Data compromises in the U.S. reached 1,803 in the first half of 2026, already surpassing last year's full-year total, as AI-enabled attacks climbed 56% and malicious insider incidents hit an all-time high, according to the Identity Theft Resource Center.
The number of reported data compromises in the United States has already surpassed the full-year tally for 2025, with artificial intelligence playing an expanding role in enabling attacks, according to a new report from the Identity Theft Resource Center.
In the first half of 2026, there were 1,803 reported data compromises, up from 1,732 during the same period a year earlier, the ITRC found. If the second half of the year mirrors the first, the final count will eclipse the 3,321 incidents recorded for all of 2025.
The victim toll is particularly stark. More than 471 million victim notices were tied to data compromises in the first six months of the year, compared with 297.5 million notices issued across all of 2025. A single incident — a cyber breach at education tool Canvas — accounted for more than half of those notices, at 275 million.
"We continue to see this ever-increasing number of data breaches," said James Lee, president of the ITRC. "That does not appear to be slowing down."
The rise in incidents coincides with the growing use of AI by threat actors. Between March 2025 and February 2026, one in four breaches was AI-enabled, a figure that represents a 56% increase from the prior year, according to a separate study from IBM. Improving AI capabilities are making it easier for attackers to identify and exploit vulnerabilities in corporate systems, analysts say.
The surge in breaches is landing on the radar of corporate boards. Cybersecurity ranked among the top three priorities for 93% of audit committees at public companies, according to a 2025 survey from Deloitte's Center for Board Effectiveness and the Center for Audit Quality. Separately, 78% of companies across 72 countries indicated they would increase cybersecurity budgets over the next 12 months, according to an October PwC survey of 3,887 business and technology executives.
A particularly sharp increase involved malicious insiders — people within organizations who exploit internal access to steal data. The ITRC counted 21 such events in the first half of 2026, compared with just three for the entirety of 2025.
Lee called the historical jump significant. "We've never seen more than three data breaches in a given year related to a malicious insider, and you get 21 in six months," he said.
Part of the increase stems from disgruntled laid-off employees who, according to Lee, "were stealing information on their way out the door." The ITRC report also points to a scheme flagged by the FBI in which North Korea plants remote IT workers inside U.S. businesses using stolen identities, deepfake videos during job interviews, and AI-generated resumes. The report describes this as "arguably the most significant structural driver of malicious insider attacks."
The true scale of malicious insider incidents may be even larger than the data suggests, Lee said. Only 24% of breach notices sent to affected consumers in the first half of 2026 included details about what occurred — a sharp decline from 93% in 2021. Lee attributed the drop partly to legal pressure that has led companies to include only the minimum disclosure required by applicable state law.
"We don't have any uniformity," Lee said. "Where you live determines if you find out [about a breach], and if you do find out, what you're told."
With AI-enabled attacks showing no signs of abating and insider threats at a historic high, the trajectory of 2026 breach data will test whether record cybersecurity spending by corporations translates into measurable protection for the consumers whose personal information sits at the center of these incidents.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →The Trump administration's presidential memorandum authorizes private cybersecurity firms to conduct offensive cyber operations against foreign criminal networks under federal oversight, drawing immediate concern from security researchers over legal risks and the difficulty of accurate attribution.
U.S. federal agencies and South Korea's National Police Agency have jointly warned that the Gunra ransomware group — a Conti-derived operation with ties to North Korea's Lazarus Group — is actively targeting government and critical infrastructure sectors worldwide.
Shares of CrowdStrike and Palo Alto Networks each rose more than 5% to record highs on Monday after the Black Hat cybersecurity conference in Las Vegas spotlighted AI agents as the dominant and growing attack threat facing enterprises.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.