What data breaches mean for your identity.
A breach can expose information you cannot easily replace. Here is what major incidents tell us, what the numbers leave out, and which protections help.
Sources reviewed October 28, 2026
How many Social Security numbers were exposed?
Social Security numbers exposed in the 2024 National Public Data breach.
Security researchers at Constella reported this estimate. Leaked files containing real Social Security numbers were posted publicly.
The records included deceased people and inaccurate information. This is not a verified count of living Americans affected.
Constella, NPD breach analysis (opens in a new tab) · Troy Hunt, NPD investigation (opens in a new tab)Does this tell us what percentage of Americans have a publicly available Social Security number? No. The estimate includes old and inaccurate records, including information about people who have died. The sources reviewed do not establish a reliable nationwide percentage.
Where the estimate comes from
Constella reported about 272 million Social Security numbers in its analysis of the National Public Data breach. Researcher Troy Hunt separately reviewed publicly posted files and confirmed they contained real personal information, including Social Security numbers. Constella, NPD breach analysis (opens in a new tab) · Troy Hunt, NPD investigation (opens in a new tab)
The files also included deceased people, repeated records, and inaccurate information. We cannot turn this estimate into a reliable percentage of Americans living today. Other breaches may include the same people, so adding their totals would overcount.
Major breaches worth understanding.
These incidents cover the main risks to everyday people: identity data, health information, government records, and account access. This is a selected guide, not a complete breach registry. Open an incident for its details and source.
Equifax · 2017145.5 million SSNs stolen
The FTC reported roughly 147 million names and birth dates stolen, including 145.5 million SSNs. A breach at a credit bureau can expose the details used to impersonate someone financially. FTC complaint, paragraph 21 (PDF) (opens in a new tab)
Useful response: consider a credit freeze and review your credit reports for unfamiliar activity.
National Public Data · 2024An estimated 272 million Social Security numbers exposed
National Public Data (NPD) collected and combined personal information from other sources. Constella reported about 272 million Social Security numbers in the breach. Troy Hunt reviewed publicly posted files containing real Social Security numbers, but also documented inaccurate information and records of deceased people. The widely reported 2.9 billion figure referred to records, not a verified count of people. Constella, NPD breach analysis (opens in a new tab) · Troy Hunt, NPD investigation (opens in a new tab)
The email-address collection Hunt examined was separate from the files containing Social Security numbers. An email match in the breach-checking service Have I Been Pwned does not establish that your SSN was leaked. A missing match does not establish that it was safe.
Useful response: take preventive identity steps without entering your SSN into an unfamiliar breach-checking site.
Change Healthcare · 2024About 192.7 million individuals affected
HHS reports that Change Healthcare updated the affected count to approximately 192.7 million on July 31, 2025. This was a breach of protected health information. That total is not a count of exposed SSNs. HHS, Change Healthcare FAQ 11 (opens in a new tab)
Useful response: read your individual notice and review medical bills and insurance statements for care you did not receive.
AT&T · disclosed March 2024About 73 million current and former account holders
AT&T reported a dark-web dataset affecting about 7.6 million current and 65.4 million former account holders. It included personal information such as SSNs, with the data source still under investigation in that notice. The company said the dataset appeared to date from 2019 or earlier. AT&T, March 2024 disclosure (opens in a new tab)
Useful response: follow the company's current account-safety instructions and protect your identity as well as your carrier account. The total does not mean every affected person had every field exposed.
T-Mobile · 2021About 76 million U.S. residents covered by the lawsuit settlement
T-Mobile reported stolen personal information, including SSNs and identity-document details for some affected groups. The lawsuit settlement covered about 76 million U.S. residents, which is not a count of exposed SSNs. T-Mobile, 2021 investigation (opens in a new tab) · T-Mobile settlement, class definition (opens in a new tab)
Useful response: follow verified notices, protect your carrier account, and consider identity protections even if you were only a former or prospective customer.
Capital One · 2019About 100 million people in the U.S. and 6 million in Canada
Capital One said the incident affected credit-card applicants and customers. It initially identified about 140,000 U.S. customers with exposed SSNs and later identified roughly 4,700 additional customers or applicants. Most affected people did not have an SSN exposed in this incident. Capital One, 2019 incident and updates (opens in a new tab)
Useful response: read which types of information are listed in your notice. A large affected-person count does not tell you which information was taken.
Anthem · disclosed 2015Almost 79 million people
HHS reported theft of names, SSNs, medical identification numbers, birth dates, addresses, and employment information. Health insurance records can create identity risks beyond medical care. HHS, Anthem findings (PDF) (opens in a new tab)
Useful response: check insurance and financial records, and follow any verified breach notice.
Office of Personnel Management · 201521.5 million background-investigation records affected
OPM reported compromised background-investigation records involving 21.5 million current, former, and prospective federal employees and contractors. Sensitive background information can remain relevant long after an investigation ends. OPM, 2015 breach review (PDF) (opens in a new tab)
Useful response: use official agency notices and be cautious when an unexpected caller knows details about your work or history.
Yahoo · 2013, scope updated in 2017Approximately 3 billion accounts worldwide
Yahoo ultimately said all of its roughly 3 billion accounts existing in 2013 were affected. Accounts are not unique people, and this worldwide figure is not an American SSN count. Yahoo, October 2017 disclosure (opens in a new tab)
Useful response: replace exposed or reused passwords and add an extra login check to important accounts.
Do not add these totals together. The same person may appear in several incidents, and the figures count different things.
What someone can do with stolen information.
Identity thieves may try to open accounts, take a tax refund, obtain employment, or get medical care in someone else's name. A name and SSN are not a universal key, but the combination can support impersonation. Exposure does not mean these crimes have happened to you. FTC, identity theft guidance (opens in a new tab)
Changing an email password protects account access. It cannot undo a leaked SSN. Likewise, a credit freeze helps with new-credit fraud, while other risks need other protections.
Choose the protection that fits the risk.
- New credit in your name: U.S. residents can place a free security freeze with Equifax, Experian, and TransUnion. Monitoring can alert you to changes, but it is not a freeze. FTC, credit freezes and fraud alerts (opens in a new tab)
- A fraudulent federal tax return: consider an IRS Identity Protection PIN. IRS, Identity Protection PIN (opens in a new tab)
- Account takeover: use unique passwords, an extra login check, and current recovery details.
- Existing fraud: review bank, credit, and insurance records. Contact the affected institution through its official site. FTC, identity theft guidance (opens in a new tab)
If something has already happened, open the emergency help guide. Otherwise, start the checkup and include U.S. guidance if it applies to you.
Can you check whether your information was exposed?
Start with a verified notice from the affected organization. You can check an email address directly at Have I Been Pwned (opens in a new tab), but it cannot give you an all-clear for your SSN. Its NPD result has the limitations described earlier.
Safer Blueprint does not look up your records and never asks for an SSN, password, or verification code. You can take preventive steps even if you do not know whether you were affected.