Best-effort open-source compilation covering 2016-09-02 to 2026-09-02, as of 2026-09-02. Nine incidents at identity-verification, background-screening and identity-data vendors carry a defensible public number. Two measures, never interchangeable: the conservative non-deduplicated person/record proxy of 1,588,120,333 (distinct-person estimates, falling back to record counts only where no person count exists), and the incident-volume total of 4,318,120,333 (reported record counts wherever available). Neither is a count of globally unique people.
| Vendor · year | Category | Affected people | Identity records | Running total (conservative) | Status | Exposed data | Source |
|---|
Method: best-effort open-source compilation of breaches at identity-verification, document/biometric verification, background-screening and identity-data vendors, 2016-09-02 to 2026-09-02, from thousands of live web results; 9 numeric incidents shown, as of 2026-09-02. No authoritative worldwide registry exists, and “all” is bounded by discoverable public reporting and this vendor scope. Counts mix distinct-person estimates and record/document counts; the conservative running total prefers person counts and is non-deduplicated across incidents. Excluded: customer companies breached independently of the verification vendor; code-only exposures without identity records; duplicate reports of one event; and vendors with publicly reported incidents but no defensible affected-person count. Attribution warning: Persona is excluded from totals — its 2,500 figure refers to publicly accessible frontend files, and the 70,000-ID Discord incident was attributed to support vendor 5CA, not to a breach of Persona itself. Blank cells mean no public figure of that kind exists; blanks are not zeros.