Millions of national identity numbers leaked online

You can change your password. You can cancel your card. But a national identification number is meant to be the one identifier a person never has to replace. That is exactly what makes its exposure so consequential. This Chart of the Week looks at what happens when that one number ends up in someone else's hands.

Key insights

• 113.6 million national identification numbers, including social security numbers, national insurance numbers, or personal identity codes, have been leaked globally since 2004, with the United States (78.8M), Brazil (6.6M), Russia (5.2M), China (1.8M), and the United Kingdom (1.1M) ranking as the top five most affected countries.
• This sensitive data is bundled with user emails or phone numbers, and often more, lowering the barrier for scammers to execute identity theft, phishing, and other fraud. On average, a single compromised email address drags in 2.5 additional data types.
• However, nearly 70% of the global total of leaked national identification numbers are attributed to the United States alone. Within North America, the United States accounts for 99% of the region's total, followed by Canada with approximately 315,000 exposed identity numbers.
• Identity theft alone cost Americans $185.8 million in 2025, which translates to more than half a million dollars every single day, according to the latest report from the FBI's Internet Crime Complaint Center (IC3).¹ The Federal Trade Commission (FTC) logged roughly 1.4 million identity theft reports in 2025 — defined as fraud committed or attempted using a person's identifying information without authority.² That breaks down to 3,721 victims every 24 hours.
• Europe is the second most exposed region after North America, with over 10 million leaked national identification numbers. Within Europe, Russia accounts for 52% of the region's total, followed by the United Kingdom (11%), Sweden (8%), France (7%), Belgium (4%), and Portugal (3%). Lithuania, Germany, Spain, and Italy each account for approximately 2%. Together, these 10 countries account for 92% of the region's total.
• Leaked national identification numbers represent only a fraction of the problem. Since 2004, data breaches have also exposed 93.1 million identification document numbers. When accounting for all compromised data categories (excluding emails), the cumulative total of leaked records reaches nearly 60 billion.

Methodology and sources

This study examines global data breach statistics spanning from 2004 to 2026, focusing on leaked national identification numbers on a worldwide scale. The underlying data was harvested from publicly available databases by independent partners, who then aggregated the records by email addresses. This information was then anonymized and provided to Surfshark’s researchers for statistical analysis.

Data was collected from:

References: