If your inbox keeps filling with "your information may have been exposed" emails, you are not imagining things. Breach notices followed a similar path. The education platform Canvas accounted for 275 million of those letters, more than half.
Now stack that against all of 2025. If the second half is as busy as the first, the full-year incident count would top 3,321, the total for all of 2025.
AI is becoming a regular part of data breach reports. Insiders are showing up more too. Malicious insiders are people inside a company who steal data, and the ITRC counted 21 such incidents in the first half of 2026.
That compares with just three for all of 2025.
James Lee, president of the Identity Theft Resource Center, said the jump stands out because insiders have rarely been a major source of breaches.
"We've never seen more than three data breaches in a given year related to a malicious insider, and you get 21 in six months."
Some insider cases were straightforward. Lee said laid-off employees "were stealing information on their way out the door."
Since your data may be exposed, start building wealth with the free Always Be Buying eBook.
The ITRC also tied other insider cases to an FBI-flagged North Korea scheme. That scheme used stolen identities, deepfake interviews, and AI-generated resumes to place remote IT workers at U.S. companies, and the report called it the biggest structural driver of insider attacks.
Corporate boards have noticed the shift. A survey of public-company audit committees, the board groups that oversee risk and financial reporting, found 93% put cybersecurity in their top three priorities.
Half of the 237 people in the survey ranked it first.
Spending is moving in the same direction. A PwC survey released last October asked 3,887 executives about their security plans.
Those executives worked in 72 countries and territories.
Of those, 78% planned to spend more on cybersecurity over the next year.
Breach notices are getting less useful. Only 24% of the letters sent to consumers from January through June 2026 included details about the incident.
Back in 2021, 93% of them did.
Lee said lawsuits may be why companies send only what state law requires. "Where you live determines if you find out, and if you do find out, what you're told."
The catch: Consumers still have ways to check on their own exposure. Credit expert John Ulzheimer says you can pull your Equifax, Experian, and TransUnion reports once a week for free at AnnualCreditReport.com.
Doing that will not hurt your credit score. Free credit monitoring can alert you to possible fraud on one of your reports.
A fraud alert forces lenders to verify applications made in your name. A credit freeze goes further and blocks new accounts and loans from being opened in your name.
Ulzheimer says a credit freeze is "kind of the Fort Knox of credit protection." You have to lift it temporarily when you apply for legitimate credit, an inconvenience Ulzheimer noted.
Breaches do not appear to be slowing down, and the notices they produce are giving people less detail. For anyone worried about their information already being out there, checking their own credit is the part they can still control.