Biggest Data Breaches of 2026: The Largest Confirmed Breaches, Ranked

The largest figure any organisation has confirmed for a data breach disclosed in 2026 is 81,329,467 email addresses, taken from the Japanese email delivery service Arara in an incident it announced on 29 October. The largest count of people is 30,000,000, the round figure that the US brokerage infrastructure firm DriveWealth reported on its filings with the Texas Attorney General and the Indiana Attorney General. The largest health data breach is DentaQuest's, at 15,000,000 people on the HHS breach portal. This list is current as of 13 November 2026.

Three things shape the 2026 ranking. Japan had an extraordinary autumn: eleven of the fifteen largest breaches are Japanese, and seven of those were first announced in the six weeks from 30 September to 9 November. Service providers sit behind the largest numbers, among them two email delivery vendors, an e-commerce platform, a booking platform and a brokerage back end. And most of the very large numbers in English-language headlines (280 million for Instructure, 153 million for IDScan.net, 72.7 million for Under Armour) are attacker claims or third-party counts, not figures the breached organisation has put its name to.

This page is the Stingrai research team's ranked reference for 2026. It lists the fifteen largest breaches for which the organisation itself, or a regulator's record of its filing, gives a figure, and it links every row to that primary source: a company notice or press release, a regulatory filing, a state attorney general portal or an SEC Form 8-K. The figures are not all the same kind of number, so every row names its unit and says when the figure is a maximum, a possible leak or a round estimate. Claims that could not be confirmed at the source are shown in separate tables with the name of whoever made them, and are not ranked.

Key facts at a glance

• Largest confirmed figure of 2026: Arara, 81,329,467 email addresses taken, a count of addresses and not people (Arara).

• Largest count of people: DriveWealth, 30,000,000, a round figure reported as the total affected on its Texas and Indiana filings; the Texas portal's visible table shows only the 2,556,688 Texans (Texas Attorney General, Indiana Attorney General).

• Largest deduplicated count of people: Estore, about 23,356,000 people across 7,858 current and former online stores (Estore).

• Largest health data breach of 2026: DentaQuest, 15,000,000 people on its HHS report of 16 July 2026 (HHS Office for Civil Rights); the Indiana register lists 29,000,000 as its total affected and does not say what that figure counts.

• Largest public-sector breach: URSSAF, the French social security collection body, with data on 12 million employees consulted and potentially extracted (URSSAF), ahead of France Titres at 11.7 million accounts provisionally concerned (France Titres).

• Where the fifteen largest happened: eleven in Japan, three in the United States and one in France.

• When they were announced: eight of the fifteen were first announced or filed between 29 September and 9 November 2026.

• What the figures count: six of the fifteen are counts of people; nine are counts of records, registrations or email addresses, and five of the fifteen are worded as possible or potential.

• Stated causes: seven of the fifteen involved a software flaw or an abused API or application function; six give no entry point; one involved a partner account with stolen login details; one involved a cloud environment.

• Largest count of people published in 2026 for an older breach: Conduent, 62,486,662 on a revised Texas filing, for a breach first reported in 2025 (Texas Attorney General).

• Largest unconfirmed figure: 280 million records, claimed by the ShinyHunters group for Instructure and not confirmed by the company (BleepingComputer).

Key takeaways

The biggest confirmed figures of 2026 are counts of records, and the list has to say so. Arara counted email addresses and states that the figure is not a number of people. Sagawa Express gives a maximum that includes duplicates. Ymirlink gives a cumulative count across 49 customer systems, and Helpfeel says most of Gyazo's account records are anonymous. Only six of the fifteen figures are counts of people, and the largest of those, DriveWealth's 30,000,000, is a round number on a regulatory form.

The biggest headline numbers are not confirmed at all. Have I Been Pwned counted 72,742,892 email addresses in the Under Armour data and 55,282,226 in the Suno data, and attackers claimed 280 million records from Instructure. None of those organisations has published a count of its own.

Six of the fifteen largest notices do not say how the attackers got in. DriveWealth describes "unauthorized access to our network". Sagawa Express, Nitori and Ryohin Keikaku say the cause is still being investigated. EPARK Riraku & Este says it is withholding the route.

Where a cause is given, it is rarely exotic. Arara names a web server vulnerability, Ymirlink a vulnerability in its software, Helpfeel a vulnerability in Gyazo's image upload server, Estore an application vulnerability that was exploited for more than two months, and KDDI a vulnerability in third-party software. Sourcenext says a member-information API was used to pull customer records. URSSAF describes a partner's valid login in the wrong hands.

