Reported U.S. Data Compromises Nearly Tripled From 2018 to 2025. The Count Can't Separate More Breaches From More Disclosure.

On April 5, 2002, hackers got into a California state database at the Stephen P. Teale Data Center. The database held sensitive financial and personal information on about 265,000 state workers. The break-in was not discovered until May 7. The workers were told on May 21.

Among them were all 120 members of the Legislature, 80 in the Assembly and 40 in the Senate. Each "received the same form letter, almost two months after the incident, informing them of the breach," Joe Simitian, then an Assembly member, recalled in a 2009 talk. "The issue was no longer hypothetical; it was now real, and it was personal."

By September the Legislature had passed the country's first breach notification law, and the governor had signed it. Under the law, businesses and state agencies would have to tell people when their personal data was breached. It took effect on July 1, 2003. Every other state followed, the last two in 2018.

Those notices are now the raw material for a national count. In January 2026, the Identity Theft Resource Center (ITRC), a San Diego nonprofit, reported a record 3,322 publicly reported U.S. data compromises in 2025, about nine a day.

A compromise is the center's term for each event it logs. Most are data breaches, 2,928 of the 3,322 in 2025, and the rest are data exposures, previously compromised data and events of unknown type. Its count is built from what becomes public: attorney general filings, media reports and the letters people receive.

A higher count could mean more breaches happened. It could also mean more of them were disclosed and found. The count by itself cannot tell those apart.

It also cannot say whether telling people did what the law's authors promised in 2002, which was to help them head off identity theft. And it cannot say what the notices now tell them.

Nine a day, counted from what became public

The center has tracked publicly reported U.S. data breaches since 2005. At the time of its 2025 report, its database held more than 25,000 tracked compromises. It says it is "largely funded by the corporate supporters and foundations" mentioned on its website. It also says the website itself was supported in part by grants from the Justice Department's Office for Victims of Crime.

In 2018, when every state had a law, ITRC counted about 1,200 compromises. That was fewer than the 1,505 it counted in 2017.

By 2025 it counted 3,322. That was nearly three times the 2018 total. It was also a little over twice the 2017 total. So did the count climb while the laws were spreading, or after they stopped?

Source: Identity Theft Resource Center, 2025 Annual Data Breach Report (January 2026), year-over-year table. Earlier years as restated in that report.

Both. The count rose in most years while the laws spread, and it kept climbing after they stopped spreading, with dips in 2020, 2022 and 2024.

The line does not show how many breaches happened. ITRC's count depends on which breaches are made public and which public sources it reads, and neither of those stayed fixed over the years in the series. "Given the nature of state data breach laws and business notification practices, the ITRC does not claim to offer 100 percent (100%) coverage of known data breaches," its 2025 report says. "Further, it is highly likely that an unknown number of data breaches are not publicly reported."

The notices that count is built from go back to a bill in Sacramento that had breach notice in it before anyone knew about the April 2002 Teale hack.

A privacy bill's afterthought

Simitian told that story in the 2009 talk, which was published in the Berkeley Technology Law Journal. He had drafted a privacy bill. Less than 48 hours before the deadline to introduce it, he held an after-hours call with two privacy lawyers who advised him informally.

One of them, Deirdre Mulligan, then at UC Berkeley's Samuelson Clinic, suggested adding notice of security breaches, by Simitian's account. The other expected heavy industry resistance and saw the provision as something to trade away as the bill moved. Simitian added it.

Then came Teale. Sen. Steve Peace, who chaired the Senate Committee on Privacy and was in his final term, held an informational hearing on the breach on June 6, 2002. "Disturbed by what he found, Mr. Peace decided to propose legislation to address the need for notice," Simitian recalled.

The two men agreed to carry identical breach bills. Each was an older bill whose text was gutted, with the new breach text amended into it.

Peace's vehicle, SB 1386, had begun as an exemption to the Public Records Act. Its 32-0 Senate vote in April was on that original text, not on the breach text. Simitian's twin, AB 700, had been a digital-signature bill.

Peace put the case for the bill in a statement quoted in the Assembly Business and Professions Committee analysis. "All too often events of this sort go completely unreported," he said. "How can this be? The embarrassment of disclosure that a company or agency was 'hacked,' or the fear of lost business based upon shoddy information security practices being disclosed overrides the need to inform the affected persons."

