Contents:
Understand cybersecurity megatrends with our rundown of 2026 data breach statistics [with data sourced from original studies published this year].
At Heimdal, we continually monitor specialist blogs, newsfeeds, forums and government websites that report on data breaches. This helps us build a picture of the latest trends in cyber crime, so we can better protect our customers.
If you’re looking to understand what’s happening with data breaches at a macro level, this article is for you. We’ve compiled high level data breach statistics for 2026 from a wide range of trusted sources, published this year. Read our summary to get a sense of the big trends and the scale of the issue.
We’ll be covering:
- Data on ‘rogue’ AI agents
- General overview of breach victims and costs worldwide
- Types and methods of breaches in 2026
- Notable breaches of 2026
The future is here: AI agents go rogue at least 24 times
Perhaps the most eye-catching data breaches of 2026 have been those carried out autonomously by AI agents. Although these incidents count for just a fraction of all breaches this year, they have generated an enormous amount of media and political attention.
The first publicised occurrence was a July incident where an OpenAI model broke out of a sandboxed testing environment and hacked into Hugging Face’s infrastructure.
Following this event, OpenAI, Anthropic and other AI labs self-reported several other occasions where their models have compromised third-party systems or some other kind of breach.
The website Felony Bench, which tracks such things, has identified at least 24 incidents as of October.
Overview of 2026 cyber breaches
Cyber breaches are reported on in different ways around the world. Also, different organisations gather data on breaches in different ways, so it is challenging to present a definitive view of all breaches. However, by combining insights from a range of sources, it is possible to get a picture of key topics.
How many breaches in 2026?
It’s impossible to say exactly how many breaches have occurred so far in 2026. But we can make some informed estimates.
Bitsight, a cyber risk intel platform, collects data on breaches posted on “underground forums”. Their data suggests there has been a total of 3,322 breaches worldwide by October 2026, with a marked increase in August and September.
These figures tally somewhat with statistics from the Identity Theft Resource Center (ITRC), a US non-profit. They reported that there were 1,803 compromises in the first six months of the year in the United States alone.
Although these figures do not fully align, likely due to different measurement techniques, they give a ‘ballpark’ figure for the number of global breaches. A number around 4000-5000 for the year seems reasonable.
Most organizations faced attacks in 2026
Experiencing a cyber attack or breach is common for businesses of all types, worldwide. National surveys show that a high proportion of firms experience at least some kind of attack yearly.
The UK government conducts an annual survey of businesses and charities about their experiences of cyber crime. In the UK, 43% of businesses experienced some kind of cyber attack. Mind that experiencing an attack is not necessarily the same as being breached.
In France, 39% of SMBs have faced some sort of cyber incident in the past 12 months. Meanwhile in Japan, a quarter of surveyed firms have suffered malware attacks and around 10% have experienced phishing. Indeed, only 22.7% experienced no incidents. A similar survey in Germany found that 57% of firms were affected by digital sabotage, and 45% had digital business data stolen.
How often do organisations get breached in 2026?
Businesses are continually targeted by cyber criminals. The UK government survey found that 43% of businesses registered a cyber attack or breach in 2026. Of these:
- 19% were attacked only once
- 27% were attacked less than once a month
- 22% were attacked once a month
- 29% were attacked weekly or more
Who is experiencing breaches in 2026?
Cyber criminals are targeting a very wide range of victims, with different kinds of attackers finding certain niches. But here is a general picture of victims of cyber crime in 2026.
North America is the top target
According to IBM’s data, North America is the region which is most targeted by cyber crime, representing 29% of all breaches. Note that IBM’s data does not include breaches in Africa.
Meanwhile, Bitsight provides a country-by-country breakdown of breaches. The United States comes out on top, with around 1100 breaches in the past 12 months (or 11.7% of all breaches). That country is followed by France (530 breaches), India (397), the UK (340) and Colombia (313).
Larger businesses are attacked more often
The UK government survey found that medium and large organisations are much more likely to be targeted by cyber criminals in 2026:
- 69% of large businesses identified an attack or cyber breach
- As did 65% of medium businesses
- 46% of small businesses identified attacks of breaches
- And 42% of micro businesses
Manufacturing and finance probably the most targeted sectors
Different surveys use different sampling methods, so it’s tricky to say confidently which industries are targeted most often at a global level. However, a few different surveys suggest manufacturing and finance are most likely to experience data breaches in 2026.
IBM’s data found that 27.7% of manufacturing firms and 27% of finance & insurance businesses have experienced an incident in the past 12 months. These were followed by professional, business and consumer services (9%), energy (8%), transportation services (8%), retail and wholesale (6% each), healthcare (4%) and government (3%).
The Identity Theft Resource Center’s 2026 survey reports slightly different findings. They found that the finance industry was most often compromised (387 reports), followed by healthcare (281), professional services (269), manufacturing (189) and technology (99).