One intrusion at a service provider becomes many organisations' breach. Arara and Ymirlink send email for other companies, Estore's platform has hosted 7,858 current and former online stores, EPARK's platform manages bookings and customer records for its client businesses, DriveWealth holds accounts opened through other brokers, DentaQuest administers benefits for health plans and KDDI's platform runs email for six internet providers. Customers of Arara, including Mos Food Services with 7,517,087 email addresses, have published their own notices for the same incident.

Counts keep moving after the headline. KDDI's first figure, on 23 June, was a maximum of 14.22 million email addresses and passwords; its 6 July release put the confirmed number at 12,231,954 people, 7,616,173 of them with a password exposed. EPARK's first figure of about 33 million records fell to about 22.18 million after duplicates were removed. Conduent's total for a breach reported in 2025 grew to more than 62 million during 2026. A ranking like this one is a dated snapshot, which is why every row carries the date of the document it rests on.

How this ranking was built

What counts as confirmed. A breach is ranked only when the organisation, or a regulator's record of the organisation's own report, gives a figure. The sources read for this page were company notices and press releases, the HHS Office for Civil Rights breach portal (both the under-investigation and archive lists), the Texas Attorney General data breach portal, the Indiana Attorney General's year-to-date breach report, notices filed with the California and Delaware attorneys general, and SEC filings on EDGAR. Every source was opened on 13 November 2026, and the latest notice of each of the fifteen ranked organisations was read again that day. Figures are as of 13 November 2026; several of these incidents are still being investigated and counts may be revised.

Which figure is ranked. The same rule applies to every row: the latest figure the organisation itself has stated, or, for US healthcare entities, the figure it reported to HHS, or, where its notice gives no figure, the total it reported to a state register. Where a state register shows a different total for the same breach, the row says so, and the breach is not ranked on that figure. DentaQuest is therefore ranked on the 15,000,000 it reported to HHS, with the Indiana register's 29,000,000 disclosed, and Aesto Health on its HHS figure, with its Texas figure disclosed. Lost media with no confirmed access is described in a note and not ranked.

What counts as 2026. The organisation's first public notice or first regulatory report of the breach is dated between 1 January and 13 November 2026. Breaches first reported in 2025 whose totals changed in 2026 are in their own table.

The figures are not all comparable, and the ranking does not pretend they are. There is one ranking, ordered by the figure each organisation stated, because that is the only number every incident has. But the figures measure different things:

• People. Six of the fifteen (DriveWealth, Estore, DentaQuest, IDScan.net, KDDI, URSSAF) are counts of individuals. Estore and KDDI say how they were counted. DriveWealth's and IDScan.net's are round figures reported as total individuals affected.

• Records, registrations or email addresses. Nine of the fifteen count rows of data. One person can account for several records, so these figures can exceed the number of people, sometimes by a wide margin. Arara, Sagawa Express, EPARK and Helpfeel all say in their notices that their figure is not a number of people.

• Maximums and possible leaks. Sagawa Express and Nitori give an upper bound for data that may have leaked; Ryohin Keikaku gave one in its first two reports, and its fourth report gives about 27.26 million records that may have leaked without calling it a maximum. Sourcenext gives the number of records that may have leaked. URSSAF says the data was consulted and potentially extracted. France Titres, just below the top fifteen, uses a provisional figure.

• Duplicates and cumulative counts. Sagawa Express's figure includes duplicates. Ymirlink's is a cumulative count across customer systems, so the same address can be counted more than once.

Every table row, the chart and the list data on this page carry the unit and the hedge. In the chart, counts of people are solid bars and counts of records are outlined bars. A reader who needs a people-only ranking should read the solid bars: DriveWealth, Estore, DentaQuest, IDScan.net, KDDI and URSSAF, in that order.

How candidates were found. The HHS portal's two lists were sorted by individuals affected. The Texas portal's records for 2026 (607 of them) were sorted by the total individuals affected that each filer reports; the visible table on that portal shows only the number of Texans, and the total sits in the same record without being displayed, so a reader following the link will see the Texas number. The Indiana report prints both an Indiana count and a total for each breach. Have I Been Pwned's list of breaches added in 2026, Tokyo Shoko Research's tally of leaks at Japanese listed companies, the Japanese Wikipedia list of 2026 incidents and several public breach trackers were used to find candidates, and each candidate was then checked against the organisation's own statement.

Coverage limits. The registers searched were the HHS portal and the Texas and Indiana attorney general registers in the United States; company notices were searched in English, Japanese, French, Dutch and Danish, with further searches for Korea, India, Latin America, Australia and the rest of Europe that surfaced no confirmed breach of seven million or more. Maine's public breach database, which normally lists totals, was offline when this page was researched; the Maine Attorney General's office says it took the database down after an apparent abuse of its reporting system. A confirmed breach of this size may still be missing, most likely one announced only in a language or on a register not covered here.

