The Weekly Breach Breakdown Podcast: 1,266 Breaches, Few Answers - Inside the Q3 Data Fog - S7E32

Breaches spiked by more than 50% year-over-year, yet more than 40% of incidents for the entire quarter lacked an identified attack vector. How are consumers supposed to protect themselves and their information when the companies being breached aren't telling us how it happened? Welcome to the Identity Theft Resource Center's “ Weekly Breach Breakdown ” for Oct. 16, 2026.

I'm Alex Achten, vice president of media relations for the ITRC. Thanks to SentiLink for supporting the ITRC and this podcast . Each week, we review the latest events and trends in data security and privacy. This week, we are looking at the Q3 2026 data breach highlights.

Unfortunately, Q3 was no better than Q2. There were 1,266 Q3 2026 data breaches tracked by the ITRC. The bad news is that 1,266 compromises are more than in any previous quarter this year. The ITRC is well on its way to breaking the previous record for publicly reported data compromises, set last year at 3,319.

For context, the ITRC has tracked 3,064 compromises as of Sept. 30. However, those 1,266 compromises resulted in only approximately 55 million victim notices. The good news is that the victim notice count in Q3 was lower than in Q1 or Q2.

With that said, the ITRC has tracked over 573 million data breach notices in the first nine months of the year, more than doubling the full-year 2025 total . As I mentioned at the top of the podcast, breaches increased 50% year-over-year (1,266 in Q3 2026 versus 830 in Q3 2025). However, in 549 compromises, the attack vector was completely unknown. Looking at public data breach notices overall, 972 did not include an attack vector — meaning only 23% gave any explanation at all.

This prevents consumers, businesses and policymakers from understanding their true risk exposure or taking meaningful preventive action. Breaking down the attack vectors we do know in the Q3 2026 data breaches, cyberattacks were the most common (621 breaches and 53.9 million victim notices), while system and human error ranked second (80 breaches and 490,996 victims). Just 29 supply chain attacks accounted for nearly half of all victim notices, demonstrating a severe multiplier effect. Examining compromises by industry, the financial industry was hit hardest, with 278 compromises.

Healthcare was also hit hard, coming in at number two with 216 compromises. In fact, two of the top five compromises by victim count in Q3 2026 were from the healthcare industry. The Aesto Health compromise led to 9.5 million victim notices, and the AdaptHealth data event resulted in 4.1 million victim notices. While healthcare saw some of the highest individual victim counts, the quarter's top compromise, identity verification platform IDScan.net , remains clouded in uncertainty.

A state breach filing put the number of impacted individuals at roughly 13 million, but IDScan has not publicly confirmed a total, and it remains unclear how that figure relates to the 153 million driver's license records a darkweb marketplace claimed to be selling. At the beginning of the podcast, I asked how consumers were supposed to protect themselves in the face of the lack of transparency we are seeing (or not seeing). For consumers, assume your data is exposed. The ITRC recommends that you freeze your credit files via FrozenPII.com , switch to passkeys to prevent credential theft and enable multifactor authentication.

Good cyber hygiene is more important now than it has ever been. If you are curious about whether you’re practicing good cyber hygiene, take our quiz. Visit IDTheftCenter.org and click on the banner at the top of the website that reads, “ Take Our Quiz .” For businesses, the ITRC advises adopting a zero-trust architecture, implementing least-privilege access controls to combat insider threats, vetting supply chain vendors in real time and prioritizing transparency by voluntarily disclosing attack vectors to build consumer trust. The ITRC will continue to track the latest data breaches and trends and bring you the details in our monthly newsletter, In the Loop, and in our quarterly data breach newsletter.

You can subscribe to them by visiting our website, IDTheftCenter.org , and clicking on “ Newsletter ” under the “Resources” tab. For information on the latest data breaches, visit the ITRC’s data breach tracking tool, Breach Alert , on the website. Also, in January, we will release our 2026 Annual Data Breach Report , which will take a comprehensive look at what happened in 2026 and why. Believe it or not, it is right around the corner.

If you want to know more about how to protect your business or personal information or believe you are the victim of identity theft, fraud or a scam, you can speak with an expert advisor on the phone, via text message, chat live on the web or exchange emails during our normal business hours Monday through Friday (6 a.m. to 5 p.m. Pacific time). Just visit IDTheftCenter.org to get started.

Thanks again to SentiLink for their support of the ITRC and this podcast . Please hit the like button for this episode and subscribe wherever you listen to your podcasts. We will return next week with another episode of the “ Weekly Breach Breakdown .” I’m Alex Achten. Until then, thanks for listening.