The UK government survey has different findings again. In that study, information & communication businesses were most often breached – see the table below:
Focus on critical infrastructure attacks
16Sectors is a database that tracks attacks against critical infrastructure (such as dams, government facilities, utilities etc.). As of October 2026, their data shows there have been 372 data breaches in this field, worldwide. The top targets have been the United States and Israel (likely related to international conflicts both countries are engaged in).
What does a cyber breach cost in 2026?
Measuring the direct and indirect costs of an individual cyber breach is challenging, and different surveys come out with wildly different numbers.
IBM’s Cost of a Data Breach 2026 study reckons these incidents cost $4.99m on average, worldwide. They are especially costly in the United States ($11.5m per breach), the Middle East ($8m) Benelux ($7.37m), Canada ($5.2m) and Germany ($4.93m).
Notably, IBM claims that the costs associated with breaches have risen by 12% on average since 2025.
However, these figures diverge dramatically from the UK government’s survey. Their study found that the median breach in the past 12 months cost firms £0.
However, when breaches did lead to a financial cost, the median perceived cost was £560 ($738). Even the most damaging breaches in the country were estimated to have cost a relatively low £15,000 ($19,788).
The massive divergence in accounting between IBM’s figures and the UK government’s figures are hard to square up. It may be that IBM’s estimates are based on extrapolations to broader financial consequences, such as fines, time lost or reputational damage.
Not a victimless crime
While cyber breaches don’t tend to cause obvious physical damage, they still have significant and long lasting impact on victims.
When cyber breach costs are counted, the focus is usually on corporations (crisis management, legal fees etc.). Yet when an individual’s personal data is stolen and published, this also has personal consequences too.
A 2026 study looked at the ‘social cost’ of a breach for individuals whose data was lost in various cyber breaches in the past 18 years. The researchers estimated direct financial loss related to identity theft, including lost time, paying for legal assistance, healthcare costs and time spent dealing with the consequences.
On the plus side, costs have gone down remarkably, from highs of $1,110 in 2008, down to $296 in 2021. Nevertheless, these costs can be significant for individuals, and show that cyber breaches are not a victimless crime.
Types of cyber breaches in 2026
Several studies published in 2026 have reported on the methods of attack used. Again, some of these figures are divergent, but give an interesting overall picture.
Palo Alto Networks’ Global Incident Response Report 2026 found that ‘identity’ was the most widely used ‘route’ for breaches. Attackers will log in with stolen credentials then attempt to escalate privileges and move laterally.
As the results suggest, most attacks use multiple methods to engineer a data breach.
The UK government’s survey, by contrast, reports that phishing attacks are by far the most prevalent type of breach. Phishing was behind 93% of breaches, followed by hacking (8%), ransomware (3%), denial of service (3%) and viruses/spyware/malware (2%).
AI as a ‘force multiplier’ for cyber breaches
Criminals are known to be using various kinds of AI in their activities, and this is showing up in cyber breach statistics.
According to Palo Alto Networks, exfiltration speeds in the fastest cyberattacks have quadrupled. Their data shows that the fastest 25% of intrusions reached exfiltration in 1.2 hours, down from 4.8 hours the year before.
Meanwhile, IBM’s Cost of a Data Breach report estimates that AI-driven attacks increased by 56% compared to the previous year. In total 25% of all cyber crimes used AI in some form, IBM says.
Notable data breaches of 2026
There have been thousands of data breaches so far this year. Here are some of the biggest or most notable incidents.
- FBI breach: In September 2026, the FBI acknowledged that private and personal information about the agency’s entire workforce had been stolen by hacker group ShinyHunters. The breach could potentially put the lives of countless agents at risk.
- Canvas / Instructure: In April, education software company Instructure also fell victim to ShinyHunters. Data from some 275 million individuals was exposed – the hacking group demanded a ransom to return the data.
- Under Armour: In January, a customer dataset containing 72 million email addresses was stolen from the American sportswear brand, and published online (after they refused to pay a ransom).
- Chinese national ID numbers: Also in January, some 2.5 billion Chinese national ID numbers were leaked.
- Match Group: The brand behind dating apps like Tinder, Hinge and Match.com had some 10 million records stolen and faced a ransom demand in January.
Heimdal is always monitoring
As our rundown of 2026 cyber breach statistics show, there has been no let up in successful attacks this year.
The most eye-catching change has been the emergence of AI as both a tool and an autonomous threat actor. However, ‘traditional’ cyber attack methods are still more prevalent, at least for now.
The bigger story is simply that the scale, impacts and consequences of cyber attacks haven’t really declined. We are still seeing similar levels of victimization as have been occurring for the past few years. This is what everyone, from governments to businesses, charities and individuals, needs to focus on.
If you liked this article, follow us on LinkedIn, Reddit, X, Facebook, and Youtube.
