Overview
Publicly reported data breaches in the United States reached a record high in 2025, with more than 3,300 incidents generating nearly 280 mn victim notifications, according to the nonprofit Identity Theft Resource Center (ITRC).
The volume of notifications has continued to increase in 2026. More than 471 mn victim notices were issued during the first six months of the year, but many contained limited information about how attackers gained access or what information was compromised.
- The US recorded more than 3,300 publicly reported data breaches in 2025, generating nearly 280 mn victim notifications, according to the Identity Theft Resource Center.
- More than 471 mn breach notices were issued during the first half of 2026, but only 24% identified the attack method, the lowest disclosure rate recorded by the organization.
- Consumers are advised to verify breach notifications, identify what information was exposed and take appropriate action, including changing passwords, contacting banks or considering credit protection.
Only 24% of notifications identified the attack vector, the lowest proportion recorded by the ITRC, according to ESET report.
The lack of detail creates problems for affected individuals, businesses and policymakers trying to understand cybersecurity risks and prevent further incidents.
ITRC research found that approximately 75% of breach victims want a clear, plain-language explanation of exactly which personal information was compromised.
Why data breach notifications often lack information
Organizations may have several reasons for limiting the details included in initial breach disclosures. Companies frequently notify customers before completing forensic investigations, particularly when information about an incident has already become public. Establishing precisely which systems were accessed and what data was stolen can take weeks or months.
Security considerations can also restrict disclosure. Revealing technical vulnerabilities or attack methods may provide useful information to other cybercriminals, particularly if the original attackers still have access to affected systems.
Financial and reputational concerns may influence how much information companies release. Detailed disclosures can affect investor confidence, customer relationships and competitive positions.
Regulatory filings may contain considerably more information than the notifications provided directly to affected individuals. For consumers, however, limited disclosures make it difficult to evaluate the likelihood of identity theft, financial fraud or further misuse of personal information.
How to interpret a data breach notification
The wording of a breach notice can significantly affect how recipients understand their exposure. A statement that personal information was “accessed” does not necessarily confirm that the data was copied or removed from the organization’s systems.
Similarly, an assurance that investigators found “no evidence of misuse” does not guarantee that stolen information has not been distributed or exploited elsewhere.
Notifications stating that an individual “may have been affected” also leave uncertainty about whether their specific records were included.
Consumers should focus on four questions: whether information was accessed or stolen, which categories of data were affected, when the incident occurred and what protective measures the organization recommends.
The type of compromised information determines the appropriate response. Exposure of an email address creates different risks from the theft of banking credentials, passwords or government identification documents.
How consumers can respond to a data breach
Before taking action, recipients should confirm that a breach notification is legitimate.
Cybercriminals increasingly exploit awareness of data breaches by sending fraudulent alerts designed to obtain personal information or encourage victims to visit malicious websites.
Consumers should avoid clicking links in unsolicited breach notifications and instead contact the organization through independently verified websites or contact details.
Once an incident is confirmed, protective measures should reflect the information potentially exposed. If usernames or passwords were compromised, affected individuals should change their credentials immediately, including on other accounts using the same password, and enable two-factor authentication.
Exposure of banking or payment card information warrants contacting the relevant financial institution, monitoring transactions and requesting replacement cards where appropriate.
Stolen names, addresses, telephone numbers and healthcare information may increase exposure to targeted phishing attempts and impersonation scams.
Where passports, driver’s licenses or other government identification documents are involved, individuals should follow the issuing authority’s recommendations on replacement and identity protection.
Financial and identity information exposure may also justify credit monitoring or a credit freeze, depending on the circumstances.
Some organizations offer affected customers a year of free credit monitoring. Monitoring services can help identify suspicious credit activity, while a credit freeze restricts access to credit reports for new credit applications.
Neither measure eliminates every form of identity fraud, making continued account monitoring important.
As breach notifications become more common, their usefulness increasingly depends on the quality of information provided. Without clear disclosure of the affected data, incident timeline and recommended safeguards, consumers may struggle to assess their exposure and take appropriate steps to reduce the consequences of a breach.
