But in a positive note, fewer people were affected

-
Data breaches in the U.S. reached 1,732 incidents in the first half of 2025 5% higher than the same period in 2024.
-
Despite more breaches, the number of victim notices droppedby 88% year-over-year, largely due to fewer mega breaches.
-
Cyberattacks remain the leading cause of breaches, while the financial services and healthcare sectors continue to be the top targets.
Data breaches have surged in the first half of 2025 but the number of affected consumers fell dramatically compared to last year. Thats the headline of the latest report from the Identity Theft Resource Center.
According to the ITRCs H1 2025 Data Breach Report Analysis, a total of 1,732 data compromises were publicly reported during the first half of the year. Thats a 5% increase over the same period in 2024 and puts the U.S. on track to break the annual record if the trend continues into the latter half of the year.
However, the number of victim notices issued when individuals' personal information is exposed dropped to 165.7 million, just 12% of the volume recorded by mid-year 2024. The ITRC attributes this steep decline to the relative absence of mega breaches in 2025 compared to the previous year, when a few massive incidents heavily skewed victim totals.
Cyberattacks remained the primary cause of breaches involving personal data, accounting for 1,348 of the incidents and generating 114.6 million victim notices. A growing concern, however, is the rising number of breaches with undisclosed root causes. In the first half of 2025, 69% of notices lacked information about how the breach occurred, up from 65% in the same period last year.
This continuing lack of transparency is troubling, said James E. Lee, president of the ITRC. More than two-thirds of compromises dont include basic information about how they happened, which hampers efforts to prevent future breaches.
Key targets
The financial services and healthcare sectors continued to be the most targeted industries, experiencing 387 and 283 breaches, respectively. While financial sector breaches were slightly down from 2024, healthcare breaches rose, signaling increased risks in one of the most sensitive data categories.
Another growing threat vector came from supply chain attacks, with 79 such breaches reported in H1 2025. These incidents impacted 690 entities and resulted in 78.3 million victim notices, underlining the interconnected vulnerabilities in modern digital infrastructure.
The ITRC also reported an uptick in physical attacks, such as stolen devices or paperwork, with 34 such incidents reported in the first six months of 2025, already surpassing the 33 cases recorded in all of 2024.
At the same time, the reuse of stolen credentials has emerged as a serious concern. Lee said ITRC has seen recycled information, like logins and passwords, used in new breaches.
Lee stressed the importance of proactive identity protection and urged individuals to take preventive steps.
Posted: 2025-07-18 11:02:21