ITRC: Malicious Insiders Surge as H1 2026 Data Compromises Set Pace for Record Year

News provided by

Jul 22, 2026, 07:57 ET

More than 471 million victim notices issued in the first six months of the year eclipse the entire 12-month total for 2025

SAN DIEGO, July 22, 2026 /PRNewswire/ -- The Identity Theft Resource Center^®, a nationally recognized nonprofit organization established to prevent and reduce the impact of identity theft, scams and fraud, tracked 1,803 data compromises in the first half of 2026. Q2 2026 alone tallied 1,029 compromises, the second-highest single-quarter total in ITRC tracking history. If the current pace continues, annual compromises could reach approximately 3,600 events, marking a four-year streak of more than 3,000 annual compromises. It also puts 2026 on pace to set a new annual record compared to the 3,321 compromises recorded in 2025.

Only 24 percent of H1 2026 breach notices contained details about the attack vector, the lowest rate ever recorded by the ITRC.

The ITRC’s H1 2026 data breach analysis shows that over 470 million victim notices were issued during the first half of the year.

Download the H1 2026 Data Breach Report

According to the ITRC's H1 2026 Data Breach Report, the number of victim notices issued during the first six months of the year reached an estimated 471.2 million, eclipsing the 297.5 million notices in all of 2025. The return of mega-breaches drove the large surge in victim notices. A single data compromise involving Instructure Holdings' Canvas education platform generated an estimated 275 million victim notices (figure reflects the total reported victims; a U.S. victim count has not been confirmed), accounting for 58 percent of the H1 2026 total.

With more victim notices issued than there are people in the U.S., consumers must assume their data has been exposed. The ITRC recommends that individuals freeze their credit files via FrozenPII.com, switch to passkeys to prevent credential theft and enable multifactor authentication. For businesses, the ITRC advises adopting a zero-trust architecture, implementing least-privilege access controls to combat insider threats, vetting supply chain vendors in real time and prioritizing transparency by voluntarily disclosing attack vectors to build consumer trust.

By sector, financial services recorded the highest frequency of compromises at 387. Healthcare compromises rose to 281, reversing a slight downward trend from the previous year. Due to the Canvas breach, the technology sector saw the highest volume of victim notices. Manufacturing also experienced a surge, producing 74 million victim notices compared to just 1.97 million in all of 2025.

"Data breaches are not predictable, but the fact that we are more than halfway to another record-breaking year is a sign that there are a lot of identity scams and fraud headed our way," said James E. Lee, President of the ITRC. "At the same time, we are facing an unprecedented transparency crisis that leaves consumers and businesses largely in the dark about their actual risk exposure because the state laws designed to inform and protect us simply do not work."

H1 2026 Data Breach Report Trends

Insider Wrongdoing Is Surging: The ITRC tracked 21 insider wrongdoing events in the first half of the year, a sevenfold increase over the three incidents recorded in all of 2025, due to tech-sector layoffs and nation-state recruitment schemes.
The Transparency Crisis Accelerates: Only 24 percent of H1 2026 breach notices contained details about the attack vector, the lowest rate ever recorded by the ITRC.
Zero-Day Attacks Escalated: Powered partly by AI tools that uncover software flaws faster than humans can, zero-day attacks rose to 14 events in H1 2026, nearly matching the 17 events recorded in all of 2025.
Public Companies Face High Concentration: Publicly traded companies accounted for only 10.3 percent of compromises but generated 83.4 percent of all victim notices.
Supply Chain Risks Compound: Supply chain attacks generated 280.6 million victim notices from just 38 initial breach events, impacting 206 total entities and demonstrating a severe multiplier effect.

Anyone can receive free support and guidance from a knowledgeable live advisor by calling or texting 888.400.5530, or by visiting IDTheftCenter.org to chat live.

About the Identity Theft Resource Center

Founded in 1999, the Identity Theft Resource Center^® is a national nonprofit organization established to prevent and reduce the impact of identity theft, scams and fraud. Through public and private support, the ITRC provides no-cost victim assistance and consumer education through its website live chat, idtheftcenter.org, and toll-free phone number 888.400.5530. The ITRC also equips consumers and businesses with information about recent data breaches through its data breach tracking tool. The ITRC offers help to specific populations, including the deaf/hearing impaired and blind/vision impaired communities.

SOURCE Identity Theft Resource Center