The findings enacted with the bill framed it as an identity theft measure. "Identity theft is one of the fastest growing crimes committed in California," they said, and "victims of identity theft must act quickly to minimize the damage; therefore expeditious notification of possible misuse of a person's personal information is imperative."

At the Assembly Judiciary Committee in June, two nonprofits registered support: the Privacy Rights Clearinghouse and the Identity Theft Resource Center, the nonprofit that now keeps the national count. "This provision is important because the sooner an individual takes identity theft prevention steps, the more likely it is that he or she will not become a victim of fraud," they wrote. The analysis listed no opposition on file at that hearing. Industry groups registered theirs in the committees that followed.

What the industry groups warned

Opponents argued, among other things, that one state should not set these rules alone, and that the notices would alarm people who could do nothing with them. The Information Technology Association of America, a tech trade group, made the first. In the Assembly Appropriations Committee's summary of its position, the group was "concerned about piecemeal state-by-state regulation of this issue and believes it is best left to the purview of federal government." The group was also concerned that the bill "lacks any caps on liability."

The Investment Company Institute, which represents mutual funds, made a prediction a reader can check against later evidence. The notices, it wrote, "will likely accomplish no more than unduly alarming recipients of the notices because such persons will be unable to take any meaningful prophylactic action to protect themselves in response to the notice." It put the costs of compliance "just from our industry alone" in "the tens of millions of dollars."

Three of the four Assembly committees split their votes: 9-3 in Judiciary, 7-1 in Business and Professions and 16-7 in Appropriations. The fourth, Governmental Organization, voted 9-0.

Amendments were taken to meet opponents' concerns. The Business and Professions analysis reported that many of the opponents "have recently removed their opposition as a result." On August 26, 2002, the Assembly passed SB 1386 78-0.

The governor signed both twin bills on September 25, 2002. Simitian later said Peace's was signed first because of a spelling mistake. He also said the law existed "only because of a spelling error, an afterthought, an unrelated concern with digital signatures, a page three news story, the rule of germaneness, the intellectual quirks of a lame-duck Senator, the personal experiences of 120 State legislators, and another bill altogether, Assembly Bill 2297."

"The law passed over strong objections from industry groups," the reporter Kevin Poulsen wrote in SecurityFocus in January 2003. Its reach was clear within months. Scott Pink, deputy chair of the American Bar Association's Cybersecurity Task Force, called it "revolutionary" on an industry call organized by the same tech trade group, the Information Technology Association of America, and expected other states to follow. Because the law covered any company with California customers, "online businesses may find it easier to notify everyone impacted by a breach, rather than trying to cherry-pick Californians for special treatment," Poulsen reported him saying.

The first months: few notices, no cases

At first there was little to see. Nearly four months after the law took effect, the Attorney General's office knew of no enforcement action under it.

"Our office is not aware of any, nor are we aware of any DA or local offices or private parties bringing them," Hallye Jordan, a spokesperson for Attorney General Bill Lockyer, told SecurityFocus. "It may be that there have not been any security breaches that the consumers have not been informed about."

Pink read the silence another way. "Thus far I have not seen a lot of examples of people notifying," he said. "My guess is people are either not familiar with the law, or are handling it discreetly." A federal version, Sen. Dianne Feinstein's Notification of Risk to Personal Data Act, was stalled in committee, according to her spokesman.

How one state's law became fifty

The case that brought the law before Congress came in early 2005, and it was not a hack. The data broker ChoicePoint said in an SEC filing that customers had "opened ChoicePoint accounts by using stolen identities and altered documents." The Electronic Privacy Information Center, a privacy advocacy group, put it more bluntly in a February 18, 2005 letter to the company: "There was no hack or computer breach. Your company, Choicepoint, sold the data for fees of $100 to $200."

In a filing dated March 4, 2005, ChoicePoint said it had mailed notices to about 145,000 people in all 50 states. "Approximately 35,000 of these consumers are California residents, and approximately 110,000 are residents of other" states, it wrote. It said it had searched back to July 1, 2003, "the effective date of the California notification law." Michael Rasmussen of Forrester Research wrote at the time that "At first, the ChoicePoint disclosure was only to California residents, but it soon changed course to include 145,000 US citizens."

