialmagnetic tape missing from an Iron Mountain Incorporated storage facility
Global Payments20127,000,000financialhacked
Gmail20145,000,000webhacked
Golfzon20232,210,000, including names, phone numbers, email addresses, dates of birthsportsransomware/hacked
Google Plus2018500,000social networkpoor security
goregrish.com2021300,000webhacked
Grozio Chirurgija201725,000healthcarehacked
GS Caltex200811,100,000, including names, Social Security numbers, addresses, cell phone numbers, email addresses and workplaces of customersenergydiscs found in trash
Gyft2016unknownwebhacked
Hannaford Brothers Supermarket Chain20084,200,000, including credit card numbers and expiration datesretailhacked
HauteLook201828,517,244e-commercehacked
HCA Healthcare202311,270,000healthcarehacked
Health Net20091,500,000, including names, medical records, addresses, Social Security numbershealthcarelost / stolen media
Health Net — IBM20111,900,000healthcarelost / stolen media
Heartland Payment Systems2009130,000,000financialhacked
Hewlett Packard2006200,000tech, retaillost / stolen media
Hilton Hotels2014363,000hotel/casinohacked
Home Depot201456,000,000retailhacked
Honda Canada2011283,000, including names, addresses, VIN numbers, Honda Financial Services Account numbers, phone numbers, e-mail addressesautomotives"unusual traffic"
Hyatt Hotels2015250 locationshotel/casinohacked
Iberdrola20221,300,000energypoor security
IKEA202295,000retailaccidentally published
Infosys McCamish Systems202357,028 Bank of America customers, including names and Social Security numbers
28,268 Fidelity Investments customers, including names, dates of birth, Social Security numbers, bank account and routing numbers, credit card numbers, passwords, PINs		techhacked
Insomniac Games20231.67 TB, 1.3 million files of passports, I-9 forms, termination documents, Slack messages, Wolverine game datagaminghacked by Rhysida
Instagram2020200,000,000social networkpoor security
Ititan Hosting Solutions2024unknownhosting providerhacked / poor security
International Committee of the Red Cross2022515,000humanitarianunknown
Inuvik hospital20166,700healthcareinside job
Iranian banks 20123,000,000financialhacked
Japanet Takata2004510,000shoppinginside job
JP Morgan Chase20072,600,000financiallost / stolen media
JP Morgan Chase201476,000,000financialhacked
Justdial2019100,000,000local searchunprotected api
Kadokawa Corporation20241.5TB of corporate, and personal information of users and employees of Niconicowebransomware hacking
KDDI20064,000,000telecomshacked
KitchenPal 2023100,000webhacked
KM.RU20161,500,000webhacked
Koodo Mobile2020unknownmobile carrierhacked
Korea Credit Bureau201420,000,000financial, credit bureauinside job
Kroll Background America20131,000,000techhacked
KT Corporation20128,700,000telecomshacked
LexisNexis20141,000,000techhacked
Landry's, Inc.2015500 locationsrestauranthacked
LastPass2015password reminders, e-mail addressestechhacked
LastPass 2022 data breach2022Password vault backuptechpoor security/hacked
Les Éditions Protégez-vous2020380,000publisher unknown
LifeLabs201915,000,000healthcarehacked
Lincoln Medical & Mental Health Center2010130,495healthcarelost / stolen media
Line Yahoo2023520,006social media/webcyber infection/unautorized access
LinkedIn, eHarmony, Last.fm20128,000,000webaccidentally published
Living Social201350,000,000webhacked
Lyca Mobile202316,000,000telecommunicationshacked
MacRumors.com2014860,000webhacked
Mandarin Oriental Hotels201410 locationshotel/casinohacked
Manipulated Caiman202340,000,000financialhacked
Marriott International2018500,000,000hotel/casinohacked
Marriott International20205,200,000hotel/casinopoor security/inside job
MediaWorks New Zealand2023162,710mediahacked
Massive American business hack2012160,000,000financialhacked
Medibank & AHM20229,700,000healthcarehacked
Medical Informatics Engineering20153,900,000healthcarehacked
Memorial Healthcare System2011102,153healthcarelost / stolen media
MGM Resorts201910,600,000hotel/casinohacked
Michaels20143,000,000retailhacked
Microsoft2019250,000,000techdata exposed by misconfiguration
2021 [Microsoft Exchange Server data breach|Microsoft Exchange servers]2021unknownsoftwarezero-day vulnerabilities
Militarysingles.com2012163,792datingaccidentally published
Mitsubishi Tokyo UFJ Bank2006960,000financialintentionally lost
MongoDB2019202,000,000techpoor security
