The headline number, and why it undersells the trend
The Identity Theft Resource Center's H1 2026 report counted 1,803 separate data compromises and 471.2 million victim notification letters sent in the first six months of the year. For context, all of 2025 produced 297.5 million notices across 3,321 incidents. Six months into 2026, notice volume has already exceeded the entirety of last year, and the compromise count is on pace toward roughly 3,600 for the full year, which would set a new annual record and mark the second consecutive year the total has grown despite years of enterprise investment in breach prevention tooling.
ITRC President James E. Lee described breach volume as inherently unpredictable year to year, while noting that crossing the halfway mark to a new record this early is itself a signal of a lot of identity scams and fraud headed toward consumers and the businesses that serve them. Q2 2026 alone produced 1,029 compromises, the second-highest single quarter ITRC has ever recorded, trailing only a spike earlier in ITRC's tracking history, and reinforcing that the H1 surge was not a one-quarter anomaly driven by a single event.
One breach did more damage than most industries combined
A large share of the H1 total traces back to a single incident: the compromise of Instructure's Canvas learning management platform, which generated approximately 275 million victim notices on its own, 58 percent of the entire first-half total. Canvas serves roughly 8,809 institutions globally, including 41 percent of U.S. higher education, which is why one platform-level breach produced notice volume larger than most sectors combined, and why a single vendor incident can now single-handedly define an entire year's breach statistics.
The concentration matters for how enterprises think about vendor risk. ITRC's data shows that public companies made up just 10.3 percent of compromises in H1 2026 but accounted for 83.4 percent of all victim notices, and that supply chain incidents, 38 initial breaches, generated 280.6 million notices spread across 206 downstream entities. Blast radius, measured in how many organizations and individuals a single upstream compromise ultimately touches, has become the metric that determines whether a breach becomes a headline, far more than how the initial intrusion happened.
The insider threat line nobody budgeted for
The most dramatic shift in the report involves people already inside the organization. Malicious insider incidents rose to 21 events in H1 2026, up from just 3 in all of 2025, a sevenfold increase in half the time. ITRC attributes the surge to two overlapping forces: tech-sector layoffs creating disgruntled or financially motivated former employees with residual access, and nation-state recruitment of insiders at target organizations, a tactic North Korean operatives in particular have refined over the past two years.
Most breach programs are built around external threat detection, perimeter monitoring, and phishing resistance. A sevenfold jump in insider events in six months argues for shifting real budget toward offboarding hygiene, privileged access review cadence, and behavioral monitoring for current employees, particularly during and after reduction-in-force events where access revocation timing is often the weakest link in the process, and where the emotional aftermath of a layoff makes data exfiltration by a departing employee more likely, not less.
Transparency keeps sliding to new lows
Only 24 percent of breach notices in H1 2026 disclosed how the attack actually happened, the lowest rate ITRC has recorded since it began tracking the metric. That means for roughly three out of every four breach notices a consumer or a business partner receives, the root cause, whether phishing, an unpatched vulnerability, a stolen credential, or an insider, remains undisclosed, leaving the recipient with a notification obligation to act on and almost nothing to learn from about how the exposure actually happened.
This has a direct cost for enterprise security teams trying to learn from the incidents around them. Threat intelligence and defensive prioritization depend on knowing what is actually working for attackers right now, and a shrinking disclosure rate erodes that shared visibility across the industry at exactly the moment volume is climbing fastest. Regulatory pressure to require root-cause disclosure alongside basic notification is likely to grow from here, particularly in states already weighing breach law updates this legislative cycle.
Zero-days are catching up to the annual pace inside six months
Zero-day driven breaches reached 14 events in H1 2026, nearly matching the 17 recorded across all of 2025. Combined with a manufacturing sector that saw victim notices jump from 1.97 million in 2025 to 74 million so far in 2026, and healthcare compromises reversing a prior downward trend to reach 281 incidents, the data points to attackers finding fresh footholds across sectors that had previously reported improving numbers and were beginning to relax their guard as a result.
For a CTO building next year's security budget, this report functions as a baseline reset rather than a single data point. The assumptions that supported last year's spend, on incident volume, on the ratio of external to insider threats, and on how much of the attack chain will be disclosed after the fact, all shifted materially in six months. Budgets built on 2025's numbers are already out of date, and the H1 2026 figures give finance and the board a defensible reason to revisit them before the fourth-quarter planning cycle locks them in again.
Financial services led on frequency, healthcare reversed course
Financial services recorded 387 compromises in H1 2026, the highest frequency of any sector ITRC tracked, a position the industry has held for several consecutive reporting periods given how many discrete, regulated entities, banks, credit unions, lenders, and fintech platforms, report separately under existing disclosure rules. Healthcare's 281 compromises are the more notable shift, reversing a downward trend the sector had shown in recent years and suggesting that consolidation among claims processors and benefits administrators is concentrating risk into fewer, larger targets.
Neither trend is reassuring on its own, but together they describe an environment where the sectors with the most mature compliance regimes, financial services and healthcare, are still absorbing the largest share of incidents. That is the clearest evidence in the report that regulatory obligation alone does not translate into breach prevention, and it argues for security investment decisions to be driven by actual incident data rather than by which sector already carries the heaviest compliance checklist.