What was left out. Attacker claims, counts made by third parties and press estimates are not ranked. Notices from the customers of a breached vendor are described under the vendor and not ranked separately, because they count the same data twice. Murauchi.com, reported in the Japanese trade press at about 7.7 million, is not listed because the company's own notice could not be opened. Japanese incidents reported below seven million, among them Times Mobility and JR East, were not all checked.

The 15 biggest data breaches of 2026

Table 1: The 15 largest confirmed data breaches disclosed between 1 January and 13 November 2026, ranked by the figure the organisation stated or filed. The fourth column says what each figure counts. Sources are linked in each row.

Figure 1: The 15 largest confirmed data breaches disclosed in 2026, by the figure each organisation stated or filed. Solid bars are counts of people; outlined bars are counts of records, registrations or email addresses. Source: Stingrai analysis of company notices, the HHS breach portal and the Texas and Indiana attorney general registers, as read on 13 November 2026.

The six figures that count people add up to 105,587,954. All fifteen figures add up to 435,851,528, but that sum mixes people with records, includes maximums and duplicates, and counts some people several times, so it should not be quoted as a number of victims.

The five largest, in detail

1. Arara: 81,329,467 email addresses

Arara runs an email delivery service that other Japanese companies use to send newsletters and notices. It first announced the incident on 29 October 2026, the day it reported to Japan's Personal Information Protection Commission, and its first report gives the cause as a web server vulnerability exploited by a third party. The second report adds a problem in the system environment and says the start of the intrusion and its route are still being investigated. The third report, dated 6 November, adds that credentials were used without authorization to reach one further environment from 28 to 31 October. The service has been suspended since 31 October.

After removing duplicates between categories, the company puts the number of email addresses taken at 81,329,467, and states that this is a number of addresses and not of people.

Because Arara sends mail on behalf of its customers, those customers have issued their own notices for the same data. Mos Food Services, for example, reported 7,517,087 email addresses. Those notices overlap Arara's total and are not ranked separately here.

2. Sagawa Express: up to about 53.23 million records

Sagawa Express is a Japanese parcel carrier. Its fifth report, dated 23 October 2026, concerns unauthorized access to its parcel inquiry service. The company gives a maximum of about 53.23 million items of personal information that may have leaked, counted after removing some duplicates and still including others. It says plainly that waybill data contains many duplicates and that the figure does not show the real number of people.

The affected waybill data covers parcels handled between 21 June and 30 September 2026. Sagawa published its first report on 30 September and made its preliminary report to the Personal Information Protection Commission on 1 October. A sixth report restarted some services and left the count unchanged; the cause is still being established.

3. Ymirlink: 47,864,147 records

Ymirlink sells Cuenote FC, another widely used Japanese email delivery service. It confirmed unauthorized access on 16 October 2026 and announced it on 19 October. Its third report, dated 11 November, says a vulnerability in its software led to leaks from 49 customer systems and puts the delivery-list records leaked at 47,864,147. The company labels the figure a cumulative count, which means an address held by more than one customer is counted each time. Its second report had given 51,628,280, which the third report describes as a maximum estimate that fell once logs and databases were matched and double-counted records were removed.

Ymirlink and Arara were breached within two weeks of each other, and neither company links the two incidents. Between them, the two vendors account for about 129 million of the records on this page.

4. Nitori Holdings: up to 37.62 million records

The furniture and homeware retailer Nitori announced on 9 November 2026 that it had confirmed unauthorized access by a third party to a system it manages on 6 November, and that up to 37.62 million items of personal information held on its servers may have leaked. Its log analysis indicates there may have been access before 6 November as well. The cause, the route and the scope are under investigation with outside specialists, so both the figure and the wording may change.

5. DriveWealth: 30,000,000 people

DriveWealth runs brokerage accounts on behalf of other brokers, advisers and financial apps. Its notice letter says the company found unauthorized access to its network that took place on 4 and 5 September 2026, that the compromise was contained on 5 September, and that a document review finished on 28 September found each recipient's name and other data elements had been exfiltrated. The letter explains why many recipients will not recognise the company: they gave their details to another broker, adviser or financial institution, which passed them to DriveWealth so that it could open a brokerage account.

The letter gives no total. The 30,000,000 figure is the total individuals affected on DriveWealth's record in the Texas Attorney General portal, published on 2 October 2026, which also lists 2,556,688 Texans. The portal's visible table prints only the Texas number. The Indiana Attorney General's report lists the same 30,000,000 as the total affected, with 460,956 Indiana residents and a notification date of 29 September. The total is a round figure, so it may be revised, and nothing in the record limits it to US residents. It is the largest count of people filed with a US regulator for a breach disclosed in 2026. The notice does not say how the network was entered.