MongoDB2019275,000,000techpoor security
Mossack Fonseca2016Panama Papers
Mobile TeleSystems 2019100,000,000telecommunicationsmisconfiguration/poor security
Monster.com20071,600,000webhacked
Morgan Stanley Smith Barney201134,000financiallost / stolen media
Morinaga Confectionery20221,648,922foodransomware hacked
Mozilla201476,000webpoor security
MyHeritage201892,283,889genealogyunknown
Myspace2016360,000,000+, including usernames, passwords email addressessocial networkpoor security/account recovery
NASDAQ2014unknownfinancialhacked
National Public Data20242,900,000,000+, including names, email addresses, phone numbers, Social Security numbers, and mailing addressesdata brokerhacked
Natural Grocers201593 storesretailhacked
NEC Networks, LLC20211,600,000healthcarehacked
Neiman Marcus20141,100,000retailhacked
Nemours Foundation20111,055,489healthcarelost / stolen media
Network Solutions2009573,000techhacked
Newegg2018credit card informatione-commercemaliciously injected Javascript
New York City Health & Hospitals Corp.20101,700,000healthcarelost / stolen media
New York State Electric & Gas20121,800,000energyinside job
New York Taxis201452,000transportpoor security
Nexon Korea Corp201113,200,000gaminghacked
NHS20118,630,000healthcarelost / stolen media
Nintendo 2013240,000gaminghacked
Nintendo 2020160,000gaminghacked
Nippon Television2016430,000mediahacked
Now:Pensions202030,000financialrogue contractor
NTT Business Solutions20239,000,000telecomshacked
NTT Docomo20235,960,000telecomshacked
OGUsers2022529,000webhacked
Optus data breach|Optus]20229,800,000telecommunicationshacked
Orbitz2018880,000webhacked
OVH2013undisclosedwebhacked
PANDORA2025name, birthdate, email addressjewelryhacked third party service
Pandora Papers2021
Paradise Papers2017records
Patreon20152,300,000webhacked
PayPay202020,076,016QR code paymentimproper setting, hacked
Persol Carrier2024549,195outsourcing servicesystem deficiency
Popsugar2018123,857mediahacked
Premera201511,000,000healthcarehacked
Quest Diagnostics201911,900,000clinical laboratorypoor security
Quora2018100,000,000question & answerhacked
Rakuten20201,381,735e-commerceimproper setting, hacked
Rambler.ru201298,167,935webhacked
Razer2020100,000, including email and mailing addresses, product orders, and phone numbers.techmisconfigured server
RBS Worldpay20081,500,000financialhacked
Reddit2018usernames, emails, 2007 database backupsocial networkemployee account compromise
Reddit2021unknownsocial networkhacked
Restaurant Depot2011200,000retailhacked by Russian hackers
Roblox201652,458, including account balances, email addresses, IP addresses, purchases, usernamesgamingexposed test server
Roblox20233,943, including names, usernames, dates of birth, physical addresses, email addresses, IP addresses, phone numbers, and T-shirt sizes.gamingunknown
RockYou!200932,000,000web, gaminghacked
Roku202415,363 accountstechcredential stuffing attack
Roll2020184,000,000, including email addresses, IP addresses, names, the last four digits of credit cardsweb, gaminghacked
Roll20202412,000,000, including full names, email addresses, IP addresses, the last four digits of credit cardsweb, gamingcompromised administrative account
Rosen Hotels2016unknownhotel/casinohacked
Saks Fifth Avenue / Lord & Taylor2018credit card recordsretailhacked
Scottrade20154,600,000financialhacked
Scribd2013500,000webhacked
Seacoast Radiology, PA2010231,400healthcarehacked
Sega20111,290,755gaminghacked
Shadow PC2023533,624, including full names, email addresses, dates of birth, billing addresses and credit card expiration datestechsocial engineering
ShopBack2020unknowne-commercehacked
SingHealth2018 [SingHealth data breach|2018]1,500,000healthcarehacked
Slack2015500,000techpoor security
SlickWraps2020377,428phone accessoriespoor security
Snapchat20134,700,000social networkhacked
Snowflake2024Up to 165 victims, including AT&T, Ticketmaster, Advanced Auto Parts, Lending Tree, Cylance, Santander Bank and Neiman Marcus.tech, data storagecompromised credentials
SolarWinds2020Source Code Compromisednetwork monitoringhacked
Sony Online Entertainment201124,600,000gaminghacked
Sony Pictures20111,000,000, including passwords, email addresses, phone numbers, home addresses, dates of birthwebhacked by LulzSec
Sony Pictures2014100 terabytesmediahacked
Sony PlayStation Network201177,000,000gaminghacked
