The numbers are in, and they are worse than expected. According to the Identity Theft Resource Center's 2025 Annual Data Breach Report, the United States experienced a record 3,322 data compromises in 2025 -- a five percent increase over 2024 and a staggering 79 percent jump over five years. Meanwhile, credential theft surged 160%, with 1.8 billion logins stolen, and combined identity fraud losses reached $38 billion. If you have not taken steps to protect your personal information, the data makes a compelling case for starting now.
Key Numbers From the ITRC 2025 Report
3,322 data compromises recorded -- a new all-time high. Financial Services was the most breached industry with 739 compromises, followed by Healthcare (534) and Professional Services (478). Social Security numbers were involved in two-thirds of all breach reports. 70% of breach notices did not include information about how the attack occurred, up from 65% in 2024.
The 2025 Breach Landscape by the Numbers
The ITRC has been tracking data breaches for 20 years, and 2025 set a new record. The 3,322 compromises surpassed the previous all-time high of 3,202 set in 2023 and exceeded the 3,152 compromises recorded in 2024. Over a five-year period, the number of annual data breaches has grown by 79 percent.
One piece of relatively good news: while the number of breaches increased, the total number of victim notices dropped sharply. Approximately 279 million victim notices were sent in 2025, down from over 1.3 billion in 2024. The decrease is largely because 2025 did not see the same scale of mega-breaches -- single incidents affecting hundreds of millions of people -- that defined 2024.
But the overall trend remains deeply concerning. Eighty percent of survey respondents in the ITRC report said they had received at least one data breach notification in the past 12 months.
The Biggest Breaches That Defined Recent Years
While 2025's breaches were spread across thousands of incidents rather than concentrated in a few massive ones, the aftershocks of major 2024 breaches continued to affect consumers throughout the year:
- National Public Data: A data broker breach that compromised Social Security numbers and personal information for nearly all Americans. The company ultimately filed for bankruptcy.
- AT&T: Hackers affiliated with the ShinyHunters group stole data on over 110 million AT&T Wireless customers. AT&T reportedly paid a $370,000 ransom to have the data deleted.
- Change Healthcare: A ransomware attack disrupted pharmacy transactions across the entire United States and triggered congressional hearings on healthcare cybersecurity.
- Ticketmaster: The ShinyHunters group claimed to have stolen a 1.3 terabyte dataset covering up to 560 million Ticketmaster customers.
- Snowflake customer breaches: More than 100 companies using Snowflake's cloud data platform were compromised through stolen credentials from infostealer malware, leading to cascading breaches across multiple industries.
These incidents illustrate a troubling pattern: breaches at one company feed credential theft and identity fraud at dozens of others, creating a chain reaction that expands the damage far beyond the original incident.
Credential Theft Exploded in 2025
One of the most alarming trends in the 2025 data is the surge in credential theft. According to Recorded Future, credential theft increased 160% over the course of 2025, with 50% more credentials identified in the second half of the year than the first. Flashpoint reported 1.8 billion credentials stolen from 5.8 million infected devices in the first half of 2025 alone -- an 800% increase.
IBM's research found that breaches involving stolen credentials now drive 22% of all incidents and cost an average of $4.81 million per breach. More concerning, 276 million stolen credentials included active session cookies, allowing criminals to bypass passwords and two-factor authentication entirely.
Your Data Is Already Out There
With 3,322 breaches in a single year and billions of credentials circulating on dark web marketplaces, the question is no longer whether your personal data has been exposed -- it almost certainly has. SpyCloud's 2025 research found over 53 billion unique identity records on the web. The focus now must shift from hoping you have not been breached to actively reducing the damage that exposed data can cause.
What This Means for You
The practical impact of these record-breaking numbers comes down to a few key realities:
- Your personal data is likely compromised. With Social Security numbers involved in two-thirds of breach reports and billions of credentials stolen, most Americans have had sensitive information exposed in at least one breach.
- Breach notifications are unreliable. Seventy percent of 2025 breach notices did not include information about how the attack occurred, making it difficult for consumers to assess their actual risk.
- The data gets combined and resold. Information from one breach gets merged with data from other breaches, data broker sites, and social media profiles to create comprehensive identity profiles that are sold to fraud rings.
- Delayed exploitation is common. Stolen data may not be used for months or even years after the initial breach, making it essential to maintain ongoing vigilance rather than reacting only when a breach is first announced.
Steps to Protect Yourself Now
1. Check if You Were Affected
Use free tools like HaveIBeenPwned.com to check whether your email addresses and passwords have appeared in known breaches. Review your credit reports at AnnualCreditReport.com for any accounts or inquiries you do not recognize.
2. Freeze Your Credit
A credit freeze at all three bureaus -- Equifax, Experian, and TransUnion -- is free and prevents criminals from opening new accounts in your name. It is one of the most effective single steps you can take after a breach.
3. Change Compromised Passwords
If any of your credentials have appeared in a breach, change those passwords immediately. Use a password manager to generate strong, unique passwords for every account. Enable two-factor authentication wherever available, and prefer authenticator apps over SMS-based codes.
4. Watch for Phishing Attempts
After major breaches, criminals often use stolen personal details to craft convincing phishing emails and texts. Be skeptical of any unexpected communication that asks you to click a link, verify your identity, or provide additional information -- even if it references a real company you do business with.
5. Remove Your Data From Data Broker Sites
Data brokers aggregate and sell your personal information -- names, addresses, phone numbers, email addresses, relatives, and more. This data is freely available on people-search websites and provides criminals with the missing pieces they need to exploit breached credentials. Removing your information from these sites reduces your overall exposure and makes it harder for fraud rings to build complete identity profiles.
6. Monitor Your Accounts and Credit
Set up transaction alerts on all financial accounts. Consider a credit monitoring service that provides real-time alerts for new inquiries and account openings. Review bank and credit card statements monthly for unauthorized charges.
Why Data Removal Is a Critical Layer of Protection
Breaches expose your data, but data brokers amplify the damage. When criminals combine breached credentials with the personal details freely available on people-search sites, they can bypass security questions, pass identity verification, and open fraudulent accounts with alarming ease.
PrivacyOn removes your personal information from over 100 data broker sites and continuously monitors for re-listing. By reducing the amount of personal data available about you online, PrivacyOn makes it significantly harder for criminals to use breached information against you. In a year when 3,322 data compromises set a new record, proactive data removal is no longer optional -- it is an essential part of any serious privacy strategy.
You cannot undo a data breach. But you can control how much of your personal information remains exposed and accessible to the criminals who profit from it.