Biggest Data Breaches in History: Ranked List (2026)

TL;DR: The largest data breach by record count is the 2024 MOAB compilation at about 26 billion records, and the largest single-company breach is Yahoo's 3 billion accounts. Counts are records, not people, and figures come from StationX's 2026 ranking and company disclosures. Check whether you were exposed. Free tool: Scan My Shadow's digital footprint checker at scanmyshadow.com/digital-footprint-checker.

👉 Use the free digital footprint checker — 30 seconds →

People search for hacked sites, massive data leaks and major data breaches for the same reason: to find out whether their own data is in them. This list ranks the biggest and best-known incidents. Numbers are records exposed, as reported at the time; one person can appear many times.

Biggest data breaches in history, ranked

MOAB (2024), about 26 billion records. A compilation of data from thousands of earlier breaches, not a single hack.
Chinese PII leak (discovered January 2026), 6.38 billion unique records per SpyCloud, including about 2.5 billion national ID numbers, from an exposed Elasticsearch cluster.
Yahoo (2013), 3 billion accounts. The largest single-company breach on record.
National Public Data (2024), about 2.9 billion records including Social Security numbers; a data broker breach.
Aadhaar (2018), reportedly 1.1 billion records. See identity theft in India.
Equifax (2017), 147 million people. Cost the company about $1.38 billion.

Google, Facebook, LinkedIn and Dropbox data breaches

Google: the 2018 Google+ bugs exposed profile data of up to 500,000 users in the first disclosure and 52.5 million in a later one.
Facebook: a 2019 scraping incident exposed phone numbers and profile details for about 533 million accounts, published in 2021.
LinkedIn: a 2012 breach exposed credentials, and a 2021 scrape of roughly 700 million profiles was sold online.
Dropbox: a 2012 breach leaked about 68 million account credentials, made public in 2016.

Hacked sites and compromised websites: how to check

There is no public list of everyone's compromised passwords, and you should not trust sites offering one. Instead, look your email up in a breach database: the free Scan My Shadow checker or Have I Been Pwned, which also publishes the list of breached sites it tracks. See what a data breach actually is and how stealer logs differ.

If your data is in a large data breach

Change reused passwords and turn on two-factor authentication.
Freeze your credit if ID numbers leaked; see identity theft protection: is it worth it.
Watch for follow-up phishing; see recent data breaches for what is happening now.

Data breaches list: what counts as massive

A massive data breach usually means tens of millions of records or more, while a large data breach can be smaller but sensitive. For breaches that just happened, see recent large data breaches. If your own website was hacked, treat it as an incident: take it offline if needed, change all credentials, update software and check with your host.

FAQs

What is the biggest data breach in history?

By record count, the MOAB compilation of about 26 billion records in 2024, although it combined data from earlier breaches. The biggest breach of a single company is Yahoo's 2013 incident affecting 3 billion accounts.

What is a list of the largest data breaches?

The ranked list above covers MOAB, the 2026 Chinese PII leak, Yahoo, National Public Data, Aadhaar and Equifax, with the year and records exposed for each.

Which hacked sites can I check?

Have I Been Pwned maintains a public list of breached websites it tracks, and you can check your own email against it or with the free Scan My Shadow checker.

Was Google, Facebook, LinkedIn or Dropbox ever breached?

Yes, in different ways: Google+ had API bugs in 2018, Facebook had a large scraping incident published in 2021, LinkedIn had a credential breach in 2012 and a scrape in 2021, and Dropbox lost credentials in 2012. Details are above.

Is there a list of compromised passwords I can download?

Do not download random lists. Use a checker that never exposes your real password, such as Pwned Passwords, and read how to check if your password was leaked.

What is a massive data leak?

A large exposure of records, often through an unsecured database or a third-party vendor, sometimes without any hacking involved.

What is a massive data breach?

A breach exposing tens of millions of records or more, or one that leaks highly sensitive data such as ID numbers. The largest are compilations or breaches of huge platforms.

My website was hacked. What should I do?

Take the site offline if needed, change all passwords and keys, restore from a clean backup, update software and plugins, and check with your hosting provider.

Before scammers use your details, see them first: check what is already public about you.

Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.

The Biggest Data Breaches of All Time, Ranked by Records Exposed