The Identity Theft Resource Center (ITRC) – a US nonprofit organisation established to support victims of identity crime has released its U.S. data breach findings for the third quarter (Q3) of 2024.

According to the Q3 2024 Data Breach Report analysis, there were 672 publicly reported data compromises in the quarter, an 8% percent decrease compared to Q2 this year (732 compromises). The year-to-date (YTD) number of compromises (2,242) is 70% of the year-end total in 2023, making a record-high number of compromises unlikely in 2024.

The number of victims decreased 77% in Q3 2024 (241,889,316) compared to Q2 2024 (1,043,903,153), primarily due to the Ticketmaster and Advance Auto Parts data events in Q2, which accounted for 940 million victims alone.

In Q3, MC2 Data, a data broker that primarily sells personal information for background checks, acknowledged a data leak impacting 100 million people. The compromise was not a data breach but a lower-risk event where a database of personal information was open to attack because of misconfigured security. There is no evidence the data was ever copied or removed by a bad actor.

Further, the report reveals that after experiencing declines in the first two quarters of 2024, US supply chain attacks surged by 203% in Q3, affecting 91 organisations due to vulnerabilities in third-party vendors. Additionally, there were 50 data compromises reported, impacting over 850,000 victims.

However, details regarding the types and root causes of these events remain unclear. This lack of information heightens the risk for individuals and businesses, leaving them vulnerable to similar attacks in the future​.

Recommended reading

• Ransomware Groups are Adjusting Their Strategies
• NCSC Guide: How To Bridge Cyber With The Boardroom
• NCSC Warns Ransomware Threat to Rise with AI

“While we will likely not set a new record for the number of data compromises in a single year as we did in 2023, there are some interesting trends in the Q3 2024 Data Breach Report,” said Eva Velasquez, president and CEO of the Identity Theft Resource Center.

“In particular, the number of businesses reporting multiple data breaches in the past 12 months and the return of mega-data breaches that impact more than 100 million people. These trends prove that businesses must continue to prioritize data and identity protection, and consumers must take the steps needed to make their information less valuable to criminals.”