text: 39 SHARES 
   
   In recent years, many Americans’ personal information has become compromised by big data breaches. In 2018 alone, prominent companies like Adidas, Best Buy, Delta, Kmart, Macy’s and Sears have fallen victim to cybercriminals. According to the Identity Theft Resource Center’s most recent Data Breach Report, between January 1, 2005 and August 31, 2018, there have been 9,395 breaches. That accounts for over 1.1 billion records compromised. 
   
   The federal government and various businesses in recent years have taken more aggressive measures to build up our defenses. The Trump administration recently released a new cybersecurity plan, including taking more offensive measures toward foreign cyberattacks. Despite this, criminal strategies continue to evolve and grow in sophistication, keeping consumers vulnerable to identity theft and fraud. 
   
   But some Americans are more susceptible than others to such crimes. In order to determine who is most likely to be exposed to and affected by identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across ten key metrics. Our data set ranges from identity-theft complaints per capita to average loss amount due to fraud. Read on for our findings, tips for protecting your personal information and a full description of our methodology. 
   
   Main Findings 
   
   States With the Most Identity Theft & Fraud 
   
   Overall Rank* State Total Score ‘Identity Theft’ Rank ‘Fraud’ Rank ‘Policy’ Rank 1 Nevada 72.66 2 5 27 2 Florida 69.11 12 2 27 3 New Jersey 68.52 1 25 5 4 Delaware 68.34 21 1 50 5 California 64.12 6 17 16 6 District of Columbia 63.89 20 3 5 7 New York 62.17 9 15 27 8 West Virginia 62.10 8 29 5 9 Michigan 61.71 10 13 41 10 North Dakota 61.64 4 37 5 11 Ohio 61.44 3 41 41 12 Maryland 59.60 7 19 51 13 Illinois 59.39 5 40 18 14 New Mexico 59.38 13 21 27 15 Colorado 59.20 14 14 41 16 South Carolina 57.83 22 9 41 17 Texas 57.72 18 12 27 18 Oregon 57.06 33 4 18 19 Tennessee 56.85 26 8 27 20 Georgia 56.36 23 10 27 21 Arizona 56.35 17 16 41 22 North Carolina 56.16 31 6 27 23 Pennsylvania 55.63 24 23 1 24 Minnesota 55.62 19 28 5 25 Virginia 55.28 25 11 18 26 Oklahoma 55.09 15 44 5 27 Nebraska 54.87 11 51 18 28 New Hampshire 53.70 30 20 1 29 Massachusetts 53.34 16 48 5 30 Missouri 51.04 32 27 1 31 Alabama 50.22 46 7 5 32 Rhode Island 49.86 28 47 4 33 Washington 49.32 27 38 18 34 Mississippi 48.91 34 18 18 35 Connecticut 48.16 29 36 27 36 Louisiana 46.48 39 22 18 37 Utah 45.49 36 30 27 38 Idaho 45.48 37 43 5 39 Alaska 44.38 38 39 18 40 Arkansas 43.35 35 45 41 41 Kansas 42.95 40 31 41 42 Wyoming 42.78 44 32 5 43 Montana 42.72 41 42 27 44 Indiana 42.35 47 24 27 45 Kentucky 41.83 45 35 16 46 Wisconsin 41.25 43 33 27 47 Maine 40.42 49 46 5 48 Iowa 39.25 42 49 41 49 Vermont 38.86 50 34 27 50 South Dakota 37.85 51 26 18 51 Hawaii 36.79 48 50 41 
   
   
   
   *No. 1 = Most Vulnerable 
   
   Quick Tips for Avoiding Identity Theft & Fraud 
   
   Emphasize Email Security : It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account. 
   
   : It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account. Sign Up for Credit Monitoring : Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report. 
   
   : Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report. Leverage Account Alerts & Update Contact Info : Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard. 
   
   : Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard. Use Common Sense Online: Don’t open emails you don’t recognize. Don’t download files from untrustworthy sources. Don’t send account numbers and passwords via email or messenger applications. And don’t enter financial or personal information into websites that lack the “https” prefix in their URLs. 
   
   For more tips and information, check out WalletHub’s Identity Theft Guide. 
   
   Ask the Experts 
   
   As a cyber-oriented culture, it’s natural to wonder whether and how our daily habits assist hackers in stealing our personal information. We consulted a panel of experts for answers to such questions and advice on how to safeguard our data against cybercriminals. Click on the experts’ profiles to read their bios and thoughts on the following key questions: 
   
   What can individuals do to guard against identity theft? How should consumers choose among third-party providers offering services to protect their identity and personal data? Should victims of identity theft be able to change their Social Security number? How can we make this number more difficult to steal and use (e.g., add more digits)? Is the recent expansion of social media facilitating identity thefts? Should the federal government intervene to establish a clear process for victims of identity theft looking to clear their name? What measures can authorities undertake in order to avoid cases like the recent Equifax leaks? Should credit bureaus be tested for security breaches by authorities on a regular basis? If so, would the Consumer Financial Protection Bureau play a larger role in regulation and enforcement of bureaus? 
   
