TechReview’s Data Breach Tracker currently lists 30 incidents, all but one of them dated October 2026. This page turns those rows into citable totals. The one rule: unlike units are never added together. People, accounts, records and tips each get their own total. There is no grand total, because adding them would double-count overlapping populations and mix unlike units.
The totals
- People: approximately 68,280,060 (7 rows: Johns Hopkins Bayview 3,182; Pentagon / DMDC approximately 3,050,000 reported; Tarter Krinsky & Drogin 196,645; Conduent 62,200,000; iRhythm Technologies 368,173; Central Ohio Primary Care 1,400,000; CenterPoint Energy 1,062,060). Marked approximate because it includes the Pentagon’s reported figure and COPC’s stated figure. The strictly “confirmed”-labelled subset within this total is 1,630,060 people across 4 rows the Tracker itself labels confirmed.
- Accounts: 6,921,810 (2 rows: Park24 / Times Car 6,600,000 + Zeabur 321,810). Park24 alone is 95.4% of this total.
- Records: approximately 20,674,247 (3 rows: Capcom 11,774,247 + Denmark CPR register approximately 8,800,000 + South Korea bank hack 100,000). Marked approximate because it includes Denmark’s approximate figure.
- Tips: 1,500,000+ (1 row: Toronto Crime Stoppers / P3; the “850,000+ with personal data” is a subset of those tips, not an additional figure).
Five findings
1. The largest countable people figure is Conduent: 62.2 million people (settlement class size per its linked article) — roughly 20 times the next-largest people figure, the Pentagon’s reported approximately 3.05 million. Two numerically larger figures on the Tracker do NOT count as victim figures and are excluded: Revolut’s 80M+ customers is an outage scope, and YAM Store’s 1 billion is scam texts sent.
2. Healthcare is the single biggest sector slice: 6 of the 30 rows — Johns Hopkins Bayview, Tarter Krinsky & Drogin, Quest Diagnostics, iRhythm Technologies, Central Ohio Primary Care, Oracle Health. Four of the six carry countable people figures totalling 1,968,000 people (3,182 + 196,645 + 368,173 + 1,400,000); Quest is undisclosed and Oracle is reported-not-final.
3. Fewer than half the rows carry a countable figure: only 13 of 30 rows contribute to a confirmed total (7 people + 2 accounts + 3 records + 1 tips). The other 17 rows contribute nothing to any confirmed total — 16 excluded rows plus Oracle Health, reported-only. Seven of the excluded rows are outage/operational rows with no victim count.
4. This is an October-2026 snapshot: 29 of the 30 rows are dated October 2026. The single exception is AOMEI Backupper, whose May–Jul 2026 activity was disclosed on Oct 20. All 30 rows sit under the Tracker’s “October 2026 Incidents” heading.
5. Reported figures would nearly double the records picture if taken at face value. The confirmed records total is approximately 20,674,247, while Oracle Health alone is “up to 20M (reported, not final)” — which is why this page keeps reported ceilings out of confirmed totals.
Methodology
Counted only rows whose affected cell states a single clear unit (people, accounts, records, or tips); mixed rows were counted on their primary unit only, with secondary figures flagged and never totalled. Excluded from confirmed totals: rows with no figure, outage/operational scope only, undisclosed or unknown counts, estimates, at-risk units, campaign volumes, and reported-not-final ceilings. “~”, “+”, “reported” and “up to” qualifiers are preserved wherever they appear in a row. All figures are as stated in the Tracker rows and the sources behind each row’s linked article; two rows that state a number without a unit (Conduent, iRhythm) had their unit confirmed from their own linked articles. No incidents beyond the Tracker’s 30 rows were added.
Every figure on this page traces to a row on the Data Breach Tracker, and from there to a linked article. If a figure here ever disagrees with the Tracker, the Tracker and its sources win, and this page should be corrected.