Security Report · github.com/jacobdjwilson

ITRC Reports 1,803 Data Compromises and 471.2 Million Victim Notices in H1 2026

Oct 21, 2026 · Original Report (PDF) ↗

Summary

ITRC recorded 1,803 data compromises and 471.2 million victim notices in H1 2026. Its report highlights mega-breaches, rising insider wrongdoing and declining disclosure of attack methods; notices do not represent unique individuals.

Key points

ITRC recorded 3.3% more compromises than in H1 2025; events are counted by database entry date, not when the compromise occurred, and totals remain subject to revision.
The report attributes an estimated 275 million victim notices to Canvas, about 58% of the total; the number of affected U.S. individuals remains unconfirmed.
Attack-vector details were absent from 76% of notices, compared with 70% in full-year 2025, limiting insight into compromise methods.
Insider wrongdoing reached 21 incidents, versus three in all of 2025; recorded zero-day attacks doubled year over year to 14.
Supply chain compromises involved 38 initial events affecting 206 entities and generated approximately 280.6 million victim notices.
Publicly traded companies accounted for 10.3% of compromises but 83.4% of victim notices, illustrating the concentration of exposed data.
The report recommends least-privilege access, prompt deprovisioning, vendor risk monitoring and stronger authentication; consumers are advised to freeze credit and avoid password reuse.

Article Details

Publisher: Identity Theft Resource Center (ITRC)
Report Period: 2026-01-01 to 2026-06-30
Scope: United States public data compromise notifications entered into the Breach Alert database; events are counted by database entry date, not occurrence date. Data is subject to revision.
Sample Size: 1,803 recorded data compromises as of 2026-07-01.
Key Statistics: H1 2026 recorded 1,803 compromises, up 3.3% from 1,746 in H1 2025, including 1,394 confirmed data breaches.
The report counted 471,206,085 victim notices, not unique individuals. This includes an estimated 275 million from Canvas, whose confirmed U.S. victim count remains pending.
Attack vector details were absent from 1,378 of 1,803 events (76%); only 425 (24%) disclosed them.
Insider wrongdoing accounted for 21 events, compared with three in full-year 2025; zero-day attacks accounted for 14 events, compared with seven in H1 2025.
Supply chain compromises involved 38 initial events affecting 206 entities and generating 280,644,600 victim notices.
Recommendations: Enforce least-privilege access, review access rights, monitor anomalous data access, and immediately revoke access when employees depart or change roles.
Continuously assess vendor security and require contractual security standards, disclosure timelines, and breach notification requirements.
Maintain backup and recovery capabilities, automate patch management, and exercise incident response plans for ransomware and data-theft-only extortion.
Require passkeys or hardware security keys for privileged access and segment networks to limit the impact of exploitation.
Include exposed data, plain-language attack causes, preventive measures, and concrete instructions for affected individuals in breach notifications.