At a Senate Commerce Committee hearing on May 10, 2005, ChoicePoint's president, Douglas C. Curling, described it differently. "We not only followed California law, we built upon it and voluntarily notified consumers who may have been impacted across the country, and we did that before anyone called upon us to do so."

At the same hearing, Sen. Daniel Inouye of Hawaii said what California's law had done to the public record. "Since January, there have been at least 32 major data security incidents potentially affecting 5.2 million Americans," he said. "These incidents only came to light because of a California law that requires disclosure of data security breaches. No one knows how many undisclosed breaches may have occurred prior to the implementation of the California law."

Inouye's point still holds. No count from before 2003 exists to compare against.

Forrester expected Congress to act. "Forrester expects legislation and increased regulation to move through Congress in 2005," Rasmussen wrote. Congress did not pass one. In January 2006, the Federal Trade Commission announced that ChoicePoint would pay $10 million in civil penalties and $5 million in consumer redress, which the agency called the largest civil penalty in its history.

The states moved instead. How fast did the law spread once ChoicePoint hit the news?

Source: Romanosky, Telang and Acquisti working paper (adoption years 2005-2009); press reports of signing dates (2010-2018); California legislative record. DC and territories not counted.

Twenty-seven states adopted a law in 2005 and 2006 alone. The last five took another nine years. By the end of 2009, 45 states had one. Alabama, Kentucky, Mississippi, New Mexico and South Dakota did not.

Mississippi joined in 2010, Kentucky in 2014 and New Mexico in 2017. South Dakota's governor signed its law on March 21, 2018. That left Alabama the only state without one, for a week. Alabama's bill passed the House 101-0 and the Senate 30-0, and Gov. Kay Ivey signed it on March 28, 2018.

"Alabama consumers finally join the rest of America in having the right to know if their personal information is stolen or compromised in a data breach," said the state's attorney general, Steve Marshall. "There is no national law requiring companies to notify affected consumers after a data breach so it is up to each state to ensure that its citizens are protected."

By the time Alabama signed, the Identity Theft Resource Center had been counting for 13 years.

Two lists that count notices

Two government lists measure narrower slices, under different rules. One exists because of a fight in Sacramento.

In 2009 Simitian, by then a state senator, passed SB 20. It would have set what a notice must contain, and it would have required copies to go to the Attorney General. Gov. Arnold Schwarzenegger vetoed it.

"There is no additional consumer benefit gained by requiring the Attorney General to become a repository of breach notices when this measure does not require the Attorney General to do anything with the notices," he wrote. Two years later Simitian's SB 24, approved on August 31, 2011, required a copy to go to the Attorney General whenever a notice goes to more than 500 Californians.

Source: California Attorney General data breach list, CSV export downloaded October 31, 2026, counted by year of reported date. 2026 is partial and not shown.

The repository the governor called unnecessary held about 5,400 notices by late October 2026. Its yearly count more than quadrupled from 2012 to 2025, with a jump in 2020 and a peak in 2023.

The second list is federal and covers health care only. The Department of Health and Human Services' Office for Civil Rights runs an online breach portal, often called the HHS breach portal, that lists breaches of health information covered by HIPAA, the federal health privacy law, when they affect 500 or more people.

Source: HHS Office for Civil Rights breach portal, archive and open-investigation exports downloaded October 31, 2026, deduplicated and counted by submission year.

Health care breach reports roughly quadrupled from 2010 to 2025. The California and HHS lists rose over the same years as the ITRC count. Each carries the same limit: a list of reports measures what was reported, not what happened.

If the count cannot settle whether there are more breaches, the next question is whether the notices did what the 2002 findings said they would.

Did telling people cut identity theft?

The California Legislature promised a tool for victims who "must act quickly." Simitian's own summary in 2009 was shorter: "Simply put: to be unaware is to be vulnerable." He also said he believed "shame and cost" would push companies toward better security.

One test of the identity theft promise comes from three Carnegie Mellon researchers, Sasha Romanosky, Rahul Telang and Alessandro Acquisti. They used a method called difference-in-differences. They tracked identity theft reports to the FTC, state by state over time. Then they compared how the reports changed in states that adopted a law with how they changed over the same years in states that had not.

