Breach figures are provisional

The first number is nearly meaningless

What it is

Initial breach notifications routinely understate scope by orders of magnitude, but the consumer's decision about whether to freeze credit gets made on the first number.

Why it matters

If you receive a breach letter, treat the stated figure as a floor rather than a fact, and re-check the company's filings months later. Stolen identifiers like SSNs and passport numbers do not expire; the credit monitoring offered does.

Companies and rows it touches

Aflac: the June 2025 disclosure gave no headcount; the December 2025 update put it at about 22.65 million (the earlier '500' starting figure could not be sourced and was removed). Yum Brands later acknowledged that personal information belonging to employees, primarily in the U.S., was also exposed in its January 2023 ransomware incident (Cybersecurity Dive, May 2023). Cencora's scope expanded to 27+ partner pharmaceutical companies.

Where to look

Life-Health-Dental (Aflac); F500 Consumer Goods & Food (Yum Brands); F500 Healthcare Providers (Cencora)