The Worst Year for Data Breaches: 2019 and What Came After

The year 2019 had its ups and downs, but one of the worst things to happen that year was the sheer volume of exposed data. Researchers, journalists and security firms counted billions of records exposed, and the term “worst year for data breaches” appeared in report after report. Years later, the pattern has not gone away. This article revisits 2019, explains how to read breach statistics and looks at what has changed by 2026, including what you can do to protect yourself.

1. Why 2019 stood out

Several large incidents defined the year.

Collection #1 and related credential dumps. In early 2019, researchers reported a massive collection of email and password combinations, around 773 million unique email addresses in the first set, compiled from earlier breaches and sold or traded. Such “combo lists” fuel credential-stuffing attacks, where criminals try leaked passwords on other sites.

First American Financial. A flaw on the title insurer’s website exposed roughly 885 million documents, many containing Social Security numbers, bank account details and mortgage records, to anyone who guessed a URL. See First American leaks 900 million documents.

Capital One. An outsider exploited a misconfigured firewall and accessed data about roughly 100 million people in the United States and 6 million in Canada. The Office of the Comptroller of the Currency fined the bank $80 million in 2020, and a $190 million class settlement followed. See Capital One hacker caught red-handed.

Facebook exposures. Researchers found hundreds of millions of Facebook-related records on unsecured servers, including phone numbers and user IDs, as covered in Facebook leaks personal information again. That year the company also agreed to a $5 billion penalty with the Federal Trade Commission over privacy violations.

Other incidents. Many other companies, hospitals, retailers and government contractors disclosed breaches throughout the year. See more than 4 billion records exposed in 2019 and data breaches increased by nearly 20 percent in 2019.

2. How to read breach statistics

Headlines count “records,” not people. A single person may appear in many records across many breaches, so billions of records do not mean billions of separate victims. Counts also vary by source: some tally incidents reported to regulators, some include exposed databases found by researchers and some rely on company disclosures. Year-to-year comparisons can be affected by changes in notification laws, which increase reporting. A year can seem worse simply because more incidents became visible.

What the numbers reliably show is direction: data is being exposed at scale, regularly. The FBI’s Internet Crime Complaint Center logged 67,456 personal data breach complaints and $1.31 billion in related losses in 2025, per ic3.gov. That figure covers only complaints that reached the IC3.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. Why breaches keep happening

The causes in 2019 have not gone away: valuable data, complex systems, misconfigurations, slow patching, phishing and vendor weaknesses. Companies keep large amounts of data for long periods, which increases the damage when something goes wrong. Penalties arrive late. Our article security or advertising? explains the incentives, and do big fines prevent data leaks? looks at enforcement.

4. What has changed since 2019

More laws. About twenty US states now have comprehensive privacy laws, and all states have breach notification laws. California, Vermont, Texas and Oregon have data broker registries, and California’s DROP lets residents request deletion from registered brokers, with processing starting August 1, 2026.

More regulation. The Federal Trade Commission and state attorneys general have brought actions that require security programs, data minimization and deletion. See ftc.gov.

More authentication options. Passkeys and hardware keys are available on more services, making phishing and credential stuffing less effective.

More AI-assisted crime. Attackers use AI to write convincing phishing and to scale social engineering. The FTC reported $15.9 billion in fraud losses in 2025.

Persistent reuse of old data. Data from 2019 and earlier is still being combined with newer leaks.

5. What to do now

Freeze your credit at Equifax, Experian and TransUnion. It is free; see IdentityTheft.gov and consumer.ftc.gov.
Use unique passwords from a password manager, and change any you reused.
Turn on MFA, preferring authenticator apps or passkeys.
Check your exposure with a reputable breach-notification service, and read official notices.
Avoid breach-themed phishing. Verify notices on the company’s own site.
Delete old accounts you no longer use.
Reduce your public footprint so leaked data is harder to match to you. Use official opt-outs such as spokeo.com/optout, suppression.peopleconnect.us and thatsthem.com/optout. California residents can use DROP at privacy.ca.gov/drop.
Know where to report: IdentityTheft.gov, ReportFraud.ftc.gov and ic3.gov.

For a response plan, see data breach response strategies and what is a data breach.

6. How long exposure lasts

The lasting damage of a breach comes from data that cannot be changed: Social Security numbers, birth dates, addresses and biometric templates. A password can be reset in minutes; a birth date cannot. That is why defenses focus on making stolen data unusable: freezes block new accounts, MFA blocks logins and fewer public listings block easy matching. Read how long can data leaks affect you.

