- Surfshark recorded 121.8 million breached accounts worldwide in Q3 2026, up 13.2% on the previous quarter.
- The UK overtook France as Europe's most breached country, while Ukraine jumped from 47th to 6th globally.
- The US still accounts for almost a third of all leaks, and experts say limiting what you share is your best defense.
More than 121.8 million online accounts were compromised around the world between July and September 2026, according to new research from Surfshark. That's a 13.2% rise on the previous quarter.
The UK saw the most dramatic shift. Its leaked account count more than doubled to 5.8 million, a 121.6% jump that pushed it past France to become Europe's most breached country.
Ukraine also surged up the rankings, climbing from 47th place to 6th globally after 2.6 million accounts were breached in just three months.
Most breaches happen on a company's servers rather than your own device, so even the best VPN can't stop your details from leaking. There are still steps you can take to limit the damage, though.
Europe is under growing pressure
The UK's rise came during a busy quarter for attacks on British organizations. In late July, extortion group ExfilSquad claimed it had stolen contact details for more than 100,000 police officers and staff from the Police National Legal Database.
The same group also claimed to have leaked around 600,000 records from the Department for Education.
Ukraine's climb fits a wider pattern. Microsoft's Digital Defense Report 2026 ranked the country first in Europe and third worldwide for cyberattacks in the first half of the year.
Ukraine's CERT-UA also handled around 200 incidents targeting citizens between January and September, up from 80 a year earlier, many involving phishing for Telegram and Signal logins.
"We can see attacks vary across countries as attackers seek the juiciest targets, sometimes for financial, and sometimes for political gain," said Tomas Stamulis, Chief Security Officer at Surfshark.
It's not just about raw numbers, either. Estonia had the highest breach density in the world at 118 breached accounts per 1,000 people, ahead of Australia, the US, and the UK.
The US still leads the way
Globally, the US remained the most breached country with 38.1 million leaked accounts, or 31% of the total. Brazil (7M), the UK (5.8M), India (5.5M), and Australia (3.1M) completed the top five.
France, meanwhile, cooled off sharply. It recorded 2.4 million breached accounts, down from 19.7 million in Q2, and dropped out of the top three for the first time this year.
How to stay safe
Stamulis warns that stolen data can sit hidden for long periods before criminals decide to use it.
His advice is to treat personal information as sensitive by default, only share your real details when it's genuinely necessary, such as on official forms, and use an alias, secondary email address, or email masking service for everything else.
A password manager also helps ensure one leaked login doesn't unlock your other accounts. Meanwhile, identity theft protection and data removal services can alert you to exposure and reduce how much of your information is out there.
