Personal data breach reports in first 7 months of 2026 already surpass full-year 2025 total

The number of personal data breach reports filed this year surpassed the entire 2025 annual total in just seven months, with large-scale hacking attacks battering the private sector while negligence-related incidents are rising sharply at public institutions, prompting calls for tailored responses to each type of breach.

According to data submitted to the office of People Power Party lawmaker Park Jun-tae of the National Assembly's Political Affairs Committee by the Personal Information Protection Commission, 499 personal data breach reports were filed through July — already exceeding the full-year 2025 total of 447. The figure is more than three times the 163 cases recorded in 2021.

The scale of exposed data has also jumped. Last year, about 103.55 million personal records were reported as compromised — the first time the annual figure exceeded 100 million since 2021. Through July this year, about 40.42 million additional records have been reported. Combined, the total number of personal records exposed from last year through July stands at about 143.96 million over just 19 months.

The acceleration becomes even more striking when compared with the preceding four years. From 2021 to 2024, the annual totals were about 9.91 million records, 4.98 million, 10.11 million and 13.77 million, respectively — a combined 38.77 million over four years. The volume exposed in the past 19 months alone is roughly 3.7 times that four-year total.

Private-sector hacking incidents have been the primary driver of the surge. About 101.59 million personal records were reported as stolen through private-sector hacking last year, with another roughly 39.69 million tallied through July this year.

Of the roughly 143.96 million total records exposed from last year through July this year, about 141.28 million — approximately 98 percent — stemmed from private-sector hacking. A pattern has emerged in which a single breach can expose tens of millions of records at once, pulling the overall totals sharply higher.

While the private sector has seen an explosion in the sheer volume of data stolen through large-scale hacking, public institutions have stood out for a different reason: a rising number of incidents caused by employee negligence.

Breach reports at public institutions attributed to negligence more than doubled, climbing from 74 cases last year to 151 through July this year. Negligence-related incidents accounted for about 83 percent of the 182 total breach reports filed at public institutions so far this year.

The volume of personal records exposed through negligence also grew sharply — from about 40,000 last year to roughly 550,000 through July this year, a more than 13-fold increase. Because the private sector is primarily threatened by external hacking while public institutions are undermined by internal management failures, analysts say the two sectors require fundamentally different responses.

"Before asking how to protect personal data, we need to ask why so much of it is being stockpiled in the first place," Park said. "The personal data management system must be fundamentally restructured so that companies and public institutions retain only the information they truly need."