| Key Highlights • Nevada leads all 50 states with 36.95 average annual personal data breaches reported per 100,000 residents from 2021 to 2025, the highest per-capita breach rate nationally. Iowa follows at 36.67, more than double the national median. • Iowa recorded a 278% surge in personal data breaches from 2021 to 2025, rising from 223 to 844 reported incidents, the largest percentage increase of any state. Arizona follows with a 146% increase. • California and Florida report the highest raw breach volumes with averages of 8,123 and 4,935 per year, respectively, yet rank only 6th and 5th per capita, showing that population size alone does not explain breach concentration. |
Nevada, a state of just 3.32 million people, holds the highest per-capita personal data breach rate in the nation. Iowa ranks second despite a population a fraction of California’s. Across all 50 states, population size predicts almost nothing about where personal data breach victims concentrate most heavily.
The study by Intuitive Digital® analyzed personal data breach reports across all 50 U.S. states using data from the FBI’s Internet Crime Complaint Center (IC3) annual reports from 2021 to 2025. States were ranked by their average annual breach count per 100,000 residents, revealing where the personal data breach epidemic is most concentrated.
States With the Highest Average Personal Data Breach Rate Per 100,000 Residents, 2021–2025
| Rank | State | Population 2025 | Avg Annual Breaches (2021-2025) | Avg Per 100K Residents |
| 1 | Nevada | 3,320,570 | 1,227 | 36.95 |
| 2 | Iowa | 3,264,560 | 1,197 | 36.67 |
| 3 | Arizona | 7,691,740 | 1,925.2 | 25.03 |
| 4 | Alaska | 743,756 | 186 | 25.01 |
| 5 | Florida | 23,839,600 | 4,935 | 20.70 |
| 6 | California | 39,663,800 | 8,123.2 | 20.48 |
| 7 | Ohio | 11,942,600 | 2,174 | 18.20 |
| 8 | Colorado | 6,013,650 | 1,081.2 | 17.98 |
| 9 | New York | 19,997,100 | 3,574.4 | 17.87 |
| 10 | Washington | 8,059,040 | 1,434.8 | 17.80 |
Nevada and Iowa hold the two highest per-capita breach rates nationally at 36.95 and 36.67 per 100,000 residents, anchoring the upper tier by a wide margin. Arizona and Alaska follow at 25.03 and 25.01, respectively. California, despite reporting the most total breaches of any state, ranks only 6th per capita at 20.48, confirming that raw volume and per-capita exposure are fundamentally different measures.
Looking at the study, Nick Footer, CEO of Intuitive Digital®, commented:
“The states with the highest per-capita breach rates are not necessarily the largest or most connected. They are the states where the ratio of exposed residents to total population is structurally disproportionate. This data shows that personal data security is not scaling with population; smaller states can carry higher per-capita risk than the largest digital economies in the country.”
States With the Fastest-Growing Personal Data Breach Volume, 2021 to 2025
| Rank | State | Breaches 2021 | Breaches 2025 | % Change |
| 1 | Iowa | 223 | 844 | +278.48% |
| 2 | Arizona | 1,147 | 2,823 | +146.12% |
| 3 | South Dakota | 65 | 152 | +133.85% |
| 4 | Wyoming | 54 | 120 | +122.22% |
| 5 | Nebraska | 133 | 290 | +118.05% |
| 6 | Montana | 86 | 177 | +105.81% |
| 7 | New Hampshire | 137 | 271 | +97.81% |
| 8 | Idaho | 175 | 344 | +96.57% |
| 9 | Oklahoma | 413 | 769 | +86.20% |
| 10 | North Carolina | 1,131 | 1,969 | +74.09% |
Iowa recorded a 278.48% increase in reported personal data breaches from 2021 to 2025, jumping from 223 to 844 incidents, the largest percentage surge of any state. Arizona follows at 146.12%, with South Dakota, Wyoming, and Nebraska all more than doubling their breach counts over the same period. Seven of the 10 fastest-growing states are in the Midwest, Northern Plains, or Mountain West regions, where digital infrastructure expansion may be outpacing data security investment.