Notes on the rest of the top fifteen

Ryohin Keikaku (6). The operator of MUJI announced a possible leak from its app on 30 October 2026, already with a maximum of about 27.26 million records. Its second report of 4 November widened the group covered to customers of the online store, and a fourth report of 9 November gives the figure as about 27.26 million records that may have leaked, no longer as a maximum, and reports a wave of login attempts on the online store using passwords obtained elsewhere.

Gyazo (7). Helpfeel, which runs the screenshot service Gyazo, confirmed that about 23.62 million user records were disclosed after a vulnerability in its image upload server was exploited on 11 September 2026. Its second notice breaks that down: about 18.01 million records are anonymous accounts with no registered email address, and about 5.62 million have one. Helpfeel says the figure is a number of accounts, not people.

Estore (8). The final report on its ShopServe platform is the most complete on this list: an application vulnerability was exploited from 21 May to 1 August 2026, about 23,356,000 people were affected across 7,858 current and former stores, and about 2,096,900 of them had partial card data included.

Sourcenext (9). Sourcenext confirmed unauthorized access to its member system at about 09:00 on 13 October 2026 and contained it by 13:36. The access began on 9 October, and a third party used the member-information retrieval API to obtain customer data. The 22,519,960 figure is the number of records that may have leaked.

EPARK Riraku & Este (10). The company's second report confirms that the contents of the customer database behind its PeakManager booking platform were transferred out and that data was then deleted. It reduced its first figure of about 33 million records to about 22.18 million by merging duplicates, and says the result still cannot be converted into an exact number of people.

DentaQuest (11). Its notice, first published on 26 May 2026, says unauthorized individuals accessed its network from 17 to 20 May. The data includes names, addresses, Social Security numbers, member, Medicaid and Medicare numbers, and dental or vision health information. Its 15,000,000 is the largest report submitted to HHS in 2026, on either list of the portal, and its Texas filing gives the same figure. The Indiana Attorney General's report lists 29,000,000 as the total affected for the same breach, with 139,500 Indiana residents; the register does not explain what the larger figure counts, so the ranking stays on the HHS report. Stingrai covered the incident in more depth in its review of healthcare cyberattacks in 2026.

Skyticket (12). Adventure Inc. announced three separate incidents on 9 October 2026. Besides the main one, 17,780 records were reached through a vulnerability in a back-office system, and about 12,000 bus bookings could be viewed because a confirmation page was reachable without logging in.

IDScan.net (13). Its notice says an unauthorized third party had access to part of its cloud environment, limited to the VeriScan platform, from 4 April to 2 September 2026. The 13,000,000 on its Texas filing is a round figure, and the same record lists a single Texas resident, which suggests it was filed before a breakdown existed. The 153 million figure in news coverage is covered below.

KDDI (14). The platform serves six internet providers, and the count covers their email users, not KDDI's own mobile customers. KDDI says the software vendor did not know of the vulnerability when KDDI found it on 17 June 2026.

URSSAF (15). The agency says the login details of a partner organisation's account had been stolen in an earlier attack on that partner, and were then used on the API that lets partners look up pre-hiring declarations. The data covers employees hired in the previous three years.

Other confirmed breaches of about seven million or more

Twelve more breaches disclosed in 2026 carry a figure of about seven million or more that was confirmed at the source. They follow the top fifteen in descending order.

Table 2: Other breaches disclosed in 2026 with a confirmed figure of about seven million or more, in descending order. Sources are linked in each row.

Not ranked: a missing backup drive. Kyushu Electric Power Transmission and Distribution announced on 8 June 2026 that a backup storage device holding customer information could not be found, and said no leak of the information had been confirmed. Its report of 8 July puts the contents at 10.03 million personal customer records, or 13.54 million including corporate contracts. It is left out of the ranking because it is lost media with no confirmed access to the data, not because of its size: at 13.54 million it would be thirteenth, and at 10.03 million it would be twentieth.

Verified breaches between five and seven million

This band is not exhaustive. These eight were confirmed at the source; others in the same range, mostly in Japan, were not all checked for this edition.

Table 3: Verified breaches disclosed in 2026 with a figure between five and seven million. Sources are linked in each row.

Carnival's cause comes from its notification letter as quoted by BleepingComputer: an unauthorized actor used social engineering to deceive an employee and gain access to a limited part of its IT system. Odido names the ShinyHunters group and says it did not pay the ransom; its page gives the attack dates but not the date of its announcement.

Older breaches whose totals grew in 2026

Some of the largest numbers published in 2026 belong to breaches that were first reported earlier, so they are not in the ranking above.

Table 4: Breaches first reported before 2026 whose totals were published or revised in 2026. Sources: Texas Attorney General and HHS Office for Civil Rights.