Their answer changed as the data grew. A 2008 workshop draft, covering 2002 to 2006, said: "We find no statistically significant effect that laws reduce identity theft, even after considering income, urbanization, strictness of law and interstate commerce." That draft's result was not statistically significant, meaning by the study's own test chance alone could easily produce a result like this even with no real difference; that does not show there was none.

A later draft covering 2002 to 2009 estimated that adopting a law reduced identity theft caused by data breaches by 5.7% on average. The version published in the Journal of Policy Analysis and Management in 2011, on the same years, put the reduction at 6.1%.

Every version used FTC identity theft reports, which count thefts from all causes. The later draft notes that the authors could not observe which thefts began with a breach. The 2008 draft stated its result for identity theft in general. The later versions describe their estimate as the effect on thefts caused by breaches, on the authors' argument that the laws should not change the other thefts.

Source: Romanosky, Telang and Acquisti, 2008 workshop draft, later working draft, and 2011 Journal of Policy Analysis and Management abstract (via Crossref).

A 2% figure comes from somewhere else. In January 2009, the security writer Bruce Schneier summarized the research, describing data from 2002 to 2007: "The researchers found data breach notification laws reduced identity theft by just 2 percent on average."

We could not find a 2% effect in any of the three versions we opened. The 2008 draft does mention 2%, but as a different number: the probability of becoming an identity theft victim as a result of a breach. The draft lists that figure among arguments made against the laws.

The later draft also offered a guess about why any effect might fade. It found "some evidence that the laws were effective in a short term (6-12 month) period," which it said "could be explained by a temporary heightened awareness by consumers of the notifications." Without signs that their actions mattered, the authors suggested, consumers might become desensitized to further notices.

That was the risk the Government Accountability Office had flagged in 2007. An "expansive requirement could result in notification of breaches that present little or no risk, perhaps leading consumers to disregard notices altogether," GAO wrote.

GAO also reviewed the 24 largest breaches reported in the media from January 2000 to June 2005. It found evidence of fraud on existing accounts in 3 of them and new-account fraud in 1. In 18 it found no clear link to identity theft, and in 2 there was not enough information.

What did identity theft reports do after the laws spread?

Source: FTC Consumer Sentinel Network Data Book 2024 (March 2025), number of reports by type. Reports are unverified consumer submissions, not a count of victims.

Reports rose in most years and more than doubled from 2019 to 2020. The FTC tied much of that jump to one kind of fraud. Reports from people whose information was misused to apply for a government document or benefit, such as unemployment insurance, went from 23,213 in 2019 to 406,375 in 2020.

The national line mixes breaches with every other route to identity theft, so it cannot test the laws on its own. The Carnegie Mellon studies used the state-by-state timing for that reason.

Researchers have tested part of Simitian's second hope, that "shame and cost" would push companies toward better security, by measuring whether disclosure costs a company anything. In 2006 two of the same Carnegie Mellon researchers, Acquisti and Telang, studied 79 breach announcements with Allan Friedman. They found that company stock fell about 0.6% over the day of the news and the day after, an effect that then lost statistical significance. CMU's Berkman Faculty Development Fund and CyLab funded that work.

In a 2024 working paper using the same before-and-after comparison method, Muhammad Zia Hydari, Yangfan Liang and Telang looked at revenue at 302 stores of Home Depot over 20 weeks around its September 2014 breach disclosure. They "found no evidence of a decline either across all stores or when sub-sampling by prior revenue size." That is one retailer, and the authors' broader conclusion about the laws is their own inference from it.

The cost can be counted in settlements. In July 2019 Equifax agreed to pay at least $575 million, and potentially up to $700 million, in a settlement with the FTC, the Consumer Financial Protection Bureau and 50 U.S. states and territories over a 2017 breach that affected about 147 million people.

What a notice tells you now

In 2009, California's governor saw no problem with what breach notices told people. In vetoing SB 20, Schwarzenegger wrote that "California's landmark law on data breach notification has had many beneficial results," but that the bill was "unnecessary, however, because there is no evidence that there is a problem with the information provided to consumers."

Seven months before the veto, Simitian had said otherwise. Many notices "may be clear and comprehensive," he said, but a substantial number left "consumers more confused than informed."

