Data studies / Data breach notice statistics

Data breach notice statistics: state attorney-general filings and HIPAA breach reports

Monthly counts of data breach notices filed with state attorneys general and HIPAA breach reports filed with HHS, how long organizations took to notify, the causes they report and the data exposed.

Key findings

1. From 2025-11 to 2026-10, 776 data breach notices were filed with the California, Washington, Delaware attorneys general in the datasets tracked here; California received 548 (70.6%). #
2. Where the notice states both dates, organizations took a median of 92 days from the breach to notifying the state (228 notices). #
3. Of 183 notices that state a cause, 66.7% were Cyberattack. #
4. Of 45 notices that list the data exposed, 21 (46.7%) included SSN. #
5. Over the same 12 months, 455 HIPAA breaches affecting 500 or more people were reported to HHS, affecting 76,558,179 individuals in total; 94.1% were hacking or IT incidents. #
6. The largest HIPAA breach report in the period was DentaQuest, LLC, affecting 15,000,000 individuals. #

<iframe src="https://zalwin.com/embed/studies/data-breach-notice-stats/ag-notices-monthly" width="100%" height="350" style="border:0;max-width:680px" title="Breach notices filed with state attorneys general, per month" loading="lazy"></iframe>
<p>Source: <a href="https://zalwin.com/studies/data-breach-notice-stats">Zalwin Data breach notice statistics</a></p>

<iframe src="https://zalwin.com/embed/studies/data-breach-notice-stats/hipaa-monthly" width="100%" height="350" style="border:0;max-width:680px" title="HIPAA breaches (500+ people) reported to HHS, per month" loading="lazy"></iframe>
<p>Source: <a href="https://zalwin.com/studies/data-breach-notice-stats">Zalwin Data breach notice statistics</a></p>

<iframe src="https://zalwin.com/embed/studies/data-breach-notice-stats/data-types" width="100%" height="336" style="border:0;max-width:680px" title="Data types exposed, state attorney-general notices (last 12 months)" loading="lazy"></iframe>
<p>Source: <a href="https://zalwin.com/studies/data-breach-notice-stats">Zalwin Data breach notice statistics</a></p>

<iframe src="https://zalwin.com/embed/studies/data-breach-notice-stats/hipaa-breach-type" width="100%" height="192" style="border:0;max-width:680px" title="HIPAA breach reports by type (last 12 months)" loading="lazy"></iframe>
<p>Source: <a href="https://zalwin.com/studies/data-breach-notice-stats">Zalwin Data breach notice statistics</a></p>

<iframe src="https://zalwin.com/embed/studies/data-breach-notice-stats/hipaa-largest" width="100%" height="336" style="border:0;max-width:680px" title="Largest HIPAA breach reports, last 12 months (individuals affected)" loading="lazy"></iframe>
<p>Source: <a href="https://zalwin.com/studies/data-breach-notice-stats">Zalwin Data breach notice statistics</a></p>

Notices by state attorney general (last 12 months)

Methodology and data provenance

• Source: California, Washington and Delaware attorney-general breach notices; HHS OCR breach portal. 2025-11 to 2026-10: 776 attorney-general notices and 455 HHS reports.
• A notice is one filing with one state; a breach notified to several states counts once per state.
• Days to notify uses the breach date and notice date stated on the filing, where both are present.
• HIPAA reports are those HHS publishes (breaches affecting 500 or more people); counts are by submission date.
• Updated every 6 hours from the state and HHS breach portals; the current month is excluded until it ends.
• Organization-level public records only. Informational; verify individual records at the official source.

Cite or embed this study

Zalwin, "Data breach notice statistics: state attorney-general filings and HIPAA breach reports" (data as of 2026-11-05), https://zalwin.com/studies/data-breach-notice-stats

Copy citation

Journalists, researchers and bloggers may republish these charts with a link to this page. The chart data is free to download as CSV.

Search breach notices Search HIPAA breach reports All data studies