Conduent is the clearest example of how long a count can keep rising. At 62 million, its total is more than twice the largest count of people for any breach first disclosed in 2026, and it reached that level more than a year after the intrusion ended. TriZetto Provider Solutions is here and not in the ranking because its letter says it began notifying affected providers on 9 December 2025; only its regulatory reports are dated 2026.

Large leaks counted by third parties, not by the company

Have I Been Pwned loads leaked datasets and counts the unique email addresses in them. Those counts are careful and independent, but they measure what was published, and they are not the organisation's own figure. The largest single-organisation datasets it added in 2026 are below.

Table 5: The largest single-organisation datasets added to Have I Been Pwned in 2026, by unique email addresses. Source: Have I Been Pwned breach list, as read on 13 November 2026.

Under Armour and Suno are dated November 2025 but only surfaced publicly in 2026, so they are listed. Two other large additions, Canadian Tire (38,306,562) and SoundCloud (29,815,722), were loaded in 2026 for incidents that Have I Been Pwned describes as occurring or announced in 2025, so they are left out, as are Raaga (10,225,145, dated December 2025) and LimeLeads (17,838,396, a 2019 breach loaded in 2026).

Claims that are larger than the confirmed counts

Table 6: Attacker claims set against what each organisation has confirmed.

Instructure deserves a plain statement. If the 280 million figure were confirmed it would be the largest of the year by a wide margin, and the incident was serious enough that universities issued their own statements. But a count of records across thousands of institutions is not a count of people, and Instructure has not published one, so the incident is not ranked here.

One more case shows why the source matters. The Cegedim Santé incident in France has been widely described in terms of patients, but the company's own statement of 26 February 2026 gives a different measure: its MLM software is used by 3,800 doctors, of whom 1,500 were affected. It gives no patient count and says the activity was identified at the end of 2025, so the incident is not ranked.

What the causes say

Figure 2: Cause as stated in the notice or filing for each of the 15 largest breaches of 2026. Source: Stingrai grouping of the wording each organisation used, as read on 13 November 2026.

A software flaw, an API or an application function (7 of 15). Arara, Ymirlink, Helpfeel, Estore and KDDI each name a vulnerability: in a web server, in the vendor's own software, in an image upload server, in an application and in third-party software. KDDI adds that the vendor did not know of the flaw when KDDI found it, and Arara says its entry route is still under investigation. Sourcenext's and Skyticket's accounts are different in kind: an API and an administrative function did what they were built to do, for someone who should not have been able to ask.

No entry point stated, withheld or still under investigation (6 of 15). Sagawa Express, Nitori and Ryohin Keikaku say the cause is being investigated. DriveWealth and DentaQuest describe unauthorized access to a network without saying how it began. EPARK Riraku & Este says it will not publish the route because doing so could invite similar attacks. Several of these notices were written within days of discovery, and some will be updated.

A partner account with stolen login details (1 of 15). URSSAF says the stolen login details of a partner organisation were used on an API meant for partners.

A cloud environment (1 of 15). IDScan.net says a portion of its cloud environment was accessed for about five months and does not say how the attacker authenticated.

The breaches just below the top fifteen add more routes. Capcom says it has identified and addressed the attack method but does not describe it. iRhythm told investors its data "was obtained through social engineering", AssuranceAmerica traces its incident to malicious activity that "targeted one of the Company's employees", and Odido and Carnival describe the same thing; Odido's account is specific, a caller who pretended to be a member of its IT staff. In Denmark nobody broke into the register at all: the ministry says outsiders used a private Danish company's legitimate right to look up register data, within the limits of what private companies may see, to collect names, addresses and personal identity numbers for about 8.8 million registered persons. Aesto Health and Daiichi Kosho both lost data from systems that held it for someone else, an archive in a cloud environment and a contractor's computer.

For the wider picture beyond these incidents, including the annual industry figures on breach causes and costs, see Stingrai's data breach statistics for 2026.

What the causes mean for security testing

A ranked list of other organisations' breaches is useful when it changes what gets tested. Six checks follow from the stated causes above.

1. Test what every API and administrative function will return, and to whom. Sourcenext and Skyticket both describe functions that handed over data in bulk. A web application penetration test or API penetration test should try each role, and no role at all, against every endpoint that returns member data, and should check whether anything limits how much one caller can pull. Stingrai's API security statistics cover broken authorization in more depth.

2. Find the pages that work without logging in. One of Skyticket's three incidents was a booking confirmation page that could be read by anyone. Unauthenticated access to an object that should belong to one customer is among the first things a tester checks, and among the cheapest to fix.

3. Rehearse the phone call. Odido, Carnival, iRhythm and AssuranceAmerica were all reached through a person. A phishing or vishing campaign run against the service desk and customer service team shows whether identity is verified before access is granted or reset. The vishing statistics for 2026 cover how this technique grew.