7. A worked example

Felix learns that a title company that handled his 2018 home purchase exposed documents in 2019. He did not act at the time. Now he freezes his credit, adds MFA to his bank and email, and notices his address on eleven people-search sites. He opts out of the top seven. When a mailer arrives that references his mortgage, he recognizes it as marketing built on old data and shreds it. His recheck in two months shows one new listing, which he removes.

8. Myths about breach years

“The worst year is behind us.” Breaches remain frequent. “Records equal victims.” Counts overlap. “Fines will fix it.” They help but arrive late. “Old breaches don’t matter.” Criminals reuse old data.

9. Case study: when a simple flaw exposes millions

The First American Financial exposure is a useful case because it was not a sophisticated hack. A website design flaw let anyone who changed a number in a web address see another customer’s document. No password was needed. The exposed files included bank statements, mortgage paperwork and Social Security numbers. Cases like this show that large-scale exposure can come from basic mistakes in access control, not only from skilled attackers. For consumers, the lesson is twofold: you cannot audit every company, so you must assume that some of your documents will leak, and you should keep copies of sensitive documents out of email and unprotected cloud folders. The Federal Trade Commission explains how to respond to exposed financial information at consumer.ftc.gov and identitytheft.gov.

10. Tracking breaches that affect you

Keep a simple record of notifications you receive: the company, the date, what data was exposed and the steps you took. When another notice arrives, check whether the same email or password appears in older entries and whether any account still needs a change. If you find reused passwords, replace them. If the same personal details appear repeatedly, such as your Social Security number, decide whether to add extra protections such as an IRS Identity Protection PIN from irs.gov and a lock on your Social Security account at ssa.gov. A simple log turns an endless stream of alarming headlines into a manageable to-do list.

11. Why the headline numbers do not tell you what to do

Most people read breach headlines and feel helpless. The numbers are too big to relate to personal risk. A better question than “How many records were exposed?” is “What did they expose about me, and what can I do to make it less useful?” If an email address leaked, change the password and enable MFA. If a card number leaked, ask the issuer for a new card. If a Social Security number leaked, freeze credit. If an address and phone number leaked, remove public listings so the leak is harder to match. Every type of exposure has a matching response, which makes the problem solvable even when the headline is overwhelming.

12. Corporate transparency and what to expect from notices

Breach notifications vary in quality. Good notices explain what happened, when, what data was involved, what the company is doing and what you should do. Weak notices are vague, late or buried. State laws set deadlines and content requirements, and attorneys general publish lists of reported breaches in several states. If a notice is unclear, read the company’s official page for details, and avoid sharing personal information with anyone who calls or emails you about the incident, since scammers often impersonate the company to exploit the news.

13. Three scenarios

Scenario 1: You learn your email is in an old dump. Change passwords everywhere it was used and enable MFA.

Scenario 2: You receive a mortgage-related scam call. Hang up and call your lender on a known number.

Scenario 3: A company you left years ago is breached. Request deletion of your account and data.

14. What to expect: a realistic timeline

Action	Time to do	When it takes effect
Credit freezes	30 minutes	Immediate
Password and MFA cleanup	1 to 2 hours	Immediate
Account deletions	1 to 3 hours	Days to weeks
Broker opt-outs	2 to 4 hours	Days to 4 weeks
Rechecks	15 to 30 minutes	Every 60 to 90 days

15. Common mistakes

Treating a breach year as past history.
Reusing passwords.
Believing monitoring replaces freezes.
Clicking breach-related emails.
Leaving public listings in place.

16. How Wiperts helps after every breach year

Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so relisted data is removed again.

Check how easily leaked data could be matched to you.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

17. Key takeaways

2019 featured billions of exposed records, but the pattern continues.
Read statistics carefully: records are not people.
Freeze credit, use unique passwords and MFA, and delete old accounts.
Shrink your public footprint so leaked data is less useful.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

18. Frequently Asked Questions

Why was 2019 called the worst year for data breaches?

Reports counted billions of exposed records, including the Collection 1 credential dump, First American Financial’s exposure of hundreds of millions of documents and the Capital One incident.

Are breaches still increasing?

Breaches remain frequent. The FBI’s IC3 logged 67,456 personal data breach complaints and $1.31 billion in losses in 2025, and large incidents continue to occur.

What is the difference between a breach and a leak?

A breach involves unauthorized access by an attacker. A leak often results from misconfiguration or exposure of data without active hacking, such as an open database.

What should I do after any breach?

Change reused passwords, enable MFA, freeze your credit, watch your accounts and avoid clicking links in unexpected breach emails.

Why do record counts overstate the number of victims?

Records include duplicates and old data, so the number of unique affected people is usually lower than the number of records.

Can I find out if I am in a breach?

Use a reputable breach-notification service and review notices you receive, and always check the official site of the company involved.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing