Why do big data breaches keep happening?

The pattern behind the headlines

In September 2026 alone, the news included a screenshot service losing data on tens of millions of accounts (see our Gyazo explainer) and an ID-checking company under FBI investigation after ID scans were offered for sale. It can feel as if no organisation can keep data safe.

The truth is more nuanced. Many attacks are stopped, and you rarely hear about those. But several deep, structural reasons make breaches hard to eliminate. This article walks through them using two respected sources: Verizon's yearly Data Breach Investigations Report, which studies thousands of real incidents, and research from Google's threat intelligence team.

Reason 1: there are more software flaws than ever

Every app and website is built from millions of lines of code, and code contains mistakes. Some mistakes are security flaws, called vulnerabilities. Verizon's 2026 report found that exploiting a vulnerability was the most common way attackers first got in, involved in 31 percent of the breaches it studied, ahead of stolen passwords at 13 percent.

Google's research, published on 30 September 2026, found the number of publicly reported flaws per month roughly doubled between January and August 2026. Google was careful to say this overstates the danger, since many entries are minor or automatically generated. Only a small fraction, about one in 431 of the flaws reported in 2026, were seen being used in attacks. But the number actually exploited each month also rose, from an average of about 10 in 2025 to about 18 in 2026.

Google also found that flaws likely discovered with the help of AI tended to be more serious than average. AI is a tool for both sides: defenders can use it to find and fix problems, while attackers can use it to find weaknesses faster.

Reason 2: fixing takes time

Finding a flaw is one thing. Fixing it across thousands of computers is another. Verizon found that only about a quarter of the most dangerous, actively exploited flaws on its list were fully fixed by organisations during 2025, and the typical time to fix them grew to 43 days. Google observed one serious flaw being attacked by several groups within a week of being made public.

That gap, between a fix being available and it actually being installed, is where many breaches happen. Large organisations have old systems, devices that cannot easily be restarted and limited staff, so patching is genuinely hard.

Reason 3: suppliers and people

Modern organisations rely on dozens of outside suppliers for payroll, customer support, cloud storage and ID checks. Each one is another door. Verizon found that a third party was involved in 48 percent of breaches in its 2026 report, a big rise on the year before.

People are also part of the picture. Verizon found a human element, such as someone being tricked, making a mistake or misusing access, in 62 percent of breaches. That is not about blaming staff: it reflects how skilled attackers have become at deception.

Reason 4: data is valuable, and crime pays

Organisations collect a lot of personal data and often keep it for years. Criminals can sell it, use it for fraud or demand a ransom. Verizon found ransomware involved in 48 percent of breaches. There is some good news: 69 percent of ransomware victims in its data did not pay, and police operations like the takedown described in our weekly roundup disrupt gangs. But as long as stolen data has value, attackers will keep trying.

What you can do

You cannot patch a company's servers, but you can make a breach much less harmful to you:

1. Use a different password for every account, ideally stored in a password manager, or switch to passkeys.
2. Turn on two-step sign-in for email, banking and social media.
3. Share less. Leave optional fields empty and delete accounts you no longer use.
4. Expect scams after breaches. Leaked details make phishing more convincing. See our scam alerts.
5. Keep your own devices updated, because the same patching problem applies at home.

Tip: Want the technical version? Read threats and risk and zero trust basics.