Key Takeaways
- 3 billion accounts – Yahoo’s 2013 breach remains the largest in history
- India’s Aadhaar second with 1.1 billion citizen records exposed
- Assume you’re exposed – use unique passwords, MFA, and VPNs to limit future damage
The Story Behind the Numbers
Across the last decade and a half, a small set of incidents account for an enormous share of exposed accounts. At the top is Yahoo, which ultimately admitted that about 3,000 million user accounts tied to its 2013 breach were affected. India’s Aadhaar ID system comes next, with public reporting indicating up to 1,100 million citizens’ records exposed through leaky systems around the national database.
The rest of the list stays in the hundreds of millions. Verifications.io exposed about 763 million email accounts, FriendFinder Networks’ adult sites leaked 412 million, and River City Media exposed around 393 million unique email addresses. Marriott/Starwood lost data on 383 million guests, and the long-running social network MySpace saw around 360 million accounts compromised in a breach disclosed in 2016. Further down, Deep Root Analytics exposed roughly 198 million US voter records, LinkedIn’s 2012 breach revealed about 165 million accounts, and Adobe’s 2013 incident affected around 153 million users. Together, they show that marketing and profiling companies can leak information on a similar scale to major consumer platforms.
Why This Data is Important
These numbers are not just trivia. If your details were in any of these breaches, attackers may still reuse them years later for phishing, account takeover, and targeted scams. A single large breach can feed credential-stuffing attacks across many services, especially if you reuse passwords. The FBI IC3 reported 13,807 data breach cases from 2020 to 2024, so it’s safer to assume exposure risk is ongoing, not occasional. That is why basic hygiene – unique passwords plus a password manager and multi-factor authentication – is non-negotiable.
The list also shows how much data is held by data brokers and analytics firms most people have never heard of. You may harden your main accounts, but background-check companies and marketing databases still collect and store your information. Using a VPN will not fix old breaches, but it does reduce fresh data trails like IP addresses and locations that can be logged whenever you browse, stream, or use public Wi-Fi.
Looking Ahead: Future Outlook
Breach sizes at the very top may not grow much beyond Yahoo’s 3,000-million-account disaster, but the overall risk is shifting. More data is now concentrated in large cloud platforms, data brokers, and identity providers. That means fewer, but more damaging, incidents. You should assume that some of your data is already exposed and focus on limiting how it can be abused: use strong authentication, review app permissions regularly, and rely on privacy tools like VPNs whenever you browse, work, bank, stream, or game online.
Source & Methodology
This ranking includes only confirmed data breaches at specific organizations. We excluded pure “scrapes” of public profiles and giant combo dumps that simply re-package old leaks. Wherever possible, we used estimates of unique users or accounts, not raw record counts, because one person can generate many records. Incident sizes are taken from public statements by affected organizations and high-quality news reporting and then normalized into millions of affected users for comparison.
Yahoo – Yahoo security notice, Reuters report
Aadhaar / UIDAI – Reuters report
Verifications.io – Wired report
FriendFinder Networks – Wired report
River City Media – Have I Been Pwned
Marriott / Starwood – Marriott incident notice
MySpace – Have I Been Pwned
Deep Root Analytics – UpGuard report
LinkedIn – Have I Been Pwned
Adobe – Have I Been Pwned