Data Breaches Explode: Companies Reveal Less

The first half of 2026 witnessed a significant escalation in data compromises, with the Identity Theft Resource Center tracking 1,803 publicly reported incidents. These breaches generated an estimated 471.2 million victim notices, more than doubling the revised total from the same period last year and exceeding all of 2025. This surge is largely attributed to megabreaches, notably an attack on the Canvas education platform which alone accounted for 275 million victim notices.

Concurrently, companies are providing increasingly scant details about the nature of these security failures. Only 24% of breach notices analyzed by the ITRC offered specifics on attack methods, marking the lowest disclosure rate on record. This lack of transparency, described as an "unprecedented transparency crisis," leaves consumers and businesses ill-equipped to assess their actual risks.

Several factors may be contributing to these trends. Insider wrongdoing, such as employees abusing their access, saw a seven-fold increase in reported incidents compared to the previous year. Mass layoffs are cited as a potential driver, with data theft by departing employees spiking significantly before official notifications. Additionally, sophisticated operations by foreign entities, like North Korean operatives targeting remote IT jobs, exploit existing access to steal sensitive data and extort employers.