Senate Report Finds Data Broker Breaches Cost $20B

On March 1, 2026, the U.S. Senate released findings that four significant data‑broker breaches have inflicted more than twenty billion dollars in losses on American consumers ¹. The study highlights how personal information—collected from public records, social media activity, and purchased lists—is aggregated into detailed profiles sold to marketers, advertisers, or scammers who use them for targeted phishing campaigns. Senator Maggie Hassan called for stronger action to protect citizens from such scams ².

The report identifies only four incidents but estimates their combined impact at over $20 billion. While exact dates are not specified, these events occurred prior to publication and contributed significantly to consumer harm. Hassan urged lawmakers to impose greater transparency requirements on brokers, mandating clear disclosures about data collection and sales practices.

Data brokers’ business model relies heavily on “data enrichment,” where they merge disparate sources—including public records and online behavior—to create comprehensive consumer dossiers. These enriched datasets are then marketed to legitimate businesses; however, the same details can be exploited by fraudsters. According to an FTC 2019 report cited in expert commentary, over three billion dollars were lost due to scams leveraging purchased consumer lists. This figure underscores the scale of financial damage caused when brokers inadvertently provide contact details to malicious actors.

Historical context further illustrates the magnitude of these breaches. Equifax’s massive leak of more than 148 million records in 2017 and Anthem Inc.’s exposure of nearly eighty million consumer records in 2015 are among the largest privacy violations recorded. The new Senate findings suggest that secondary market activities—where stolen personal information is sold off after initial compromises—play a pivotal role in amplifying losses. Legislative push will likely target data brokers who profit indirectly from such incidents rather than holding primary responsibility for original theft events themselves.

Experts note average breach costs exceed $3 million per incident, as indicated by a 2025 study at Carnegie Mellon University. When applied across multiple cases, this estimate aligns with the reported $20 billion total. Moreover many scams remain underreported because victims often lack awareness or feel embarrassed about their loss, implying actual figures may be higher.

The implications for consumers are clear: without regulatory oversight on how brokers handle and sell sensitive data, individuals face heightened risk of identity theft and phishing attacks. Senator Hassan's call for stronger action reflects growing concern that current laws do not adequately protect against misuse of brokered data. If enacted, transparency mandates would require brokers to disclose exactly what types of data they collect, how it is verified before sale, and whether any third parties have access to those datasets.

In practice, companies using brokered lists must conduct thorough due diligence, ensuring purchased contacts meet strict verification standards. Failure can expose them—and customers—to fraud schemes relying on accurate contact details. The Senate report’s findings serve as both a warning and an impetus for lawmakers to close gaps in privacy law that allow brokers to facilitate large‑scale consumer losses.