The Identity Theft Resource Center (ITRC) reported 3,158 data compromises in 2024, just 44 incidents shy of 2023’s record high. While the total number of breaches remained nearly unchanged, victim notices surged 312% to 1.7 billion, driven largely by 6 mega-breaches that each affected at least 100 million individuals.
According to James E. Lee, President of ITRC, the findings highlight a troubling trend:
“Stolen and compromised data is so ubiquitous that the number of people and businesses who have not been impacted by a data breach is now dwarfed by the number of victims who have been — by a factor of five.”
Cyberattacks accounted for 2,525 of the breaches and resulted in 1.6 billion victim notices. However, 65% of data breach notices lacked details on the attack vector, continuing a five-year trend of diminishing transparency.
The report found that many breaches were preventable:
- 1965 breaches could have been avoided with better security measures.
- 4 of the6 mega-breaches (Ticketmaster, Advance Auto Parts, AT&T, and Change Healthcare) resulted from stolen credentials that could have been mitigated with multi-factor authentication (MFA).
- At least 21 breaches stemmed from misconfigured or unsecured cloud environments.
The largest breaches were concentrated in a few high-profile companies, with six incidents accounting for 85% of all victim notices:
| Company | Victim Notices |
| Ticketmaster Entertainment | 560 million |
| Advance Auto Parts | 380 million |
| Change Healthcare | 190 million |
| DemandScience | 121.8 million |
| AT&T | 110 million |
For the first time since 2018, financial services was the most breached industry, surpassing healthcare. Financial services suffered 737 breaches, largely due to increased attacks on commercial banks and insurance firms.
Meanwhile, the healthcare sector, which had been the most attacked industry for 6 years, reported 536 breaches in 2024.
The ITRC noted that state privacy laws are expanding, with 40% of U.S. states now implementing comprehensive privacy laws, but federal disclosure regulations remain ineffective at reducing breaches. Additionally, AI has enabled more sophisticated phishing and identity scams.
