US regulators logged 710 large data breaches, defined as incidents affecting 500 or more people, across every state, DC, and Puerto Rico in 2025, according to HIPAA Journal's 2025 Healthcare Data Breach Report, published February 13, 2026 from HHS Office for Civil Rights breach portal filings. California reported more of those breaches than any other state, while Georgia lost more individual records than anywhere else. Neither state ranks first on both measures, which is the clearest sign that breach count and breach size tell two different stories.
How many data breaches happen across US states each year?
710 large healthcare breaches were reported nationally in 2025, a 4.3 percent decline from the prior year, according to HIPAA Journal's annual count of HHS Office for Civil Rights filings. That figure only captures healthcare breaches affecting 500 or more people, the threshold HIPAA sets for public reporting, so it undercounts the true volume of US data incidents. Beyond healthcare, the Identity Theft Resource Center's 2025 Annual Data Breach Report counted 3,322 data compromises across every US sector in 2025, a record high and a 5 percent rise over the 3,152 compromises logged in 2024.
Figure 1: Large healthcare breach counts have climbed almost every year since 2019, though the 2025 figure is still rising as late filings arrive. Source: HIPAA Journal, compiled from the HHS Office for Civil Rights breach portal.
The HHS breach portal is a rolling database, not a fixed annual snapshot. Healthcare entities have 60 days to report a breach, and some file months late, so a given year's total keeps climbing after the calendar year ends. HIPAA Journal's live tracker, checked in August 2026, already showed 772 large breaches for 2025, up from the 710 captured in its February 2026 report. Both figures come from the same underlying source; the difference is simply how many late filings had landed by the time each snapshot was taken.
The cause behind most of these filings barely varies by state. Hacking and other IT incidents accounted for more than 80% of the large breaches reported in 2025, per HIPAA Journal's breakdown of the HHS breach portal, up from 79.7% in 2023, the most recent year OCR published a full percentage breakdown by cause. Unauthorized access or disclosure was the next most common category, and its average breach size actually rose 17.4% year over year even as the overall national total fell.
Which state had the most data breaches in 2025?
California reported 69 large healthcare breaches in 2025, the most of any state and about 10 percent of the 710-breach national total, per HIPAA Journal's state-by-state breakdown. Florida and Texas tied for second with 47 breaches each, followed by New York at 44 and Ohio at 37. Those five states alone accounted for nearly a third of every large breach reported nationwide.
Sites that collect any personal information, not just health data, face the same underlying obligation: disclosing what gets collected, how it is protected, and what happens if it is exposed. A privacy policy generator built to keep that disclosure current is a faster fix than rewriting a policy after a state regulator or the press comes asking.
Where the breached data actually lived tracks the cause data closely. 61.5% of 2025's large breaches originated on a network server and another 24.9% traced to a compromised email account, according to HIPAA Journal's analysis of breach portal filings, with physical records and paper files behind just 5.6%. States with more hospitals and insurers simply run more servers and inboxes that can be targeted, which is a large part of why size, not any single security failure, predicts a state's breach count.
Figure 2: California, Florida, and Texas led all states in large healthcare breach counts during 2025. Source: HIPAA Journal, 2025 Healthcare Data Breach Report, February 2026.
Breach count by itself does not measure severity, though. A state with dozens of small incidents can expose far fewer records overall than a state with just one very large one, and that is exactly what happens once individuals affected enters the picture instead of a raw filing count.
Which states had the most people affected by a breach?
Georgia had more individuals affected by a healthcare data breach than any other state in 2025, at 16,050,351 people, according to HIPAA Journal's state ranking, even though it ranked ninth nationally in the number of breach filings. California was second in individuals affected at 11,849,467, followed by Connecticut at 7,048,122 and Maryland at 3,809,252.
Nationally, 61,556,256 individuals had health data exposed in 2025, down 78.7 percent from 289,162,330 in 2024. That drop tracks a sharp fall in mega breaches, incidents exposing 1 million or more records, which fell from 18 in 2024 to just 9 in 2025, and it explains why the average breach size dropped from 389,707 individuals to 86,699 while the median fell from 6,702 to 4,011. Georgia's total shows how a state can still rank first in individuals affected even in a year when mega breaches became rarer nationwide.
Figure 3: Georgia's total individuals affected outpaced every other state despite a mid-tier breach count, showing how a single large incident can dominate a state's yearly figure. Source: HIPAA Journal, 2025 Healthcare Data Breach Report, February 2026.
For the picture across every industry, not just healthcare, see our companion data breach statistics for 2026, which covers global cost and cause data from IBM and Verizon alongside the ITRC's all-sector US count of 3,322 compromises. That post also tracks average breach cost and detection time worldwide, figures that HIPAA Journal's state-level dataset does not measure since it counts filings and records, not dollars.
