Breach notices have already passed the whole of 2025

Data breach notices have already passed, at the halfway point, the total for the whole of 2025. The first half of 2026 records 1,803 reported compromises.

One incident outweighs all the others combined

The breach of Instructure's Canvas platform, used across the education sector, alone produced an estimated 275 million notices to data subjects: 58% of the half-year total.

It is the figure a data protection officer should keep in mind when reading breach statistics. The number of people affected does not measure how often risk materialises: it measures concentration. A few heavily used platforms move the entire aggregate, and most organisations look nothing like the average.

AI appears in one breach in four

Between March 2025 and February 2026, one breach in four was found to involve artificial intelligence — up 56% on the previous year.

Caution is needed here: "involving AI" covers very different things — better-written phishing, automated reconnaissance, attackers using generative tools. It is not a legal category; it is an observation about technique.

What this means for risk assessment

Article 32 requires appropriate measures "taking into account the state of the art". If the attacker's state of the art changes, so does the yardstick by which the adequacy of defences is judged. A risk assessment written two years ago and never revisited is, today, a document describing a different world.

And the Canvas case is a reminder of something easily forgotten: the largest breach your client suffers will almost never happen in their own systems, but in a supplier's. That is why the processor register and the Article 28 guarantees are not paperwork.

It is worth checking two things across your clients: which third-party platforms process their data, and whether any procedure exists to learn of a breach that happened elsewhere. In most cases the answer to the second question is that the news arrives through the press.