4. Test the cloud environment, not just the application in front of it. IDScan.net and Aesto Health both lost data from cloud storage or infrastructure. A cloud penetration test follows the paths from one identity or workload to the data stores behind it, including archives and backups that no longer serve a live product.

5. Treat partner access as an attack path. URSSAF and the Danish register were both reached through a partner's valid access, and Arara, Ymirlink, Estore and DriveWealth show how much of other organisations' data one service provider can hold. Testing should cover what a partner account, a vendor integration or a support login can read, and whether anyone would notice a partner reading everything. Stingrai's supply chain attack statistics track the same exposure.

6. Check the components nobody owns. Arara, Ymirlink, Helpfeel, Estore and KDDI each trace their breach to a flaw in a web server, an application or third-party software, and Estore's was exploited for more than two months before it was noticed. Penetration tests of internet-facing applications should include the libraries and embedded third-party software they depend on, and the detection that would show such a flaw being used.

Where Stingrai fits

Stingrai is a CREST-accredited penetration testing company offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters.

The causes on this page map onto work the team does every week. Web application and API tests are run authenticated across every user role and focus on broken authorization, IDOR and business logic, the classes behind bulk data retrieval through an API or an administrative function. Cloud penetration tests cover AWS, Azure and Entra ID, and Google Cloud from the control plane to the workloads and storage. Phishing and vishing campaigns test whether a service desk can be talked into granting access, and red team engagements chain those routes together against an agreed objective.

Findings are posted to the PTaaS portal as they are confirmed, each with a working proof of concept and remediation guidance, and retesting of fixed findings is included. Engagements run as one-time tests or continuous programs. For one web application and associated APIs there are two published packages: the Autonomous Pentest, run by Snipe, Stingrai's autonomous AI agent for web applications and associated APIs, is US$3,000 one-time, and the Hybrid Pentest, in which Snipe and human penetration testers test together, is US$6,800 one-time. Both are on the pricing page. Network, cloud, mobile, social engineering and red team work is scoped per engagement.

Frequently Asked Questions

What is the biggest data breach of 2026?

As of 13 November 2026, the largest figure confirmed by an organisation for a data breach disclosed in 2026 is Arara's: 81,329,467 email addresses taken from the Japanese email delivery service in an incident announced on 29 October 2026, a count of addresses and not of people. The largest count of people is DriveWealth's 30,000,000, a round figure reported on its Texas and Indiana attorney general filings after unauthorized access to its network on 4 and 5 September 2026.

How many people were affected by the biggest data breaches of 2026?

Six of the fifteen largest confirmed breaches disclosed in 2026 give a count of people, and those six add up to 105,587,954: DriveWealth, Estore, DentaQuest, IDScan.net, KDDI and URSSAF. The other nine give counts of records, registrations or email addresses, several of them maximums or possible leaks, so the fifteen figures cannot be added into one number of victims.

What caused the biggest data breaches of 2026?

Seven of the fifteen largest breaches involved a software flaw or an abused API or application function. Six give no entry point in their notices, withhold it or are still investigating, one involved a partner account with stolen login details, and one involved a cloud environment with no entry point stated.

Is the Instructure Canvas breach the biggest of 2026?

It is the largest claim, not the largest confirmed figure. The ShinyHunters group says it stole 280 million records from 8,809 schools, districts and platforms, according to BleepingComputer's report of 5 May 2026. Instructure has confirmed a breach but has not published a count of people affected, so the incident is not ranked.

Why is Conduent not in the ranking?

Conduent's breach was first reported in 2025, so it falls outside a list of breaches disclosed in 2026. Its total did grow in 2026: a revised Texas filing published on 20 May 2026 lists 62,486,662 people, and the HHS portal shows 62,224,658. That is the largest count of people published in 2026 for any breach on this page.

Which countries had the largest data breaches in 2026?

Eleven of the fifteen largest confirmed breaches disclosed in 2026 are in Japan, three are in the United States and one is in France. Seven of the eleven Japanese breaches were first announced between 30 September and 9 November 2026, and four of the five largest figures come from Japanese notices.

What is the largest healthcare data breach of 2026?

DentaQuest, at 15,000,000 people, is the largest report submitted to the HHS Office for Civil Rights breach portal in 2026; the Indiana Attorney General's register lists 29,000,000 as the total affected for the same breach. Aesto Health is second at 9,540,683, iRhythm Technologies is third at 8,179,772 and Lumexa Imaging is fourth at 5,830,949. The largest healthcare breach ever reported to the portal remains Change Healthcare, at 192,700,000 people in 2024.

Why do breach counts differ between sources?

Organisations, regulators, researchers and attackers count different things. A company may report people, accounts or records, a regulator's portal may show only residents of one state, Have I Been Pwned counts unique email addresses in leaked data, and attackers quote record totals that can include duplicates. Some figures are maximums for data that may have leaked, and counts change as investigations finish.

How to cite this page

Stingrai. "Biggest Data Breaches of 2026: The Largest Confirmed Breaches, Ranked." Stingrai Blog, 13 November 2026. https://www.stingrai.io/blog/biggest-data-breaches-2026

This compilation is licensed under CC BY 4.0.

References

1. Texas Attorney General. Data Security Breach Reports. https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage. Public portal of breach reports filed with the state; source for total individuals affected and dates for DriveWealth, IDScan.net, AssuranceAmerica, TriZetto Provider Solutions, Carnival, Marathon Health, Conduent, Cerner and Episource.

2. US Department of Health and Human Services, Office for Civil Rights. Breach Portal. https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf. Federal record of health data breaches affecting 500 or more people; source for DentaQuest, Aesto Health, iRhythm, Lumexa Imaging, TriZetto, Conduent and Change Healthcare.

3. DriveWealth. Notice of Data Breach, filed with the California Attorney General. https://oag.ca.gov/system/files/DriveWealth%20-%20Redacted%20Notice.pdf. Dates and description of the incident.

4. Sourcenext. Notice of customer information leak following unauthorized access, 15 October 2026. https://www.sourcenext.com/support/i/2026/1015_info/. Count, dates and the API route.

5. DentaQuest. Notice of Data Breach, first published 26 May 2026. https://www.dentaquest.com/en/notice-of-data-breach. Dates and data types.

6. Adventure Inc. Skyticket notice of customer information leak, 9 October 2026. https://skyticket.jp/news/maintenance/67603/. Three incidents, counts and causes.

7. IDScan.net. Notification of Data Security Incident, updated 29 September 2026. https://idscan.net/notification-data-security-incident/. Access window and data types.

8. KDDI. Press release on unauthorized access to its email system for internet providers, 6 July 2026. https://newsroom.kddi.com/english/news/assets/2026/kddi_nr-1115_4645/kddi_nr-1115_4645_pdf_01.pdf. Final counts and cause.

9. Capcom. Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, 22 October 2026. https://www.capcom.co.jp/ir/english/news/html/e261022.html. Record count and timeline.

10. France Titres (ANTS). Security incident update of 21 April 2026. https://ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026. Provisional account count and data types.

11. BK Japan. Notice of member information leak from the Burger King official app, 15 October 2026. Archived copy: https://web.archive.org/web/20261019002347/https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf. Count and dates.

12. Monogatari Corporation. Notice of personal information leak from the Yakiniku King app, 5 October 2026. https://www.monogatari.co.jp/news/261005_news/. Count and dates.

13. Aesto Health. Notice of Data Security Incident, 24 June 2026, archived copy. https://web.archive.org/web/20260909182524/https://www.aestohealth.com/notice-of-data-security-incident-12-18-25/. Access window and environment.

14. Danish Ministry of Research, Education and Digitalisation. Press release on unauthorized access to Central Person Register data, 5 October 2026. https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/. Count and method.

15. iRhythm Holdings. Form 8-K, Item 1.05, filed 15 June 2026. https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm. Cause and timeline.

16. AssuranceAmerica. Individual notice letter filed with the Delaware Attorney General. https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2026/06/AA-Individual-Notice-Letter-Delaware.pdf. Dates and cause.

17. TriZetto Provider Solutions. Notice letter, hosted by Brown University Health. https://www.brownhealth.org/sites/default/files/2026-03/Trizetto-1.pdf. Portal access and dates.

18. Odido. Update about cyberattack. https://www.odido.nl/veiligheid-eng. Count, method and attribution.

19. Helpfeel. Notices on unauthorized access to Gyazo, 16 and 25 September 2026. https://corp.helpfeel.com/en/news/news-20260925. Record counts and the split between anonymous and registered accounts.

20. Have I Been Pwned. Pwned websites. https://haveibeenpwned.com/PwnedWebsites. Counts of unique email addresses in leaked datasets, with breach and added dates.

21. BleepingComputer. Reports on Instructure (5 May 2026), IDScan.net and Carnival. https://www.bleepingcomputer.com/news/security/instructure-hacker-claims-data-theft-from-8-800-schools-universities/. Source for attacker claims and for the wording of Carnival's letter.

22. Cegedim. Press release of 26 February 2026. https://www.cegedim.fr/Communique/Cegedim_Communique26022026.pdf. Doctors affected by the MLM incident.

23. Arara. Third report on the information leak and service suspension, 6 November 2026. https://www.arara.com/dcms_media/other/arara_20261106_.pdf. Count of email addresses taken and dates; the first and second reports, linked in the text, give the cause.

