InfoSec Signals™
Sign InStart Free
CSV export is a subscriber feature
Reset

Updated 3 hours ago ()

Chapter 1 of 14599 reports in view

Threat landscape now

Is the breach problem growing, and what kind of breach is taking over?

This view holds 594 reports; widen the range to 24 months or more to see the year-over-year trend. Hacking and IT incidents account for 85% of reports in 2026.

What this means for you

Most reportable breaches now begin with an intrusion (85% in 2026), not a lost device. Weight your risk analysis, budget and tabletop exercises to match.

Weight the likelihood ratings in your risk analysis to the current breach mix. If the analysis was written when theft and loss dominated, its top risks are out of date.

Do this next

Re-baseline the risk analysis on hacking, not lost devices

4 program actions, mapped to HIPAA and NIST CSF 2.0

Volume

How many breaches, and which way the line is heading

Monthly reports with a 12-month average that removes seasonal noise. Narrow the window with the brush and every chart in this chapter follows.
Breach reports per month

Selected: Jan 2026 to Sep 2026. Drag the handles under the chart to narrow every chart in this chapter to that window.

Jump to a year:2026
How this is calculated

Reports are counted by the month OCR received them (submission date), with months that had no reports filled as zero. The line is a trailing 12-month moving average, which removes seasonality and single-month spikes. The headline compares the most recent 12 complete months with the 12 before them; a change within ±5% is called flat. The current calendar month is excluded because its reports are still arriving.

Mix shift

What kind of breach is taking over

The same reports, split by breach type. The flat view shows shares; the 3D view shows volume by year and type together, so growth and mix are read at once.
Share of breach-type mentions by year

Needs at least two years with 20 or more matching reports.

How this is calculated

The chart stacks each breach type's share of all type mentions in a year, so each year sums to 100%. OCR lets a report list more than one type, so the finding instead uses the share of reports that list a type (those shares can add to more than 100%). Theft and Loss are combined because both describe a lost or stolen device or record. Years with fewer than 20 matching reports are left out of the comparison.

Reports by year and breach typeHacking/IT Incident is the tallest ridge: 512 reports in this view.
Drag to rotate, scroll or pinch to zoom. Click a bar to open that year and type.

Loading 3D view…

  • Hacking/IT Incident
  • Unauthorized Access/Disclosure
  • Improper Disposal
  • Loss
  • Theft
How this is calculated

Counts of reports listing each breach type in each submission year (a report listing two types counts in both). The six most frequent types in the view are shown; colours are fixed per type across the site. The table view carries every value.

Outlook

Where it is heading

A projection from the recent trend, and whether breach reporting follows a calendar. Both are estimates with stated uncertainty, not predictions of any single month.
Reports per month, with a 12-month projectionProjection

Needs at least 24 complete months of history in the selection.

How this is calculated

A log-linear trend fitted by least squares to log(reports + 1) over the last 36 complete months, after dividing out month-of-year factors from the seasonality card (ratio to a 12-month moving average over the whole selection), which are applied only when that seasonality is statistically clear (chi-square, p < 0.05). The shaded band is the 80% prediction interval from the regression, which widens with distance from the data. It assumes the recent trend and seasonal pattern continue and cannot anticipate changes in OCR reporting rules or a sudden campaign. It is a projection, not a forecast of any particular month.

Seasonal index by calendar month (1.00 = trend)

Needs at least three years of complete months (two after trend removal) and 60 reports.

How this is calculated

Month-of-year uses classical ratio-to-moving-average decomposition over complete months: each month's reports are compared with the centred 12-month moving average around it, so long-run growth does not make late-year months look busier. The index is observed ÷ trend for each calendar month, rescaled to average 1.00 (1.10 = 10% above trend). A chi-square test of observed against trend-expected counts (11 df) says whether the differences exceed chance; month length is not adjusted, so February reads slightly low. Weekday uses every report in the selection. Caveat: these are submission dates, when OCR received the report; HIPAA allows up to 60 days from discovery, so this is the rhythm of reporting, not of breaches.

For program leaders

Program actions

Each action is mapped to the HIPAA standard it helps you meet (45 CFR Part 164 unless noted) and to the NIST CSF 2.0 function and category it belongs to.
  1. 1

    Re-baseline the risk analysis on hacking, not lost devices

    Weight the likelihood ratings in your risk analysis to the current breach mix. If the analysis was written when theft and loss dominated, its top risks are out of date.

    HIPAA
    §164.308(a)(1)(ii)(A) Risk analysis§164.308(a)(1)(ii)(B) Risk management
    NIST CSF 2.0
    Identify · ID.RA Risk AssessmentGovern · GV.RM Risk Management Strategy
  2. 2

    Prove you can restore from ransomware

    Keep offline or immutable backups of ePHI systems, test a full restore on a schedule, and time it against the downtime your clinical operations can absorb.

    HIPAA
    §164.308(a)(7)(ii)(A) Data backup plan§164.308(a)(7)(ii)(B) Disaster recovery plan§164.308(a)(7)(ii)(D) Testing and revision procedures
    NIST CSF 2.0
    Protect · PR.DS Data SecurityRecover · RC.RP Incident Recovery Plan Execution
  3. 3

    Patch exploited vulnerabilities on a clock

    Track CISA's Known Exploited Vulnerabilities list against your asset inventory and set a remediation deadline for internet-facing systems measured in days, not quarters.

    HIPAA
    §164.308(a)(5)(ii)(B) Protection from malicious software§164.308(a)(1)(ii)(B) Risk management
    NIST CSF 2.0
    Identify · ID.RA Risk AssessmentProtect · PR.PS Platform Security
  4. 4

    Review system activity continuously

    Centralise logs from ePHI systems, email and remote access, and review them on a defined cadence so an intrusion is found in days rather than months.

    HIPAA
    §164.308(a)(1)(ii)(D) Information system activity review§164.312(b) Audit controls
    NIST CSF 2.0
    Detect · DE.CM Continuous MonitoringDetect · DE.AE Adverse Event Analysis

For certification candidates

Exam angle

CISSP

  • Domain 1: Security and Risk Management
  • Domain 7: Security Operations

CISM

  • Domain 2: Information Security Risk Management
  • Domain 4: Incident Management

CISA

  • Domain 4: Information Systems Operations and Business Resilience

Study prompt

A risk register still ranks lost laptops as the top threat while most reported breaches are now hacking incidents. As the security manager, what do you change first: the controls, or the risk analysis that justifies them? Explain why the answer is the risk analysis, and what evidence an auditor would ask for to show it was refreshed.

Lessons learned for this chapter

1,165 resolved OCR cases, filed under ransomware resilience and recovery (874), vulnerability and patch management (39) and audit logging and monitoring (252).

Read the lessons
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.