What to do when a data breach notice doesn't say much

What happened

Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.

How To Data breach notifications are telling victims less than ever. read Publicly reported data breaches hit an all-time high in the US last year, with over 3,300 incidents recorded and nearly 280 million victim notices mailed out.

As the volume of data breach (an incident in which data leaves an organisation without permission) incidents increases, there’s a growing chance that you’ll be caught up in one. According to the non-profit Identity Theft Resource Center (ITRC), over 471 million victim notices went out in the first half of 2026 alone.

Yet just a quarter (24%) contained details about the attack vector. That’s the lowest ever rate recorded by the ITRC.

This is bad news for consumers, corporate victims and policymakers. A lack of detail prevents you from understanding your true risk exposure or taking meaningful action to limit the fallout and possibly prevent it from happening again. ITRC’s own data shows that three-quarters of victims want a plain-language list of exactly what data was compromised.