24. Sagawa Express. Fifth report on unauthorized access to its parcel inquiry service, 23 October 2026. https://www2.sagawa-exp.co.jp/information/detail/430/. Maximum record count, duplicates and period covered; first report 30 September 2026.

25. Ymirlink. Third report on unauthorized access to its systems, 11 November 2026. https://www.ymir.co.jp/info/ymir-information20261111.html. Revised cumulative record count, systems affected and cause.

26. Nitori Holdings. Notice of unauthorized access, 9 November 2026. https://www.nitorihd.co.jp/news/items/2b702dbe4d438f7fef74945d68e5bd27_3.pdf. Maximum record count and dates.

27. Ryohin Keikaku. Second and fourth notices on a possible leak of MUJI app customer information, 4 and 9 November 2026. https://files.microcms-assets.io/assets/1abbce69114443b0af3672230990db72/76bbc0db48474ee1b82866248e210ddb/261104_MUJI%20app.pdf and https://files.microcms-assets.io/assets/1abbce69114443b0af3672230990db72/a68ea996d5614c8d8b44655c4cf4de95/261109_%E7%AC%AC4%E5%A0%B1%E3%83%AA%E3%83%AA%E3%83%BC%E3%82%B9.pdf. Maximum record count and scope.

28. Estore. Final report on the ShopServe information leak, 16 October 2026. https://estore.jp/press/20261016/. People affected, stores, dates and cause.

29. EPARK Riraku & Este. Second notice on unauthorized access and personal information leak. https://www.epark-relax.co.jp/news/231. Record count after de-duplication and findings.

30. URSSAF. Press release of 19 January 2026, archived copy. https://web.archive.org/web/20260120082425/https://www.urssaf.org/accueil/espace-medias/communiques-et-dossiers-de-press/communiques-de-presse/2026/l-urssaf-appelle-a-la-vigilance-.html. Employees concerned, data types and the partner account route.

31. Daiichi Kosho. Notice of a possible leak at a contractor, 8 October 2026. https://www.dkkaraoke.co.jp/news/newsletter/261008_2.html. Record count and cause.

32. Sharefull. Notice of a possible leak following unauthorized access to an internal management system. https://sharefull.com/information/9480/. Maximum account count and dates.

33. Bookoff Group Holdings. Follow-up notice of 13 October 2026 on the member information leak. https://ssl4.eir-parts.net/doc/9278/tdnet/2894129/00.pdf. People affected and dates.

34. Ride On Express Holdings. Notice of a possible leak following a cyberattack, October 2026. https://www.rideonexpresshd.co.jp/news/2026/10/3-33.html. Maximum record count.

35. Yamato Transport. Update on unauthorized access to its pay-later service. https://www.yamato-hd.co.jp/important/info_260929_1.html. Record count and dates.

36. Mos Food Services. Notice on the leak of email addresses following the Arara incident, 4 November 2026. https://www.mos.jp/topics/20261104_2/. A customer notice for the Arara incident.

37. Indiana Attorney General. Data breach year-to-date report, November 2026. https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-Novemver-2026.pdf. Indiana and total affected counts and notification dates for DriveWealth and DentaQuest.

38. Iris Ohyama. Second report on the Iris Plaza online store, 5 November 2026. https://www.irisohyama.co.jp/news/2026/amp/?date=1105. People whose stored data may have been viewed or obtained.

39. Nojima. Notice on the Nojima Online member information leak, 2 November 2026. https://www.nojima.co.jp/wp-content/uploads/2026/11/fa47750556e505f2ddb83dc080a6420f.pdf. Member record count and dates.

40. Joshin. Notice of 26 October 2026. https://www.joshin.co.jp/ja/ir/news/auto_20261026556267/pdfFile.pdf. Maximum record counts.

41. Kyushu Electric Power Transmission and Distribution. Release of 8 June 2026 and report of 8 July 2026 on a missing storage device. https://www.kyuden.co.jp/td/press/2026/260608.html. Contents of the missing device; no leak confirmed.

Related reading

• Data Breach Statistics 2026: Cost, Frequency, Causes and Timelines

• Healthcare Data Breach Statistics 2026

• Healthcare Cyberattacks 2026: DentaQuest, Aesto, Medtronic, Stryker and iRhythm

• Financial Services Cyberattacks 2026

• Supply Chain Attack Statistics 2026

• Vishing Statistics 2026

• API Security Statistics 2026

• Recent Cyber Attacks 2026: A Month-by-Month Timeline

Talk to Stingrai

A breach list shows where others were exposed. A penetration test shows where your own applications, cloud environment and service desk stand against the same routes. Request a quote or see the published packages on the pricing page.