By Roy Urrico

The Identity Theft Resource Center (ITRC) revealed the number of data compromises reported in the U.S. in 2024 decreased by 1% from 2023. However, the number of data breach notices issued in 2024 increased by 312% from 2023. These are among the findings in the ITRC 2024 Annual Data Breach Report.
The ITRC, an El Cajon, Calif.-based national nonprofit organization that supports identity crime victims, released its annual report January 28, 2025 at the Identity, Authentication and the Road Ahead Cybersecurity Policy Forum hosted by the Better Identity Coalition, the FIDO (Fast IDentity Online) Alliance and the ITRC.
According to the ITRC 2024 Annual Data Breach Report, the number of U.S. data compromises in 2024 (3,158) decreased 1% percent compared to the record-setting amount in 2023 (3,202). The types of information exposed in data compromises skewed toward sensitive information with a renewed focus on financial information along with a continued increase in driver’s license and health information.
In 2024, the financial services industry, led by commercial banks and insurance, was the most breached industry, followed by healthcare (the most attacked industry each year from 2018 until 2024), professional services, manufacturing and technology. In 2024, 59 compromises impacted credit unions, with approximately 2 million notices sent to members.
Mega-Breaches Fuel Notifications Rise
The ITRC uses the number of victim notices for both individual events and as a total for all reported compromises as a measure of the scale of events and impacts on individuals. However, the organization pointed out the victim notices should not be considered a one-to-one count of actual victims since not all notices include a victim count.
According to the ITRC annual Report, approximately 70% of cyberattack-related breach notices did not include attack information, compared to 58% in 2023. In 2019, and previous years, approximately 100% of breach notices included attack vector information.

“Our 2024 Annual Data Breach Report reveals troubling trends,” said ITRC CEO Eva Velasquez. “With a near-record number of compromises and over 1.7 billion victim notices, often tied to inadequate cyber practices, we are also seeing an increase in notices that provide limited actionable information for victims.”
“On a positive note, 40% percent of states have enacted comprehensive privacy laws to better protect consumers,” noted Velasquez. “Innovative technologies like passkeys offer promising solutions to prevent breaches caused by stolen and compromised passwords, which accounted for four of the six mega-breaches.”
The ITRC annual report revealed the number of data breach notices issued in the past year increased from 419,337,446 in 2023 to 1,728,519,397 in 2024. Meanwhile, six “megabreaches” accounted for only .001% of compromises in the past year but approximately 84% of data breach notices.
Megabreach victim notices totaled more than 1.4 billion of the more than 1.7 billion victim notices issued in 2024. These six megabreaches resulted in at least approximately 100 million notices issued in each event:
Ticketmaster Entertainment (approximately 560 million breach notices)
Advanced Auto Parts (approximately 380 million)
Change Healthcare (approximately 190 million),
DemandScience by Pure Incubation (approximately 122 million)
AT&T (approximately 110 million)
MC2 Data (approximately 100 million)
Trends Highlighted in the Data Breach Report

“We still have not sufficiently addressed the root causes of most data breaches. Nor have the technical and policy cures adopted in the intervening years been particularly effective in slowing, let alone stopping, the steady increase in events that compromise information,” said ITRC’s President James E. Lee President in the report’s introduction. “You’ll find the data that shows we are not making much progress in data protection. In fact, stolen and compromised data is so ubiquitous that the number of people and businesses who have not been impacted by a data breach is now dwarfed by the number of victims who have been – by a factor of five.”
Other findings, revealed by the ITRC in the report, include:
State and federal disclosure requirements are having no significant impact on data breaches. New Securities and Exchange Commission (SEC) breach disclosure rules resulted in a 60% increase in disclosures in 2024. However, less than 10% of the notices included details of the event.
There were fewer zero-day (that take advantage of security flaws in software, hardware or firmware) and supply chain (that inject malicious code into a product or service supply system) attacks. There were fewer Zero Day and Supply Chain attacks. However, they had more significant impacts, according to the ITRC. Supply Chain attacks directly impacted 134 organizations and indirectly impacted 657 entities, resulting in 203 million victim notices. Supply Chain attacks directly impacted 134 organizations and indirectly impacted 657 entities, resulting in 113 million victim notices.
Publicly traded companies represented only 7% (221 companies) of all compromised organizations. However, they issued 76% percent of victim notices in 2024.
Of the 133 cyberattacks against publicly traded companies resulting in a data breach notice, a stolen credential was the leading attack vector. Seventy-four percent of the breach organizations did not list an attack vector in a breach notice.
Passkeys to the Rescue?
Better cyber practices and requirements could have prevented at least 196 compromises and more than 1.2 billion victim notices. The addition of multi-factor authentication (MFA) or passkeys, suggests the ITRC, could have blocked attacks using stolen credentials against Ticketmaster, Advanced Auto Parts, AT&T, Change Healthcare and other organizations.
The use of passkeys, a digital credential that permits users to sign in to a website or app without needing a password makes stealing or using stolen passwords obsolete, according to the ITRC report. “If passkeys had been deployed at the time of most, if not all, of the organizations reporting breaches related to stolen credentials in 2024, there would not have been a breach,” suggested the ITRC.
“A whopping 94% of all devices are now ready to use passkeys, with major providers, like Amazon and Microsoft, offering access to passkeys to 100% of users,” the ITRC report said citing the FIDO Alliance, which is focused on providing open and free authentication standards. Consumer support for passkeys is rapidly growing, too. According to ITRC research, 30% of U.S. consumers already use passkeys on at least one account after one year of availability.