ITRC's 2025 report measures one part of that. In 2025, 70% of breach notices, 2,324 of them, did not include attack information, meaning they said nothing about how the breach happened. That share was up from 65% in 2024 and 45% in 2023.

"In 2020, nearly 100 percent (100%) of organizations provided root-cause details in public notices," the report says. "By 2025, this figure collapsed to just 30 percent (30%)." The word "collapsed" is ITRC's.

ITRC's count of compromises went up in 2025. Its count of people notified went down. It counted about 279 million victim notices in 2025, down 79% from about 1.4 billion in 2024, and it attributed the drop to "the lack of 'mega-breaches' in 2025." That was the lowest total since 2014.

The HHS healthcare list shows a similar swing. On that list, about 290 million people were affected in 2024 and about 141 million in 2025, while the number of breaches rose.

How often do people get these letters, and what follows? ITRC asked 1,040 people through the online platform SurveyMonkey in November 2025.

Eighty percent said they had received a breach notice in the past 12 months. Of those, 88% said they had at least one negative consequence. ITRC described the sample as "primarily tech-literate, middle-aged, mid-to-upper income," so it is not a measure of all Americans.

In 2002 the two sides disagreed about whether a person who got a notice could do anything with it. The mutual-fund group said no. The law's two nonprofit supporters wrote that year that "individuals who are at risk for identity theft place a fraud alert or a security freeze on their three credit reports."

In 2026, ITRC president James E. Lee said: "Freezing your credit and transitioning to passkeys are the foundational requirements for digital safety." He added: "Businesses should prioritize transparency over liability mitigation." Our guide on how to freeze your credit after a data breach covers the steps.

Still no federal law

In 2002 the Information Technology Association of America, the tech trade group opposing California's bill, wanted Washington, not the states, to handle breach notice. Twenty-four years later, the rules for most private companies are still state rules. "Most data breach notices are mandated by state laws that vary significantly from state to state," ITRC's 2025 report says.

The fight has been over who sets the standard. In 2015 the Obama White House proposed a 30-day notice requirement "while providing companies with the certainty of a single, national standard." It was never enacted. That March, Mallory Duncan of the National Retail Federation told a House subcommittee that "the experimentation in legislation that exists at the state level and that defines our federalist system has reached its breaking point," citing laws in 47 states.

The states pushed back. In July 2015, 47 attorneys general signed a letter opposing federal preemption of their laws, as 44 had in 2005. "We have seen in recent years how widespread data breaches have become, which is why our enforcement efforts cannot be constrained in any way," said Maryland Attorney General Brian E. Frosh.

Washington added narrower layers instead. On July 26, 2023, the Securities and Exchange Commission voted 3-2 to require public companies to report material cybersecurity incidents on Form 8-K. That is the form they use to tell investors about major events between regular reports. The reports go under a new section called Item 1.05, and they are generally due within four business days of deciding an incident is material. "I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way," said Chair Gary Gensler.

Commissioner Hester M. Peirce dissented. The new 8-K disclosures "could then tell successful attackers when the company finds out about the attack, what the company knows about it, and what the financial fallout is likely to be," she wrote. Filings began on December 18, 2023. In the first six months, 17 companies filed under Item 1.05 and 9 filed under other items, according to a count by consumer groups.

In late May 2025, the Securities Industry and Financial Markets Association and four banking groups petitioned the SEC to rescind Item 1.05. The National Association of Manufacturers backed the request in June 2025. Consumer Reports, the Consumer Federation of America, the Electronic Privacy Information Center and the Secure Resilient Future Foundation opposed it in July: "After only 18 months in effect, disclosure is providing relevant information to investors and helping promote transparency about the security posture of publicly traded firms."

In April 2026, the bank groups answered SEC Chair Paul Atkins's request for comment on reforming Regulation S-K, the agency's disclosure rulebook. They repeated that "the pre-existing principles-based disclosure framework" adequately covers material incidents. We found no Commission action on Item 1.05 through early November 2026.

A second federal rule is still in review. The Cyber Incident Reporting for Critical Infrastructure Act, known as CIRCIA, ordered the Cybersecurity and Infrastructure Security Agency (CISA) to write it. The rule would require critical-infrastructure companies to report covered incidents within 72 hours and ransom payments within 24 hours. The White House's regulatory review office logged the final rule on October 1, 2026, according to a security vendor's blog citing the trade outlet BankInfoSecurity, "four years after Congress ordered it and a year past the statutory deadline."

