Breach Reports Rose 20 Percent in 2019: What State Data Tells Us Today

In late 2019, the Washington State Attorney General released his office’s fourth annual data breach report. The numbers were local, not national, but they offered a rare window into how breaches look through the lens of a notification law. The headline was that reported breaches had risen nearly 20 percent compared with the previous year. This revisited article explains what such reports reveal, how breach notification law works in 2026 and how to use state-level data to protect yourself.

1. What the Washington report showed

Washington law requires businesses and state agencies to notify the attorney general when a breach affects 500 or more Washington residents. The attorney general’s office compiles those notices and publishes an annual analysis of what happened.

The 2019 edition reported that breaches were up nearly 20 percent from the prior year. It also described the common causes, with hacking, malware and phishing leading, and the types of data most often exposed, including names, Social Security numbers and driver’s license numbers. We are describing the findings of that report at a high level and not asserting current totals.

Why is this useful years later? Because the structure of the data is more informative than any single year’s figures. It shows that breaches are driven by a small number of repeating causes, that sensitive identifiers are routinely exposed and that smaller incidents are reported only because the law forces disclosure.

2. How breach notification laws work

Every U.S. state has some form of data breach notification law. The details differ, but several themes recur.

Feature	Typical rule
Trigger	Unauthorized acquisition of personal information, often a name plus a Social Security number, financial account number or driver’s license number
Notice to individuals	Required within a deadline, often 30 to 60 days in many states
Notice to regulators	Required when a threshold number of residents is affected
Exceptions	Encrypted data or data deemed unlikely to cause harm in some states
Content	Description of what happened, data involved, steps taken and resources
Enforcement	State attorneys general can bring actions

Without these laws, many breaches would never become public. They are a primary reason we know as much as we do about the scale of the problem. Read what is a data breach for a plain-language description of how incidents occur.

3. Why reported counts are an imperfect measure

Breach numbers are useful, but they must be read with caution.

Detection varies. Many organizations discover intrusions months after they begin, and some never do.
Reporting varies. Thresholds and definitions differ, so a breach affecting 400 residents in one state may not appear in any report.
Laws change. When a state broadens its definition or lowers its threshold, counts can rise without any change in underlying risk.
Record counts exaggerate or understate. A single breach can touch millions of people, while a count of incidents treats it as one.
Multiple notices overlap. The same event may be reported by several organizations in a supply chain.

An increase of 20 percent therefore means “more reported breaches”, not necessarily “20 percent more danger”. The takeaway for individuals is practical: breaches are common enough that you should plan for being included.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

4. What state data suggests about causes

State reports tend to find similar causes year after year.

Hacking and malware. External attackers exploit vulnerabilities, stolen credentials or ransomware.
Phishing. Employees are tricked into giving access.
Third-party vendors. A breach at a service provider exposes many clients.
Human error. Misdirected emails or unsecured cloud storage.
Lost or stolen devices. Laptops and drives that are not encrypted.

The overlap with national figures is strong. In 2025, the FBI’s Internet Crime Complaint Center recorded 67,456 personal data breach complaints with reported losses of $1.31 billion, and 31,675 identity theft complaints. Our summaries of the worst year for data breaches and more than 4 billion records exposed in 2019 show how the national picture around that time compared.

5. How to use your state’s breach information

You do not need to be a researcher to benefit from public breach data.

Find your attorney general’s breach page. Many states list notices, annual reports or searchable databases on their .gov websites.
Search for organizations you use. Check whether banks, retailers, medical providers or employers have reported incidents.
Read the notice details. Pay attention to the data types involved and the dates.
Act on what was exposed. Social Security numbers call for credit freezes and tax protections. Passwords call for changes and multi-factor authentication. Medical data calls for insurance statement review.
Keep a log. Note which breaches you were in and what you did.
Compare with your own records. If you receive a notice for a company you do not remember, think about old accounts or vendors that held your data.

Our guide to information on data breaches and what to do after a data breach notice help interpret what you find.

6. What to do when you are notified

A notice is a signal to act, not just to file.

Freeze your credit at all three bureaus. See what is a credit freeze.
Change passwords for affected services and anywhere you reused them.
Enable multi-factor authentication, preferably using an authenticator app.
Watch your accounts and review credit reports at AnnualCreditReport.com.
Request an IRS Identity Protection PIN if your Social Security number was exposed.
Be careful with follow-up messages. Verify any message about the breach using the organization’s official website.
Report problems at IdentityTheft.gov.

