Government data breaches in 2026: a running list, and the patterns underneath it

Government bodies disclosed breaches at every level in 2026, from county networks to an FBI system holding surveillance data. Comparitech counted 187 ransomware attacks on government organizations in the first half of the year, 89 of them confirmed by the victims, up from 165 in the second half of 2025. Ransomware is only part of the picture, though. Several of the year’s most consequential government incidents involved no encryption at all.

This page tracks notable government data breaches made public in 2026, in the United States and among allied governments. An incident is listed when the affected government body confirmed it or at least two reputable outlets reported it, and any figure that comes only from an attacker is labeled as a claim. The list is updated monthly and was last updated on October 1, 2026.

Dates reflect when each incident became public, which is often months after the intrusion began.

Several of the year’s largest incidents ran through systems built to move documents between people. The Los Angeles City Attorney’s Office lost more than 337,000 files from a third-party tool used to send discovery to opposing counsel, and GovTech reported that the tool was not password-protected so outside attorneys could reach it. The Defense Manpower Data Center’s breach came through a file-sharing system. Intruders in DHS’s Homeland Security Information Network reached a SharePoint system used for collaboration, and Japan’s Digital Agency found its intrusion through file access on a shared government server.

A file-sharing system hands documents to whoever its front end lets in, which makes that front end the entire security model. When it fails, through a flaw, a missing password, or a stolen login, everything behind it becomes readable. Access policy that travels with the data, evaluated on every operation against how each file is labeled, is what keeps one failed front end from exposing a whole repository.

In most incidents on the list, the harm came from data being read and copied rather than locked. The City of Suffolk stopped an attempted ransomware deployment and still had to notify everyone whose data might have been taken. France’s tax administration saw 678,000 records consulted and extracted through accounts that were allowed to log in. In the Florida and FBIJobs.gov incidents, the extortion was over stolen records, and no encryption was reported in either.

That changes which controls matter. Backups and immutable snapshots restore files that were encrypted or destroyed, and they do nothing about copies an attacker already holds. Against theft, the defense has to act while the reads are happening.

Valid accounts were a common way in. France’s tax data left through a staff account and a contractor account, with multi-factor authentication bypassed. Florida says its driver database was reached with a police department user’s credentials kept on a personal device. Japan’s intruder entered through a VPN flaw and then read files with a maintenance staff member’s account. Each of those sessions authenticated, so each was trusted by every control that checks only who is logged in.

A session that authenticates correctly can still behave in ways no job requires: reading a department’s entire file share, walking a database record by record, or pulling files at night from a source address with no history. Japan’s case shows that signal is real. The agency found its intrusion on June 25 because a large volume of files was accessed with a single maintenance account, which is exactly the kind of pattern behavioral analysis at the storage layer is built to catch while it is happening.

The hardest question in most of these incidents came after containment: what, exactly, was taken? Suffolk’s investigators could not determine what personal information, if any, the intruder accessed, so the city notified all potentially affected people, 157,725 of them according to Comparitech. The Pentagon’s letters give no count, and approximately four million personnel may be affected according to Military Times’ sources. DHS has not said whether documents left HSIN. Kootenai County detected ransomware on March 30 and finished its review on July 2. In Berlin, the most detailed inventory of the stolen data is still the attacker’s leak-site listing.

Each of those answers depends on a record of which files were read, by whom, and when. When that record is incomplete, organizations notify broadly, pay for monitoring for everyone on the list, and have no evidence with which to test an attacker’s numbers. An immutable, per-operation audit kept by the storage itself turns scoping into a query.

The controls that address these patterns belong in the storage layer, where the files are. RackTop BrickStor SP evaluates every SMB, NFS, S3, and Web Drive operation inline. Its Active Defense engine profiles normal activity for each user, host, and dataset and ends an anomalous session in under a second, attribute-based access control (ABAC) decides each request on the user’s attributes and the data’s labels, and every operation is written to an immutable audit record. Data at rest is encrypted with a FIPS 140-3 Level 1 validated cryptographic module in version 23.8 and later.

None of this replaces patching the flaw or hardening the login. It limits what happens after those fail, which is where this year’s government breaches did their damage. RackTop’s analysis of the Pentagon DMDC breach walks through how those controls map onto a single incident.