The Weekly Breach Breakdown Podcast by ITRC - Once More Unto The Breach - S6E12

Show Transcript

Welcome to the Identity Theft Resource Center's (ITRC) Weekly Breach Breakdown for April 18, 2025. I'm Alex Achten, Senior Director of Communications & Media Relations of the ITRC. Thanks to Sentilink for supporting the ITRC and this podcast. Each week, we look at the most recent events and trends related to data security and privacy. Today, we look at our Q1 2025 data breach findings.

Can you believe that we are in our sixth year of this podcast? The Weekly Breach Breakdown has come a long way since our first episode, “Once More Unto the Breach,” where ITRC President James E. Lee analyzed the numbers and trends from the publicly reported U.S. data compromises in the first quarter (Q1) of 2020. 

As we fast forward five years from that first episode, data compromises and their impacts remain as prevalent as ever. For the fifth anniversary of this podcast’s first episode, let’s look back at the Q1 data breach highlights for 2025, just like James did in 2020 for Season 1, Episode 1. It’s only fitting we, once again, quote King Henry in Shakespeare's Henry V, “Once more unto the breach, dear friends.”

In Q1 2025, the ITRC tracked 824 data compromises, leading to just over 91.3 million victim notices. The number of compromises remained nearly flat quarter-over-quarter, with 837 compromises tracked in Q1 2024. However, the number of victim notices increased by 138 percent over the same period of time. 

Of the 824 data compromises, 638 were cyberattacks, 60 were system and human errors, 11 were physical attacks and 115 were not specified. The Financial Services industry was the most impacted industry in Q1, accounting for 193 compromises, followed by Healthcare, Professional Services, Manufacturing and Education. These industries were also the top five affected in the full year 2024. 

Unfortunately, we continue to see an increase in the number of data breach notices without attack vector details. In Q1, 68 percent of notices did not contain those details, up from 65 percent in 2024. Since 2018, the percentage of notices with actionable information has dropped from ~100 percent in 2018 to 32 percent in Q1 2025. The lack of actionable information leaves victims more vulnerable to an identity crime.

Finally, let’s look at the top compromises by victim notice count in the quarter. PowerSchool tops the list, with 71.9 million victim notices issued due to their data event. In late December, the third-party breach exposed the personal and sensitive information of students and teachers across the United States who used PowerSchool’s Student Information System after criminals accessed the company’s customer support portal. 

Other top compromises include:

• DISA Global Solutions, Inc. (three-point-three (3.3) million victim notices),
• New York University (three (3) million victim notices),
• Community Health Center, Inc. (one-point-one (1.1) million victim notices), and
• Hospital Sisters Health System (882,000 victim notices).

The most important question is how we can protect ourselves from these data events. We have mentioned them on the podcast before but cannot talk about them enough. The ITRC encourages everyone to freeze their credit, whether they have received a victim notice or not. It is the single most impactful thing you can do to protect yourself. 

Also, exercise good cyber-hygiene by having unique 12+ character passphrases on each account (and switch to passkeys when offered). Use multi-factor authentication everywhere it is available to provide you with an added layer of security.

The ITRC will continue to track the latest data breaches and trends and bring you the details in our monthly newsletter, In the Loop, and in our quarterly data breach newsletter. You can subscribe to them by visiting our website, www.idtheftcenter.org, and clicking on “Newsletter” under the “Resources” tab. We will also release a half-year data breach analysis in July with additional information.

If you want to know more about how to protect your business or personal information or think you have been the victim of an identity crime, you can speak with an expert ITRC advisor on the phone, via text message, chat live on the web, or exchange emails during our normal business hours (6 a.m.-5 p.m. PT). Just visit www.idtheftcenter.org to get started.

Thanks again to Sentilink for their support of the ITRC and this podcast. Please hit the like button for this episode and subscribe wherever you listen to your podcasts. 

Next week, be sure to tune in to our Fraudian Slip podcast, where we will hear audio from a panel titled “It’s Not Just About Benefits Fraud.” Panelists will include the ITRC’s Eva Velasquez, the Aspen Institute’s Kate Griffin, the United States Secret Service’s Matthew Noyes, the R Street Institute’s Shoshana Weissman and the American Bankers Association’s John W. Carlson. The panel was held in January at the Identity, Authentication, and the Road Ahead Cybersecurity Policy Forum hosted by the Better Identity Coalition, the FIDO Alliance and the ITRC.

We will return in two weeks with another episode of the Weekly Breach Breakdown. I'm Alex Achten. Until then, thanks for listening.