More than 121.8 million online accounts were compromised worldwide between July and September 2026, a 13.2% increase from the previous quarter, according to research from Surfshark. The United States remained the most affected country, accounting for 38.1 million leaked accounts, or 31% of the global total.
The UK recorded 5.8 million breached accounts, up 121.6% from the previous quarter. That increase moved it ahead of France as Europe’s most breached country. Ukraine climbed from 47th to sixth place in the global rankings, with 2.6 million accounts compromised during the quarter.
Brazil, with 7 million leaked accounts, ranked second worldwide, followed by the UK, India with 5.5 million and Australia with 3.1 million. France recorded 2.4 million breaches, down from 19.7 million in Q2, and fell out of the global top three for the first time this year.
Surfshark’s figures also show that breach totals do not tell the whole story. Estonia had the highest breach density, at 118 compromised accounts per 1,000 people, ahead of Australia, the US and the UK.
Surfshark Chief Security Officer Tomas Stamulis said attacks vary between countries as criminals pursue targets for financial or political reasons. The company also cautioned that breaches often occur on company servers, meaning a VPN cannot prevent personal data from being exposed in such incidents.
Stamulis advised treating personal information as sensitive and sharing real details only when necessary, such as on official forms. For other sign-ups, he recommended using an alias, a secondary email address or an email-masking service. A password manager can also help prevent one leaked password from giving access to other accounts, while identity-theft protection and data-removal services may help users identify and reduce their exposure.
Sources: TechRadar.