If you stacked every data breach notice issued in the first half of 2026 on top of each other, the pile would reach the thermosphere. That is not hyperbole -- it is the Identity Theft Resource Center's math.
The ITRC tracked 1,803 data compromises between January and June 2026. The second quarter alone tallied 1,029 -- the second-highest single-quarter total ever recorded. If the pace holds, 2026 will set a new annual record, eclipsing 3,321 incidents from 2025.
AI Has Entered the Breach
According to IBM's 2026 Cost of a Data Breach Report, one in four malicious breaches is now AI-enabled -- a 56% increase over the prior year.
The most common AI-powered attack vectors:
- Deepfake impersonation (45%) -- synthetic audio and video tricking employees
- AI-enabled malware (19%) -- code that adapts and evades detection
- AI-generated phishing (17%) -- emails so convincing they bypass filters
AI-enabled breaches cost an average of $6 million -- roughly $1 million more than the global average of $4.99 million. Attackers launch campaigns for thousands while defenders spend millions.
The MENA Angle
The average breach cost in the Middle East has climbed to $8 million -- significantly above the global average. Financial services and energy face the highest concentration of AI-driven attacks at 62% of critical infrastructure incidents.
The Insider Threat Surge
The ITRC tracked 21 malicious insider events in H1 2026 -- a sevenfold increase over all of 2025. In the entire history of ITRC tracking, there had never been more than three in a single year.
Tech-sector layoffs and nation-state recruitment schemes drove the spike. The ITRC flagged FBI warnings about North Korea placing remote IT workers using stolen identities and deepfake interview videos.
Supply Chain: The Multiplier Effect
Just 38 initial breach events generated 280.6 million victim notices impacting 206 downstream entities. One vendor's failure cascading across hundreds of partners remains one of cybersecurity's most dangerous dynamics.
Zero-day attacks reached 14 in H1 2026, nearly matching 17 for all of 2025 -- partly powered by AI tools discovering flaws faster than human researchers.
The Transparency Gap
Only 24% of breach notices in H1 2026 included attack vector details -- the lowest rate ever recorded by the ITRC, down from 93% in 2021.
As ITRC president James Lee put it: Where you live determines if you find out about a breach, and if you do find out, what you are told.
What Businesses Should Do Now
The IBM and ITRC reports converge on the same recommendations:
- Deploy AI defensively. Organizations using AI and automation in security operations cut breach costs by almost $2 million on average.
- Adopt zero-trust architecture. Perimeter defenses alone no longer hold against AI-powered attacks and insider threats.
- Vet supply chain vendors in real time. One compromised vendor can generate hundreds of millions of victim notices.
- Close the AI governance gap. 68% of organizations breached through AI tools had no AI governance plan in place.
- Demand breach transparency. Only 24% of notices disclose attack vectors, leaving everyone else unable to assess their true risk.
The economics of cybercrime have fundamentally shifted. AI makes attacks faster and cheaper to launch while breaches keep getting more expensive to find and fix. The organizations that close that gap -- with AI-powered defense, zero-trust identity, and real-time vendor oversight -- will be the ones still standing when the next report drops.