Will a major cybersecurity breach affect more than 500 million Americans before 2028?

Mega-breaches affecting hundreds of millions are becoming more common, with the 2024 National Public Data breach affecting an estimated 2.9 billion records. A 500 million US individual threshold would require a breach at a major data aggregator, social media platform, healthcare system, or government database. Given the expanding attack surface from AI-powered threats and the Iran conflict increasing state-sponsored cyberattack activity, this is a plausible but uncertain scenario.

Last updated: Mar 2, 2026

Resolves YES if a single cybersecurity incident or coordinated attack results in the exposure or theft of personal data affecting more than 500 million unique US individuals, as reported by the breached entity, regulatory disclosures, or law enforcement. The count must be confirmed by the entity or a government investigation.

Source: SEC breach disclosures, HHS breach portal, and CISA incident reports

Expected resolution: February 1, 2028