Guide ยท Data
What is a data breach?
A data breach is an incident in which information is accessed, acquired, used or disclosed without authorisation. Each state breach law and the HIPAA rule has its own legal definition of when a breach triggers notice.
Types of data breach
- Hacking or IT incidents, such as ransomware and network intrusions.
- Unauthorised access or disclosure, such as misdirected mail or staff viewing records without a need.
- Theft and loss of laptops, devices or paper records.
- Improper disposal of records.
What is the most common cause of data breaches?
In HHS OCR healthcare reports affecting 500 or more people, Hacking/IT Incident is listed on 4,838 of 8,024 reports (60.3%). This reflects healthcare only.
| Type of breach | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Hacking/IT Incident | 4,838 | 60.3% | 998,777,936 | |
| Unauthorized Access/Disclosure | 1,744 | 21.7% | 54,408,009 | |
| Theft | 1,060 | 13.2% | 27,220,780 | |
| Loss | 247 | 3.1% | 9,615,000 | |
| Improper Disposal | 127 | 1.6% | 2,220,170 | |
| Other | 95 | 1.2% | 1,461,610 | |
| Unknown | 16 | 0.2% | 2,246,065 |
Where the breached information was held
| Location | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Network Server | 3,698 | 46.1% | 992,622,069 | |
| 1,858 | 23.2% | 52,855,850 | ||
| Paper/Films | 1,013 | 12.6% | 7,410,388 | |
| Laptop | 515 | 6.4% | 10,367,181 | |
| Electronic Medical Record | 477 | 5.9% | 18,590,504 | |
| Other | 464 | 5.8% | 28,046,241 | |
| Desktop Computer | 381 | 4.7% | 12,819,208 | |
| Other Portable Electronic Device | 331 | 4.1% | 7,932,795 |
Data breach examples
- Change Healthcare, Inc. (MN), 192,700,000 individuals, Hacking/IT Incident
- Anthem Inc. (IN), 78,800,000 individuals, Hacking/IT Incident
- Conduent Business Services LLC (NJ), 62,224,658 individuals, Hacking/IT Incident
- DentaQuest, LLC (MA), 15,000,000 individuals, Hacking/IT Incident
- Welltok, Inc. (CO), 14,782,887 individuals, Hacking/IT Incident
Legal definitions: see the state law pages and what is a HIPAA breach.
Frequently asked questions
What is a data breach?
An incident in which information is accessed, acquired, used or disclosed without authorisation. Laws define when a breach requires notice.
What is the most common cause of data breaches?
In HHS OCR healthcare breach reports of 500 or more people, Hacking/IT Incident is the most common listed type, on 60.3% of reports.
What does data breach mean?
That someone obtained or exposed information without permission, whether through hacking, theft, loss, misdirected disclosure or improper disposal.
Sources
Last updated 2026-10-20.