The number of data breaches added each month since 2013 to Have I Been Pwned, a public service that catalogs breached accounts.
AI could make phishing, credential stuffing, and vulnerability exploitation cheaper and speed up attackers’ reconnaissance, raising the rate of data breaches. Have I Been Pwned has cataloged breaches since 2013 with roughly constant effort, so it offers a long, if partial, view of publicly known breaches.
From 2016 to 2025, the service added between 70 and 111 breaches per year. In January–August 2026, it added 97, compared with 58 in the same months of 2025.
We fetch every breach from the Have I Been Pwned API and count breaches by the month they were added to the service. The service adds only breaches that are reported to it and that it judges legitimate, so the series misses breaches that were never reported or that it judged illegitimate. The chart shows monthly, quarterly, or annual totals. Months with no breaches count as zero, and the month in progress is left out. Breaches are often added months or years after they happen, so the series tracks when breaches become public rather than when they occur.
Source: Have I Been Pwned.
Our charts, text and processing are available under the Creative Commons Attribution license. The underlying data comes from Have I Been Pwned (https://haveibeenpwned.com/) and is subject to its own licence or terms.
The number of data breaches added each month since 2013 to Have I Been Pwned, a public service that catalogs breached accounts.