Inside the 17.9 billion-record tally: the limits of megabreach league tables

Two numbers sit at the centre of a recent breach ranking: more than 8.1 billion records and 27.8 per cent. They both describe the web or online sector, but they answer different questions.

IT Asset Management Group, or IT-AMG, reports that web companies account for more than 8.1 billion of the close to 17.9 billion records associated with the ten leading sectors in its analysis. Using those rounded totals, that is roughly 45 per cent of the records. The smaller figure, 27.8 per cent, is the web category’s reported share of incidents in the full catalogue, not its share of records.

That distinction is more than arithmetic housekeeping. A statistic about incidents can become a claim about exposed records, and a record count can become an implied count of people. Neither conversion is justified by the available analysis. The ranking offers a useful view of selected large events, but it cannot by itself identify unique victims or establish which industry is most likely to lose data.

A ranking built on a catalogue

Inc. reported the 17.9 billion figure on 16 September 2026, attributing the sector analysis to IT-AMG. A more detailed company-authored account had been syndicated by the Daily Press on 22 August. The analysis covers reported events dating from 2004 and groups them into sectors including web, government, healthcare, retail, financial, technology and telecoms.

The figures were not produced from a new census of organisations or regulatory notifications. Medical Laboratory Observer identified the underlying source as Information is Beautiful’s long-running World’s Biggest Data Breaches & Hacks catalogue. It reported that the June 2026 version contained more than 500 incidents, each involving more than 30,000 records, and that the ten leading sectors represented nearly 95 per cent of entries.

Information is Beautiful describes its project as regularly updated and lists the Identity Theft Resource Center, DataBreaches.net and news reports among its sources. IT-AMG then aggregated the catalogue by sector. The company describes itself as an IT asset disposition provider offering services that include data destruction and secure retirement of technology assets.

That commercial role does not invalidate the calculations. It does make provenance important: the underlying catalogue, IT-AMG’s aggregation and the company’s interpretation are separate layers. The raw workbook, calculation method and versioned source sheet were not available in the reviewed material, so the reported totals remain attributed calculations rather than independently reproduced findings.

The catalogue is also a selected collection of unusually large, publicly documented events, not a complete population of breaches worldwide. Its threshold and reliance on publicly available reporting make it useful for illustrating megabreach scale, but unsuitable for measuring every event, including smaller or undisclosed incidents.

Records are not people

The 17.9 billion total refers to records associated with selected events. It does not establish that 17.9 billion different people were affected. The available methodology does not say whether IT-AMG deduplicated data across incidents, repeated datasets or multiple records belonging to one person.

Security reporting uses several units that can sound interchangeable but are not. An incident is an event considered relevant to security analysis. A confirmed breach is a narrower category. A victim is an affected person, while a record is a unit of data whose contents and relationship to an individual can vary.

Other security reports preserve these distinctions explicitly. The Identity Theft Resource Center’s 2025 annual report recorded 3,322 US data compromises and 278.8 million victims, presenting events and affected people separately. Verizon’s 2024 Data Breach Investigations Report analysed 30,458 security incidents and 10,626 confirmed breaches from 2023, again treating those categories as different measures.

Record counts remain a legitimate way to convey the scale of an event or collection of events. The problem begins when the unit disappears. Without definitions, a time period and information about deduplication, a large cumulative record total cannot answer how many unique people were affected, how many organisations experienced a breach or how frequently such events occur.

Why incident counts do not reveal probability

IT-AMG reports 150 web incidents, followed by 63 government incidents, 56 in healthcare, 53 in retail and 51 in the financial category. The ten listed sector totals add up to 512 selected incidents. Those counts show how entries in the catalogue were distributed after classification.

They do not establish that an organisation in the web category is more likely to suffer a breach than one in another sector. Calculating such a rate would require an exposure denominator, such as the number of organisations, users or records held in each category. It would also require reasonably consistent detection and reporting coverage.

A sector with many large platforms can generate a high number of records from relatively few events. Another sector might contain more organisations but fewer catalogue entries because its incidents are smaller, less visible or below the selection threshold. Raw counts cannot resolve those differences.

The ranking can still show where exceptionally large documented exposures have accumulated. That is a narrower and defensible use. It becomes misleading only when a distribution within a curated list is presented as the underlying probability that a sector will experience a breach.

Definitions can move the rankings

Two examples reported by Inc. expose the importance of category rules. Inc. describes the leading 2021 LinkedIn example as public-facing data from hundreds of millions of users being scraped and offered for sale. That description does not, on its own, establish a conventional system intrusion. Yet its inclusion affects the web category’s incident and record totals.

Inc. also places the 2024 National Public Data incident in the government category while identifying National Public Data as a background-check company. The reviewed material does not provide the codebook or explain that placement. It is therefore not possible to determine whether it reflects a deliberate classification rule, shorthand or inconsistent coding.

Broad labels can make a complicated dataset easier to navigate, but web, technology and telecoms can overlap, while a private company may hold information commonly associated with public records. A ranking needs transparent rules for organisations spanning several functions, as well as consistent treatment of scraping, leaks, hacks and other forms of exposure. Without them, category boundaries can materially change the result.

When the average is not typical

Megabreach catalogues are especially sensitive to outliers. IT-AMG reports a web-sector median of 11.5 million records per incident and a mean of 54,259,574. For government, the reported median is 1.7 million, compared with a mean of 44,794,364. A large gap between the two indicates that the average is being pulled upwards by exceptionally large entries.

Telecoms demonstrates the same issue from another direction. It has only 30 listed incidents, fewer than several other sectors, but IT-AMG gives it the highest sector mean at 67,668,591 records per incident. That does not make telecoms the sector with the most incidents. It shows how a small number of very large events can dominate a mean.

Medians help describe the middle listed event, while cumulative totals and means reveal the influence of the largest cases. None is inherently the correct measure. Each answers a different question, and the full distributions are unavailable here.

Global context is not an Australian rate

Australians use services represented throughout the global catalogue, so its examples can provide context about the scale of major data exposures. They should not be treated as evidence of Australia’s domestic sector pattern.

The Office of the Australian Information Commissioner maintains a collection of Notifiable Data Breaches publications for Australian reporting. That notification series has a different scope and purpose from a global catalogue of selected megabreaches. Comparisons need to account for their definitions, reporting systems, periods and inclusion rules. No Australian figures can be safely inferred from IT-AMG’s ranking alone.

Reading the next enormous breach number

A breach statistic becomes more informative when the reader can identify its unit, denominator and source. Is it counting records, people, incidents or confirmed breaches? Does a percentage describe events or exposed data? What period and selection threshold apply? Were repeated people or datasets deduplicated? Are sector labels defined consistently, and is the source a regulator, a research report or a curated media catalogue?

The 17.9 billion tally captures something real but limited: the accumulated record scale attributed to selected, publicly reported events and grouped under a particular taxonomy. It does not count 17.9 billion unique victims, measure every breach or prove that one sector is intrinsically the most breach-prone. The most consequential number in a breach league table may therefore be the denominator that the headline leaves unstated.

Units and denominators shape what breach statistics can support, making disciplined interpretation a useful security habit. If you want a wider grounding, look to The Hack Academy’s online cybersecurity training programme, which lists cybersecurity fundamentals among its subjects and offers self-paced learning with practical exercises alongside theory.