In the first half of 2026, state agencies and HHS published 5,429 data breach notification filings describing 1,969 breach events and affecting at least 343 million people. A single platform breach at Instructure (Canvas) accounts for nearly 80 percent of that total, and the share of breaches whose cause cannot be determined from the public record has risen to one in three.

In 2025, the Data Breach Chronology captured 8,019 data breach notification filings from state and federal agencies that publish breach reports. These represented 4,080 unique breach events impacting at least 375 million individuals. This report examines what those 4,080 breaches tell us about the state of data security, and where the gaps in breach reporting leave consumers in the dark.

This survey analyzes and compares data breach notification laws across all 50 U.S. states and the District of Columbia. Using a standardized framework of 50 questions, we examined each jurisdiction's requirements for breach notification timing, covered data types, notification recipients, enforcement mechanisms, and consumer remedies.

The survey reflects statutes enacted as of January 1, 2026.

Hundreds of data brokers have not registered with state consumer protection agencies. These findings come as more states are passing data broker transparency laws that require brokers to provide information about their business and, in some cases, give consumers an easy way to opt out.  

Our May 2025 update—the fifth this year—brings our complete data through May along with this focused analysis of Q1 breach statistics. The first quarter saw 876 new breach notifications representing 658 distinct security incidents that impacted over 32 million people.