South Shore Hospital, Massachusetts2010800,000healthcarelost / stolen media
Southern California Medical-Legal Consultants2011300,000healthcarehacked
Spartanburg Regional Healthcare System2011400,000, including names, Social Security numbers, addresses, dates of birth and medical billing codeshealthcarelost / stolen computer
Spoutible2024207,114social networkmisconfigured API
Staples2014customer payment cardsretailhacked
Starbucks200897,000, including names, addresses, and Social Security numbersrestaurantlost / stolen computer
Starwood
including Westin Hotels & Resorts and Sheraton Hotels and Resorts		201554 locationshotel/casinohacked
Steam201135,000,000gaminghacked
StockX20196,800,000e-commercehacked
Stratfor2011?militaryhacked
Supervalu2014200 storesretailhacked
Sutter Medical Center20114,243,434healthcarelost / stolen computer
Taobao201620,000,000e-commercehacked
TalkTalk2015recordstelecomhacked
Tangerine Telecom2024243,462telecomcompromised credentials
Taringa!201728,722,877webhacked
Target Corporation2013110,000,000retailhacked
TaxSlayer.com20168,800webhacked
TD Ameritrade20076,300,000financialhacked
TD Bank2012260,000financialhacked
TerraCom & YourTel2013170,000telecomsaccidentally published
Tesla202375,000transportinside job
Tetrad2020120,000,000market analysispoor security
Ticketfly 201826,151,608ticket distributionhacked
Ticketmaster201840,000, including login information, payment data, addresses, names, phone numbersticket distributionmaliciously modified Javascript
Ticketmaster2024560,000,000ticket distributionhacked third party service
Tic Hosting Solutions 202346hosting providermisconfigured web server
Tianya Club201128,000,000webhacked
TikTok202042,000,000social networkpoor security
TK / TJ Maxx200794,000,000retailhacked
T-Mobile, Deutsche Telekom200617,000,000, including phone numbers, addresses, dates of birth, email addressestelecomslost / stolen media
T-Mobile202145,000,000telecomhacked
T-Mobile202337,000,000telecomhacked
Tokopedia202091,000,000e-commercehacked
Trello202415,111,945techmisconfigured API
Triple-S Salud, Inc.2010398,000healthcarelost / stolen media
Truecaller2019299,055,000telephone directoryunknown
Trump Hotels20148 locationshotel/casinohacked
Tumblr201365,469,298webhacked
Twilio2022125techphishing attack
Twilio202433,000,000, including phone numbers,techcredential stuffing attack
Twitch2015unknowntechhacked
Twitch2021unknowntechhacked/misconfiguration
Twitter2013250,000social networkhacked
Typeform2018unknowntechpoor security
Uber201450,000transportpoor security
Uber201757,000,000transporthacked
Uber2022No customer, driver, or sensitive personal data was directly stolen. Exposure of sensitive data from internal systems.transporthacked
Ubisoft2013unknowngaminghacked
Ubuntu20132,000,000techhacked
UCLA Medical Center, Santa Monica20154,500,000healthcarehacked
U-Haul202367,000, including full names, dates of birth, driver license numberstransportstolen credentials
MyFitnessPal2018150,000,000consumer goodshacked
UPS201451 locationslogisticshacked
Vastaamo2020130,000healthcarehacked
Verifications.io 2019809,000,000online marketingpoor security
Verifications.io 20192,000,000,000online marketingpoor security
Verizon Communications20161,500,000telecomshacked
View Media202038,000,000online marketingpublicly accessible Amazon Web Services server
Virgin Media2020900,000telecomsaccidentally exposed
Vodafone20132,000,000telecomsinside job
VTech20155,000,000retailhacked
Walmart20151,300,000retailhacked
Washington Post20111,270,000mediahacked
Wattpad2020270,000,000webhacked
Wawa 202030,000,000retailhacked
Weebly201643,430,316webhacked
Wellnow Urgent Care2023patients’ names, dates of birth, health informationhealthcareransomware hacked
Wendy's2015unknownrestauranthacked
Westpac201998,000financialhacked
Woodruff Arts Center2019unknownarts grouppoor security
WordPress2018thousands of websitesweb servicesvulnerabilities in plugins
Writerspace.com201162,000webhacked
Xat.com20156,054,459websocial engineering
Yahoo20133,000,000,000webhacked
Yahoo2014500,000,000webhacked
Yahoo Japan201322,000,000tech, webhacked
Yahoo! Voices hack|Yahoo! Voices]2012450,000webhacked
YouTube20204,000,000social networkpoor security
Yum! Brands2023names, driver's license numbers, and other ID card numbers.restaurantransomware attack
Zappos201224,000,000e-commercehacked
Zynga2019173,000,000social networkhacked