In 2026 CISA announced public town halls on "refining the scope and burden" of its 2024 proposal. The final rule had not appeared in the Federal Register as of early November 2026.

The European Union set a single deadline for its members. The GDPR, the EU's data protection law, has applied since May 25, 2018. Under it, a company must tell its regulator about a breach within 72 hours where feasible, unless the breach is unlikely to put people at risk.

The law firm DLA Piper counted an average of 443 notifications a day to European regulators in the year to January 27, 2026. That was up 22% from 363 a day, and it was the first time the average was above 400 since the GDPR took effect.

Those notifications follow a different trigger from U.S. state notices, so the two counts are not comparable. Our comparison of breach notification deadlines by country sets out the rules side by side.

Thirty days from discovery

On January 1, 2026, California's general breach law gained a fixed deadline for businesses. SB 446, authored by Senator Hurtado, passed the Senate 39-0 and the Assembly 74-0 in 2025. It requires notice "within 30 calendar days of discovery or notification of the data breach," with delays allowed for the legitimate needs of law enforcement or to determine the breach's scope and restore the system. State agencies fall under a separate section that still requires notice "in the most expedient time possible and without unreasonable delay."

Through October 29, 2026, the Attorney General's list held 480 notices for 2026. The full-year count, the first under the 30-day rule, can be compared with 2025's 565 once the list is complete in early January 2027. The rule sets how fast notices go out, not how many are filed, so the count alone will not show whether it changed anything. Our page on California's data breach notification law explains the current requirements.

ITRC's next annual report, its 21st, is likely in late January 2027 if it follows the timing of the 2025 report, which came out on January 29, 2026. It will show whether the count set another record and whether the share of notices saying nothing about how a breach happened kept rising.

The Teale workers were told of their breach 46 days after it happened. The law the Legislature passed that year set no fixed number of days for telling people.

Their letters went out 14 days after the break-in was found. The clock California now sets for businesses starts when a breach is discovered or reported to them, and it runs for 30 calendar days.

How we measured

ITRC counts. Compromises per year come from the year-over-year table in ITRC's 2025 Annual Data Breach Report (released January 29, 2026, the latest edition on October 31, 2026). ITRC restates earlier years: its 2025 report gives 1,278 for 2019 and 1,859 for 2021, which differ from older editions.

ITRC counts publicly reported compromises drawn from state attorney general filings, media reports and consumer notices. Victim notices are used only for 2024 and 2025, the two years confirmed in ITRC's press release; earlier years in the report's text could not be read reliably.

The report says it "was written with the assistance of Google's Gemini AI," with narrative and quality review by people. "About nine a day" is 3,322 divided by 365 (9.1). "Nearly three times" is 3,322 divided by 1,175 (2.8); "a little over twice" is 3,322 divided by 1,505 (2.2). Of the 3,322 compromises in 2025, the report classes 2,928 as data breaches, 24 as data exposures, 4 as previously compromised data and 366 as unknown.

States with a law. California is shown at 2003, when its law became operative (it was approved on September 25, 2002, Chapter 915). For 2005 to 2009 we use the adoption-year groups in the Romanosky, Telang and Acquisti working paper (8, 19, 8, 6 and 3 states); the paper does not say whether these are enactment or effective dates.

Later adoptions use signing dates reported at the time: Mississippi (2010), Kentucky (April 10, 2014), New Mexico (April 6, 2017), South Dakota (March 21, 2018) and Alabama (March 28, 2018). DC and the territories are not counted. "Twenty-seven states in 2005 and 2006" is 8 plus 19.

Teale dates. "46 days" is April 5 to May 21, 2002; "14 days after the break-in was found" is May 7 to May 21, 2002. "Counting for 13 years" is 2005 to 2018.

California Attorney General list. We downloaded the full CSV export on October 31, 2026 (5,393 rows, reported dates from January 20, 2012 to October 29, 2026) and counted rows by year of the reported date. The list covers notices sent to more than 500 Californians, under SB 24. "More than quadrupled" is 565 divided by 132 (4.3). One breach can appear once on this list and once in national counts; the list measures notices filed with one state.

