Freely subscribe to our NEWSLETTER

Leaked accounts increased by 5x in Q1 2024 compared to Q4 2023 (from 81M to 435M, according to the Global data breach monitoring tool by cybersecurity company Surfshark. The US, China and Russia were the most breached countries in 2024 so far. Since 2004, a total of 17.2B accounts have been breached, and approximately 6.5B of them have unique email addresses.

“Surfshark’s extensive monitoring of data breach trends over the past two decades reveals an alarming digital reality: data leaks persist as an ongoing global threat. Since 2004, a staggering 17 billion user accounts have been leaked worldwide, with 400 million occurrences recorded at the start of this year,” says Lina Survila, a spokesperson at Surfshark. “We urge everyone to remain vigilant, create strong passwords, refrain from reusing them, and exercise caution when sharing personal information online.”

Breach rates have been on the rise compared to the last quarter

In Q4 2023, 627 accounts were being breached every minute. In Q1 2024, however, breach rates are 435% higher, with 3,353 accounts being leaked every 60 seconds. It means that 5 out of 100 people in the world suffered account breaches in Q1 2024.

Out of 17B leaked user accounts, 38% of them are unique email addresses. A total of 60.9B data points have been exposed (17.2B of them have been email addresses) since 2004. On average, each email address is leaked with 3 additional data points. American and Russian accounts are leaked the most often.

In descending order, the ten most breached coutries since 2004 were, The US (3.0B), Russia (2.4B), China (1.1B), France (521.6M), Germany (486.7M), Brazil (354.2M), The UK (321.9M), India (320.5M), Italy (266.8M) and Canada (213.8M).

The countries with the highest breach density since 2004 (number of leaked accounts per resident): Russia (16.8), The US (9.0), South Sudan (8.1), France (8.1), Czechia (6.1), Singapore (5.8), Germany (5.8), Canada (5.5), Australia (5.3), The UK (4.8) and Portugal (4.7).

Most people use the same email for different accounts when registering online. That’s why a single email or account can be breached several times in separate cases, and some numbers may seem so high (like 17.2B total breached accounts).

When an email account is breached, the user is at risk of social engineering and identity theft. Scammers might send fake emails pretending to be from legitimate organizations, and those emails might contain links with computer viruses or requests to disclose even more personal information. If the email address was leaked with more personal information like name and address, scammers might even be able to impersonate the victim for various malicious purposes.

If you suspect your information has been breached, you should:

Change the passwords to your accounts immediately
Enable two-factor authentication where possible
Contact your bank if your credit card information was leaked
Scan your devices for malware
Keep an eye out for scams if your email, phone number, or other contact information leaked.

METHODOLOGY

A data breach happens when confidential and sensitive data gets exposed to unauthorized third parties. In this study, we treat every breached or leaked email address used to register for online services as a separate user account, which may have been leaked with additional information, such as password, phone number, IP address, zip code, and more.

The data was collected by our independent partners from 29,000 publicly available databases and aggregated by email address. To determine the location of the email address, our partners’ mechanism looked into several associated parameters, such as domain names, IP addresses, locales, coordinates, currency, or phone numbers. This data was then anonymized and passed on to Surfshark’s researchers to analyze their findings statistically.

The Data Breach World Map is updated monthly with the most recent data from our independent partners. Countries with a population of less than 1M people were not included in the analysis.

Note: A data breach happens when confidential and sensitive data gets exposed to unauthorized third parties. In this study, we treat every breached or leaked email address used to register for online services as a separate user account, which may have been leaked with additional information, such as password, phone number, IP address, zip code, and more.