States With the Most Personal Data Breaches Reported in 2025
| Rank | State | Breaches Reported 2025 | Per 100K Rate Rank |
| 1 | California | 9,068 | 6 |
| 2 | Texas | 5,801 | 21 |
| 3 | Florida | 5,708 | 5 |
| 4 | New York | 4,022 | 9 |
| 5 | Arizona | 2,823 | 3 |
| 6 | Pennsylvania | 2,379 | 19 |
| 7 | Illinois | 2,170 | 24 |
| 8 | Ohio | 2,013 | 7 |
| 9 | Georgia | 1,996 | 34 |
| 10 | North Carolina | 1,969 | 29 |
California leads all 50 states in raw breach volume with 9,068 reported incidents in 2025, followed by Texas at 5,801 and Florida at 5,708. However, only three of the top 10 by volume, Florida (5th), Arizona (3rd), and Ohio (7th), also appear in the top 10 per capita, confirming that total breach counts are heavily driven by population size. Georgia and North Carolina each report nearly 2,000 breaches yet rank 34th and 29th per capita, illustrating how volume can mask relatively lower per-capita exposure.
States With the Highest Average Annual Breach Volume, 2021–2025
| Rank | State | Avg Annual Breaches (2021–2025) | Per 100K Rate Rank |
| 1 | California | 8,123.2 | 6 |
| 2 | Florida | 4,935 | 5 |
| 3 | Texas | 4,795.2 | 21 |
| 4 | New York | 3,574.4 | 9 |
| 5 | Ohio | 2,174 | 7 |
| 6 | Pennsylvania | 2,009.2 | 19 |
| 7 | Arizona | 1,925.2 | 3 |
| 8 | Illinois | 1,867.4 | 24 |
| 9 | North Carolina | 1,585.4 | 29 |
| 10 | Georgia | 1,566 | 34 |
The top four states by average annual breach volume, California, Florida, Texas, and New York, account for a combined average of 21,427.8 reported breaches per year, representing a disproportionate share of the national total.
States With the Lowest Personal Data Breach Rate Per 100,000 Residents, 2021-2025
| Rank | State | Avg Annual Breaches (2021–2025) | Avg Per 100K Residents | Population 2025 |
| 41 | Idaho | 253.2 | 12.46 | 2,032,120 |
| 42 | Rhode Island | 138.4 | 12.34 | 1,121,190 |
| 43 | Vermont | 79.4 | 12.25 | 648,278 |
| 44 | Maine | 165.2 | 11.71 | 1,410,380 |
| 45 | South Dakota | 108.4 | 11.64 | 931,033 |
| 46 | Mississippi | 336.6 | 11.44 | 2,942,920 |
| 47 | Wisconsin | 685 | 11.43 | 5,991,540 |
| 48 | Nebraska | 229.2 | 11.33 | 2,023,070 |
| 49 | Kansas | 330 | 11.04 | 2,989,710 |
| 50 | North Dakota | 87.4 | 10.87 | 804,089 |
All 10 lowest-ranked states record per-capita breach rates below 12.50 per 100,000 residents. North Dakota holds the lowest rate nationally at 10.87, less than one-third of Nevada’s leading rate of 36.95. Wisconsin ranks 47th despite a population of nearly 6 million, demonstrating that larger Midwestern states can maintain low per-capita breach exposure. Notably, Nebraska and South Dakota appear in the bottom 10 per capita while simultaneously ranking among the fastest-growing states by percentage increase, suggesting that breach volume is accelerating from a historically low base.
Methodology
This analysis ranks all 50 U.S. states by their average annual personal data breach rate per 100,000 residents, calculated using reported breach data from the FBI’s Internet Crime Complaint Center (IC3) annual reports for the years 2021 through 2025. For each state, the five-year average of annual reported breaches was divided by the state’s 2025 estimated population and multiplied by 100,000 to produce a standardized per-capita rate. States were also ranked by total volume, year-over-year percentage change (2021 to 2025), and average annual breach count to provide multiple dimensions of comparison. Population estimates are based on 2025 data.
Data Sources
- Personal Data Breach Data (Victim Count by Crime Type):
https://www.ic3.gov/AnnualReport/Reports/2021State/ - https://www.ic3.gov/AnnualReport/Reports/2022State/\
- https://www.ic3.gov/AnnualReport/Reports/2023State/
- https://www.ic3.gov/AnnualReport/Reports/2024State/#?s=51
- https://www.ic3.gov/AnnualReport/Reports/2025State/#?s=51
- Victim Count Data by Crime Type:
Bureau of Justice Statistics (BJS)
https://www.bjs.gov - Research Dataset: https://docs.google.com/spreadsheets/d/1i1e6IhW2FGkwhQmlnTxn0YzeRc7677V5YcuWKUGA0xg/edit?gid=0#gid=0
- Study by: intuitivedigital.com
About Intuitive Digital®
Intuitive Digital® is a Portland, Oregon-based digital marketing agency specializing in purpose-driven organizations, including nonprofits, B Corps, and mission-aligned businesses. The agency produced this analysis to map where personal data breach victims are most concentrated across the United States.
