Scale and impact

How large is a typical breach, and what separates the mega-breach from the rest?

Breach size is extremely uneven. The median report affects 6,102 people, but the largest 1% of reports hold 62% of everyone affected and the largest 10% hold 92% (Gini 0.94). Reports involving network server (6.6×, 95% CI 4.8 to 9.2) or hacking/IT incident (5.2×, 95% CI 3.4 to 8.0) are the likeliest to reach 100,000 or more affected, compared with reports without that attribute. Email reports are the least likely (0.22×).

What this means for you

The median report affects 6,102 people, but the largest 1% of reports hold 62% of everyone affected and the largest 10% hold 92% (Gini 0.94).

Do this next

Minimise the data you hold

This chapter's program actions come with a subscription

Lessons from resolved cases

Start free and set your program

6,102

Median report

individuals affected

210,716

Mean report

35× the median

62%

Held by the largest 1%

of all individuals affected

0.94

Gini coefficient

0 = equal, 1 = one report holds all

The heavy tail

A few breaches affect most people

The curve shows how much of the total the largest reports hold; the bands show how many reports fall at each scale. Click a band to open its reports.

Concentration curve of individuals affected

The largest 1% of reports (36 of 3,584) account for 62% of all individuals affected, and the largest 10% for 92%; the median report affects 6,102 people against a mean of 210,716, 35× higher.

How this is calculated

Reports are sorted from largest to smallest by individuals affected. The curve plots the cumulative share of reports (x) against the cumulative share of all individuals affected they account for (y); a straight diagonal would mean every report is the same size. The Gini coefficient summarises the same curve (0 = equal, 1 = one report holds everything). The mean is pulled far above the median by the largest reports, which is why the median is the better "typical" size.

Reports by number of individuals affected

100 reports of 1 million or more hold 78% of everyone affected.

Table view


Under 1,000	562	377,612	0.1%
1,000 to 9,999	1,502	5,460,372	0.7%
10,000 to 99,999	1,010	36,134,592	4.8%
100,000 to 999,999	410	126,305,282	16.7%
1 million or more	100	586,928,540	77.7%

How this is calculated

Bands are powers of ten. OCR's public list only includes breaches affecting 500 or more individuals, so the first band starts at 500. The tooltip shows each band's share of all individuals affected.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 4: Scale and impact

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

Which attributes make a report likelier to reach 100,000+
What this means for your program: 3 key points
3 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Minimise the data you hold”
Exam angle for 5 CISSP, CISM and CISA domains, with a study prompt
247 lessons from resolved OCR cases filed under this chapter

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works