HHS breach portal. The HHS Office for Civil Rights portal lists HIPAA breaches affecting 500 or more people. Our reporter downloaded both exports (archive and under investigation) on October 31, 2026, removed duplicates on entity name, submission date and number of individuals, and counted by year of submission; 2026 is partial. "Roughly quadrupled" is 806 divided by 199 (4.1). People-affected totals are sums of what entities reported, and one large breach can dominate a year.

FTC reports. Identity theft reports come from the Number of Reports by Type table in the Consumer Sentinel Network Data Book 2024 (March 2025), the newest edition listed on October 31, 2026. They are unverified consumer reports, not victims, and exclude Do Not Call complaints. "More than doubled" is 1,388,532 divided by 649,390 (2.1).

The studies. The Romanosky, Telang and Acquisti versions use FTC identity theft reports by state and year and compare states before and after adoption with states that had not adopted (difference-in-differences, with state and year fixed effects). The later draft's 5.7% estimate has a 95% confidence interval of about 1.7% to 9.8%; a linear version of the model gives about 4.1%, significant only at the 10% level. Neither the drafts nor the journal abstract state a funder. All three versions use total identity theft reports, which include thefts from every cause. The later draft and the 2011 abstract describe their estimate as the effect on identity theft caused by breaches, on the authors' argument that the laws should not change the other thefts; the 2008 draft states its result for identity theft in general. On the estimates chart a positive value is a reduction; the 2008 draft reported its estimate in identity thefts per 100,000 people rather than as a percentage, found it not statistically significant, and is drawn as a hollow marker at zero, and the 2011 abstract gives no interval.

What these data cannot show. No series here measures how many breaches actually happen. Each counts reports under its own rules, and those rules, the sources read and companies' willingness to report all changed over the period.

There is no count from before California's law to serve as a baseline. The ITRC consumer survey is a non-probability online sample. DLA Piper's European figures use the GDPR's trigger and are not comparable with U.S. counts.

Frequently Asked Questions

When did all 50 states have data breach notification laws?

In 2018. South Dakota's governor signed its law on March 21, 2018, and Alabama's on March 28, 2018, making Alabama the 50th state. California's law, the first, became operative on July 1, 2003.

How many data breaches were there in 2025?

The Identity Theft Resource Center counted 3,322 publicly reported U.S. data compromises in 2025, a record, and classed 2,928 of them as data breaches. The total was up from 3,152 in 2024 and 3,202 in 2023. ITRC says an unknown number of breaches are never publicly reported, so this is a count of what became public.

Are data breaches increasing, or are more being reported?

The available counts cannot separate the two. ITRC's count, the California Attorney General's list and the HHS healthcare list all rose over the past decade. But each counts reports under its own rules, and no count exists from before California's 2003 law to compare against.

Do data breach notification laws reduce identity theft?

A study by Romanosky, Telang and Acquisti found no statistically significant effect in a 2008 draft covering 2002 to 2006. A later draft covering 2002 to 2009 found a 5.7% average reduction in identity theft caused by breaches, and the 2011 published version found 6.1%. Every version used FTC identity theft reports from all causes. The later versions read their estimate as the effect on thefts caused by breaches. A 2% figure comes from a 2009 essay summarizing the research.

Is there a federal data breach notification law?

There is no general federal breach notification law for private companies. Federal rules cover specific sectors, such as health care under HIPAA. Public companies must also report material cybersecurity incidents to the SEC under Form 8-K Item 1.05. Industry groups have petitioned the SEC to rescind Item 1.05.

How long do companies have to notify Californians of a data breach?

Since January 1, 2026, businesses must notify affected Californians within 30 calendar days of discovering or being notified of the breach, unless a delay is needed for law enforcement or to determine the breach's scope and restore the system (SB 446). Before that, the general breach law required businesses to notify in the most expedient time possible and without unreasonable delay. That rule still applies to state agencies. A sample copy of any notice sent to more than 500 Californians must go to the Attorney General within 15 calendar days of notifying them.

What should I do if I get a data breach notice?

The Identity Theft Resource Center says freezing your credit is a foundational step. Our guide to freezing your credit after a breach covers the steps.