7. Why removal belongs in the response

Notification laws tell you what was exposed. They do not shrink the number of public places where your address and phone number appear, and those places help criminals connect breached data to a current identity. Removing your listings from people-search sites narrows that bridge. Our data broker cleanup guide shows how, and the article on how long data leaks can affect you explains why the effects can last for years.

For the broader legal landscape, see state privacy laws in 2026, which covers rights to access and delete your information beyond breach notices.

8. Myths about breach statistics

“If breaches are up, I should panic.” Alarm does not help; a calm, short checklist does. “My state’s law protects me from breaches.” Notification laws inform you but do not prevent incidents. “Companies always tell me quickly.” Notice deadlines exist, but detection and disclosure can lag. “Only big companies report.” Smaller organizations are also covered once thresholds are met.

9. Reading a breach notice like an investigator

A notice often hides its most important details in a few sentences. Look for the date of the incident, the date of discovery and the date of notice, because long gaps mean longer exposure. Note exactly which data elements were involved, such as Social Security numbers, financial account numbers, medical information or login credentials, since each calls for a different response. See whether the organization names a vendor or a cause, which can help you spot other services affected by the same incident. Finally, check what it offers: monitoring, a call center, a deadline to enroll. The Federal Trade Commission explains how to respond at consumer.ftc.gov, and its consumer pages describe steps for individuals.

10. Where to report problems with a breach response

If you believe an organization failed to protect or promptly disclose your data, you have options. Contact your state attorney general’s consumer protection office, which enforces the state’s breach law. Report identity misuse at IdentityTheft.gov. For financial firms, the Consumer Financial Protection Bureau accepts complaints at consumerfinance.gov. Keep your notice, your correspondence and your own log, since they strengthen any complaint.

11. Three scenarios

Scenario 1: You receive a notice from your pharmacy. Check what was exposed, freeze your credit, review insurance statements and consider whether your medications reveal sensitive information to anyone who sees the data.

Scenario 2: You live in a state with weak transparency. Rely on notices you receive, news reports and federal resources. Keep your own log and enable alerts on financial accounts.

Scenario 3: You work for a small business. Learn your state’s notification requirements, limit the data you keep and train staff to spot phishing, because small organizations are common targets.

12. What to expect: a realistic timeline

Item	Typical timing
Notice to individuals	Often within 30 to 60 days of discovery under many state laws
Credit freeze	About 30 minutes
Annual state report	Published once a year, covering the prior year
Risk after a breach	Can last years
People-search opt-outs	Days to 4 weeks

13. Common mistakes

Treating a breach notice as junk mail.
Accepting credit monitoring and skipping the freeze.
Reusing the breached password elsewhere.
Assuming that no notice means no breach.
Ignoring the data types involved in the notice.

14. How Wiperts supports your response

Wiperts focuses on the part that notices do not address. It scans more than 100 data brokers and people-search sites for your name, address and phone number, submits removal requests, requests removal of personal results from Google and Bing, blurs your home on maps and monitors the web 24/7 so relisted data is removed again.

Start with a free exposure scan.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

15. Key takeaways

State reports show breaches are frequent and driven by repeating causes.
Notification laws exist in every state, but their details differ.
Use your attorney general’s breach page and your notices to guide action.
Freeze credit, change passwords and remove public listings.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

16. Frequently Asked Questions

Why do state attorneys general publish breach reports?

Many states require companies to notify the attorney general when a breach affects a threshold number of residents. The offices compile the notices into public reports and databases that show trends, causes and the types of data exposed.

What did Washington State’s 2019 report find?

The report described a nearly 20 percent increase in breaches compared with the prior year, with hacking and malware among the leading causes, and noted that names, Social Security numbers and driver’s license numbers were frequently exposed.

Do all states require breach notification?

Yes. All 50 states, the District of Columbia and several territories have laws requiring organizations to notify affected residents of certain breaches, though the triggers, deadlines and thresholds differ.

Where can I check for breaches affecting my state?

Many state attorney general websites post breach notices or annual reports. Search for your state’s attorney general breach notification page on the official .gov site.

Are breach numbers rising or falling?

They vary by year and by how they are counted. Reports are affected by changing laws and detection. The consistent trend is that breaches remain frequent, and in 2025 the FBI’s IC3 logged 67,456 personal data breach complaints.

What should I do when I get a breach notice?

Read it, freeze your credit, change relevant passwords, enable multi-factor authentication, monitor your accounts and remove public listings that make leaked data easier to match.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing