Not every breach deserves the same reaction.
Thousands of breaches are disclosed every year and the warnings all sound alike, even when the underlying risk is not remotely alike. The Breach Risk Index measures what was exposed, what is actually circulating, how the pieces combine and what that combination enables. It has been applied to roughly 950 breaches whose data has been observed in circulation.
A disclosure tells you something happened. Circulation tells you the data escaped. The Breach Risk Index tells you how much that matters. Most people now receive several breach notices a year, worded almost identically, describing exposures that are not remotely alike. Below is the record of roughly 950 breaches whose data has been observed in circulation, each one scored.
Disclosed is not the same as circulating.
Reported, but not seen in circulation
A filing, a statement, a notification letter. The company has told you it noticed something. Notification is frequently required with no evidence of misuse at all, and the company often cannot say where the data went, because it does not know.
The data may still sit with the attacker, an investigator or a private buyer. Not circulating means not observed, which is not the same as not out.
Observed, somewhere it can be reached
The set has surfaced where it can be searched, bought or reused, and is usually indexed from there. This is the part that can be checked from outside, and it is the inclusion test for everything listed on this page.
It can begin at any time. LinkedIn was breached in 2012 and the data did not circulate widely until 2016, which is why an alert about an old breach is not a false alarm.
Treat a disclosed breach as unknown risk, not no risk, and treat the absence of your data from a search service as an absence of evidence rather than evidence of absence.
Two breaches, both circulating, not remotely the same.
Circulation is a threshold, not a verdict. It says the data got out. It says nothing about what the data lets someone do.
Email address and username
Real exposure, and worth knowing about. It supports credential stuffing where a password was reused, and a better-targeted phishing attempt. Rotating a password reaches most of it.
Identity number, date of birth, home address, phone, financial detail
The same threshold, a different order of problem. The combination supports account recovery, identity proofing, new-account fraud, and putting a named person at a specific door. None of it can be rotated.
Observed, and still in circulation.
Every entry here has been observed in circulation rather than merely disclosed. Each opens into the full record: what was exposed, what the combination enables, and what to do about it.
The figures do not all carry the same weight, so each one says where it comes from. A number indexed by a breach search service has been counted. A number a company disclosed has been counted by the company. A number an attacker published is a claim, and extortion claims are written to be impressive rather than accurate. Circulation is established for every entry; the scope attached to it is graded separately, and the two are never merged into one figure. CB-221, the standard this follows →
A limited incident tied to vishing, claimed by two groups, indexed by HIBP and followed by litigation.
310,400accountsIndexed · HIBPRescoringAddi / Adelante Soluciones Financieras2026Identity, credit, KYC, phone and government ID data across 67.9 million rows.
34M+unique emailsIndexed · breach indexRescoringAmtrak2026A Salesforce-linked compromise. Names, physical addresses and customer support records.
2.1Munique emailsIndexed · HIBPRescoringCarGurus2026Nearly two decades of marketplace accounts, released publicly after a failed extortion attempt.
12Muser recordsObserved · publishedRescoringSubstack2026Breached in October 2025, disclosed in February 2026. Account records with limited user data.
663,000accountsDisclosed · companyRescoringSoundCloud2026Disclosed in December 2025, published to a dark web leak site the following month.
30Muser recordsObserved · publishedRescoringPanera Bread2026Published in full after the company declined an extortion demand.
Full customer datasetObserved · publishedRescoringUnder Armour2025Internal and customer data claimed by a ransomware group.
343GBexfiltratedClaimed · actorRescoringIberia Airlines2025Unauthorized access to a third-party supplier's systems.
Count not disclosedDisclosed · companyRescoringMavis Tire Supply2025A ransomware attack on one of the largest independent multi-brand tire retailers in the US.
Count not disclosedClaimed · actorRescoringInstagram data exposure2026A dataset tied to Instagram accounts, apparently assembled by scraping and third-party enrichment.
Posted to a forumObserved · forumRescoringCarMax2025One of several Salesforce-linked compromises claimed by the same group.
Count not disclosedClaimed · actorRescoringIngram Micro2025A ransomware intrusion that halted global operations.
Count not disclosedDisclosed · companyWhat each one holds.
The question is not whether you are in one.
You are. The question is which of them is still live, what it joins to, and whether anyone is watching for the next one.
An exposure audit maps every record an adversary can reach on a client, this corpus included, and works the findings at the source. ThreatWatch covers what surfaces afterwards.
- Phone
- 855.76.ERASE
- info@obscureiq.com
- Counsel
- Introductions on request
- Handling
- Encrypted intake. Off the record by default.