Data Breaches in the News 2019–2026: article-level dataset and coverage tables
Description
A dataset of data breach news from a global news index, January 2019 – July 2026, built with the
Prism News API (historical and real-time news,
https://radar-api.fliarbi.com/news). Every row is one news article about a data breach or data leak,
with its date, location, tone, editorial priority, themes and the organisations it names, plus a link
that returns the full article through the API.
| Rows in this release | 9,845 articles (25.3% of 38,970 matched articles to 31 July 2026) |
| Full coverage counted | 38,972 data breach articles, January 2019 – July 2026 |
| Countries | 95 primary locations in the sample |
| Research paper | data-breach-research-paper.pdf (findings, figures, methods) |
| Findings for citation | FINDINGS.md (15 findings, each with its Wikipedia target) |
| Maps | World and US state maps of over- and under-coverage |
| Licence | CC BY-NC 4.0 (attribution and a link required) |
Key findings
- Data breaches took a 42% smaller share of news in 2020 than in 2019 (1.99 against 3.43 per 10,000 articles).
- July 2019 was the peak month by share (7.04 per 10,000); July 2024 was second by share (5.25 per 10,000) and had the most articles (1,027).
- The United States holds 49.23% of located data breach news, close to its weight in all news (lift 1.02). South Korea (4.77), Australia (2.35) and Singapore (2.1) are the most over-represented countries; India is under-represented (0.52).
- Among US states, Maine (18.91) and Oklahoma (2.97) lead by lift; New Jersey (0.11) and Pennsylvania (0.66) are lowest.
- Data breach coverage rose 8.94-fold as a share of South Korea's news between 2023 and 2025.
- 78.5% of data breach articles are negative in tone (all news: 33.6%); 86% are rated critical priority (all news: 42.6%).
- Research papers on data breaches rose 2.33-fold as a share of all papers from 2015 to 2025; patent families grew 3.38-fold from 2015 to 2024.
Files
| File | Rows | What it holds |
|---|---|---|
data/data-breach-news-sample.csv |
9,845 | Article-level sample (columns below) |
data/monthly.csv |
full | Data breach articles and all-news articles per month, and the share per 10,000 |
data/countries.csv |
full | Located articles per country, 2023 – Jul 2026, share and lift against all news |
data/continents.csv |
full | Located articles per continent, share and lift |
data/states_india.csv, data/states_us.csv |
full | Located articles per state of India and the US, lift against that country's news |
data/country_trend.csv |
full | Data breach articles per 10,000 of each country's news, per year |
data/country_tone.csv |
full | Negative share of data breach articles by country vs that country's news overall |
data/themes.csv |
full | Themes carried by data breach articles, share and lift |
data/tone_by_year.csv |
full | Negative, neutral and positive articles per year |
data/organisations.csv |
full | Organisations named most often, 2023 – Jul 2026 |
data/cities.csv |
full | Primary city per article (noisy: see limitations) |
data/research_by_year.csv |
full | Research papers with the topic in the title, per year and per 10,000 papers |
data/top_papers.csv |
25 | Most-cited data breach papers since 2010 |
data/patents_by_year.csv, patent_offices.csv, patent_cpc.csv |
full | Data breach and data leakage patent families by year, office and technology class |
metrics.json |
— | Every number quoted in the card, the findings and the paper |
Columns of the article sample
| Column | Meaning |
|---|---|
article_id |
Stable article identifier |
date, month |
Publication date and month |
country, state, city, continent |
Primary location tagged by the index (41.0% of rows carry a country) |
tone, tone_label |
Tone group (negative / neutral / positive) and the graded label |
priority |
Editorial priority, 1–9 (7 and above = critical) |
themes |
Up to three themes, strongest first |
keywords |
Up to five keywords |
organisations, places |
Up to three organisations and places named |
matched_terms |
Which data breach terms matched the article |
api_url |
Full article (text, headline, publisher, related articles) through the Prism News API |
What is withheld (available via the Prism News API)
- Article text, headlines, publishers and URLs. Fetch any row through
api_urlwith an API key. - The remaining matched articles and everything after July 2026. The API covers the full history and updates continuously.
- Sentiment and theme timelines at any granularity, other topics, other filters and exports.
bash
curl -fsSL https://raw.githubusercontent.com/fliarbi/prism-news-api/main/scripts/install.sh | bash
prism-news login
prism-news trends "data breach" --since 2019-01-01 --until 2026-07-31 --granularity monthly --table
How it was built
Articles match when their opening text contains data breach(es), data leak(s), personal data
breach, breach of personal data, exposed (the) personal data, personal information was exposed,
stolen data or leaked data as whole phrases. Broad terms such as security breach (often physical
security) and hackers stole (often cryptocurrency theft) were tested and dropped. Video-game leaks and
market-research listings are excluded. A hand check of 40 random matched articles found 90% were about
the exposure, theft or leak of data, and 70% were mainly about a breach. Article IDs are de-duplicated.
The sample is a fixed hash selection (SHA1(article_id)), so later releases keep the same rows. Paper
and patent counts match titles, with repository deposits, the machine-learning sense of "data leakage"
and physical leak senses excluded. Place tags derived from ordinary words (such as "Congress", "Cloud" or "Mobile") were treated as unlocated in every location field, which removed 15.3% of city-tagged articles. Full method: the research paper, §2.
Limitations
- Part of the news index was offline when this release was built (92.88% of rows readable), so counts are lower bounds. Shares and lifts are less affected.
- The index thins after May 2026. 2026 values (January–July) are partial.
- The
cityfield sometimes tags ordinary words and acronyms as places. Usecountryfor geography. Place tags derived from ordinary words were treated as unlocated (15.3% of city-tagged articles), so some real places that share a name with a common word are also unlocated. - Too few Indian articles carry a state (219) for state-level analysis of India.
- Tone, priority and themes are machine labels from the article opening.
Citation
Fliar BI (2026). Data Breaches in the News 2019–2026: article-level dataset and coverage tables. Built with the Prism News API. https://github.com/fliarbi/prism-news-api
Licence: CC BY-NC 4.0. Commercial use and the full data: Prism News API.
Notes
Files
data-breach-research-paper.pdf
Additional details
Related works
- Is supplement to
- Software: https://github.com/fliarbi/prism-news-api (URL)
- Is variant form of
- Dataset: https://huggingface.co/datasets/fliarbi/data-breach-news-2019-2026 (URL)
- Dataset: https://www.kaggle.com/datasets/fliarbi/data-breach-news-dataset (URL)