How concentrated are data breaches among a handful of states?
Large healthcare breaches were reported by entities in 49 states, DC, and Puerto Rico in 2025, with Vermont the only jurisdiction to avoid a large breach entirely, according to HIPAA Journal's coverage summary. But that near-universal spread hides a heavy concentration at the top: the ten states with the most large healthcare breaches in 2025, California, Florida, Texas, New York, Ohio, Pennsylvania, Michigan, Illinois, Georgia, and North Carolina, together reported 372 of the 710 breaches nationwide, or 52 percent, based on PrivacyTerms.io's calculation from HIPAA Journal's published state totals. The remaining 40 states, DC, and Puerto Rico split the other 48 percent among them, so more than half of all reported breach activity concentrates in just one-fifth of US jurisdictions.
Figure 4: The 10 highest-breach states account for just over half of all 710 large breaches reported in 2025. Source: PrivacyTerms.io calculation from HIPAA Journal's 2025 Healthcare Data Breach Report.
That concentration mostly tracks population and the size of each state's healthcare sector rather than weaker security practices in any one place. Larger states simply run more hospitals, insurers, and health systems, each one a separate entity that can file its own breach report.
How does the state breakdown compare to the national picture?
| State | Large breaches, 2025 | Individuals affected | Rank by individuals |
|---|---|---|---|
| California | 69 | 11,849,467 | 2nd |
| Florida | 47 | 3,372,753 | 5th |
| Texas | 47 | 1,034,662 | 10th |
| Georgia | 23 | 16,050,351 | 1st |
Source: HIPAA Journal, 2025 Healthcare Data Breach Report, compiled from HHS Office for Civil Rights breach portal filings, published February 2026.
California's 69 breaches and Georgia's 16,050,351 affected individuals sit at the top of two different rankings, which is the clearest evidence that a state's breach count and its breach severity need to be read as separate figures, not one composite score.
The Bottom Line
710 large data breaches spread across every US state in 2025, and no single state dominates both measures that matter. California leads on breach count with 69, a reflection of its size and the sheer number of separate healthcare entities operating there, while Georgia leads on records exposed with over 16 million individuals, driven by a small number of unusually large incidents. Ten states account for just over half of all reported activity, and the national total keeps climbing after each calendar year closes as HHS receives late filings. For any organization handling personal data, the practical lesson is the same regardless of which state it operates in: breach counts and breach severity respond to different weaknesses, and a current, accurate privacy disclosure addresses the reporting side of both.
Frequently Asked Questions
How many data breaches happened across US states in 2025? 710 large data breaches, meaning ones affecting 500 or more people, were reported to the HHS Office for Civil Rights in 2025, according to HIPAA Journal's 2025 Healthcare Data Breach Report published February 13, 2026. That count covers every state, DC, and Puerto Rico, and does not include the many smaller breaches that fall under the 500-person reporting threshold.
Which US state had the most data breaches in 2025? California, with 69 large healthcare data breaches reported in 2025, more than any other state and roughly 10 percent of the national total of 710, per HIPAA Journal's compilation of HHS Office for Civil Rights breach portal data.
Which state had the most people affected by a data breach in 2025? Georgia, where 16,050,351 individuals had their health data exposed in 2025, more than any other state despite Georgia ranking ninth nationally in breach count. California was second with 11,849,467 individuals affected, and Connecticut third with 7,048,122.
Is 710 breaches more or fewer than in 2024? Fewer. Large healthcare breaches fell 4.3 percent year over year, but the number of individuals affected dropped far more sharply, down 78.7 percent to 61,556,256 in 2025 from 289,162,330 in 2024, because 2025 had far fewer mega breaches of 1 million or more records.
Where the Numbers Come From
- HIPAA Journal. (2026). "2025 Healthcare Data Breach Report." Published February 13, 2026. 710 large breaches nationally, state-by-state breakdown by breach count and individuals affected, compiled from HHS Office for Civil Rights breach portal filings.
- HIPAA Journal. "Healthcare Data Breach Statistics." Live tracker of large breach counts by year, 2019 through 2025, checked August 2026.
- Identity Theft Resource Center. (2026). "2025 Annual Data Breach Report." 3,322 US data compromises across all sectors, published January 2026.
- California Office of the Attorney General. "Data Breach Notifications." Public database of breach notices affecting 500 or more California residents, underlying source for state-level breach filings in California.
Note: All figures verified as of August 2026. The HHS Office for Civil Rights breach portal updates continuously as entities file late notifications, so the 2025 breach count in particular will likely keep rising above the 710 figure captured in HIPAA Journal's February 2026 report; this post is refreshed at least twice a year to track that revision.
