What the Government Knows About Data Breaches | Proof

Updated June 1, 2026

When a data breach hits the news, the reaction is usually the same: panic, notification emails, maybe a free year of credit monitoring. Then the story fades. But the consequences don’t.

According to the Bureau of Justice Statistics, a data breach is only the beginning of a much longer cycle of identity fraud. Their Data Breach Notifications and Identity Theft report draws a straight line between breach exposure and real-world identity misuse—and the findings are especially sobering for businesses operating in high-trust environments.

If you're still thinking of fraud prevention as a login issue or a compliance checkbox, this report should be a wake-up call.

Key takeaways

• ​The breach cycle: Data breaches are not isolated events but the beginning of a long-term identity fraud cycle.
• ​Increased risk: 24% of identity theft victims received a breach notification in the year prior to the fraud.
• ​New account fraud: Leaked data is increasingly used to open entirely new accounts rather than just accessing existing ones.
• ​Verification vs. authorization: Simple identity verification is no longer enough; businesses must shift to identity authorization to confirm a person's intent and presence.

Exposure Doesn’t Always Mean Theft, But It Raises the Risk Dramatically

Here’s the core insight: while not everyone who gets a breach notification becomes a fraud victim, those who do are significantly more likely to report downstream identity theft. In fact:

• ​24% of identity-theft victims had received a data breach notification in the previous year
• ​For these individuals who experienced identity theft, the most common type involved the fraudulent use of their existing accounts (such as bank, credit cards, and utilities)
• ​A growing portion reported their identity data being used to open new accounts in their name

That last one is particularly important. Fraudsters aren’t just logging into stolen accounts. They’re using identity data leaked in a breach to impersonate real people—and using that data to pass through account opening, apply for new loans, and sign documents undetected.

Data Alone Isn’t the Problem. It’s What Comes After.

Breached data doesn’t sit idle. It gets sold, stitched together, and used to power sophisticated attacks—especially synthetic identity fraud and impersonation.

And here’s the catch: verification alone isn’t enough to stop it.

Why? Because when sensitive data like date of birth, Social Security numbers, and addresses are leaked, simply verifying that information just confirms it's correct. It doesn't prove the person using it is genuinely who they claim to be, especially in a world where access can be easily faked and deepfakes are convincing.

A Better Standard: Identity Authorization

The BJS report isn’t just a set of statistics; it’s a strong argument for rethinking how organizations treat identity. If data breach exposure is now a permanent fixture of our lives online, then businesses need tools that do more than check IDs. They need solutions that confirm the person is real, present, and aware of the action being taken in their name.

That’s the difference between identity verification and identity authorization, and it’s where traditional fraud controls often fall short.

At Proof, we help businesses go beyond “checking the box” on identity. Our platform brings together:

• ​Real-time identity verification with AI and human fallback
• ​Deepfake-resistant online notarization and electronic signatures
• ​Tamper-proof audit trails showing who signed what, and when

From mortgage closings and auto loans to insurance claims and powers of attorneys, Proof gives organizations confidence that the right person is taking the right action, not that someone purchased the right data set. Reach out to learn how you can reduce risk across your most sensitive workflows.