People Affected by Health Data Breaches, 12 Months (HHS)

## What this measures

The number of people affected, as reported by the breached organisations, across all health-data breaches of 500+ people submitted to HHS over the trailing 12 months, in millions.

## Why it matters

It measures the scale of exposure, which a breach count alone does not.

## How to read it

It was 158.0 million in the 12 months to July 2026, up from 84.1 million a year earlier. Single breaches dominate it: the July 2024 record of 358.1 million includes Change Healthcare (192.7 million people), and Conduent reported 62.2 million in October 2025.

## What it does not say

People are counted once per breach, so someone in two breaches counts twice, and organisations often revise their counts later.

## Source

U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (ocrportal.hhs.gov/ocr/breach), HIPAA breach reports, Under Investigation and Archive tabs combined, by breach submission date. Palanor reads both CSV exports every day. U.S. government work, public domain.