   Methodology 
   
   In order to determine where American consumers are most vulnerable to identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across three key dimensions: 1) Identity Theft, 2) Fraud and 3) Policy. 
   
   We evaluated those dimensions using ten key metrics, which are listed below with their corresponding weights. Each metric was graded on a 100-point scale, with a score of 100 representing the most vulnerable. 
   
   Finally, we determined each state and the District’s weighted average across all metrics to calculate its total score and used the resulting scores to rank-order our sample. 
   
   Identity Theft – Total Points: 47.5 
   
   Identity-Theft Complaints per Capita: Full Weight (~23.75 Points) 
   
   Average Loss Amount Due to Online Identity Theft: Full Weight (~23.75 Points) 
   
   Note: This metric was calculated using the following formula: Total Loss Amount / Total Number of Online Identity-Theft Complaints. 
   
   Fraud – Total Points: 47.5 
   
   Fraud & Other Complaints per Capita: Full Weight (~11.88 Points) 
   
   Median Loss Amount Due to Fraud: Full Weight (~11.88 Points) 
   
   Note: This metric was calculated using the following formula: Total Reported Amount Paid / Total Number of Complaints Stating the Amount Stolen. “Total reported amount paid” is based on the total number of fraud complaints for which the amount paid was reported by the victims. The amount paid ranges from $0 to $999,999. 
   
   Persons Arrested for Fraud per Capita: Full Weight (~11.88 Points) 
   
   E-Commerce Attack Rates: Full Weight (~11.88 Points) 
   
   Policy – Total Points: 5.0 
   
   Availability of Security-Freeze Law for Minors’ Credit Reports: Full Weight (~1.25 Points) 
   
   Note: This binary metric considers the presence or absence of legislation allowing parents, legal guardians or other representatives of minors to place a security freeze on the minor’s credit report. 
   
   Availability of Identity-Theft Passport Program : Full Weight (~1.25 Points) 
   
   Note: This binary metric considers the presence or absence of Identity-Theft Passport programs that help victims of identity theft reclaim their identity. When presented to a law-enforcement agency, an “identity-theft passport” allows a victim to prevent his or her arrest for offenses committed by an identity thief. 
   
   Compliance with REAL ID Act : Full Weight (~1.25 Points) 
   
   Note: According to the Department of Homeland Security, the REAL ID Act “establishes minimum security standards for license issuance and production and prohibits Federal agencies from accepting for certain purposes driver’s licenses and identification cards from states not meeting the Act’s minimum standards. The purposes covered by the Act are: accessing Federal facilities, entering nuclear power plants, and, boarding federally regulated commercial aircraft.” This binary metric considers a state’s compliance, noncompliance or extension of time to comply with the ACT. An extension allows a state to accept driver’s licenses and identification cards issued by that jurisdiction to accept those forms of identification for official purposes, under the condition that the state has provided adequate justification for noncompliance. 
   
   
   
   Data Disposal Laws by State : Full Weight (~1.25 Points) 
   
   Note: This is a binary metric that measures the presence or absence of data disposal laws in each state. Businesses and government collect personal information and store it in various formats-digital and paper. Several states have enacted laws that require entities to destroy, dispose or otherwise make personal information unreadable or undecipherable. 
   
   
   
   Videos for News Use: 
   
   
   
   Sources: Data used to create this ranking were collected from the Federal Trade Commission, Internet Crime Complaint Center, Federal Bureau of Investigation, Department of Homeland Security, Experian Information Solutions and National Conference of State Legislatures. 
   
   Image: alexskopje / Shutterstock.com 
   
   Was this article helpful? Yes No Awesome! Thanks for your feedback. Thank you for your feedback. Sorry! Failed to send the feedback. Please try again later. Submit ||||| 2018 Data Breaches: Click Here 
   
   2017 Data Breaches: Click Here 
   
   
   
   Information management is critically important to all of us - as employees and consumers. For that reason, the Identity Theft Resource Center has been tracking security breaches since 2005, looking for patterns, new trends and any information that may better help us to educate consumers and businesses on the need for understanding the value of protecting personal identifying information. 
   
   January 1, 2005 to May 17, 2018 (cumulative totals) 
   
   Number of Breaches = 9,039 
   
   Number of Records Exposed = 1,097,531,139 records 
   
   The ITRC Breach Report is a compilation of data breaches confirmed by various media sources and/or notification lists from state governmental agencies. This list is updated daily, and published each Tuesday. Breaches on this list typically have exposed information that could potentially lead to identity theft, including Social Security numbers, financial account information, medical information, and even email addresses and passwords. ITRC follows U.S. Federal guidelines about what combination of personal information comprise a unique individual, and the exposure of which will constitute a data breach. 
   
   What is a breach? The ITRC defines a data breach as an incident in which an individual name plus a Social Security number, Driver’s License number, medical record or financial record (credit/debit cards included) is potentially put at risk because of exposure. This exposure can occur either electronically or in paper format. The ITRC will also capture breaches that do not, by the nature of the incident, trigger data breach notification laws. Generally, these breaches consist of the exposure of user names, emails and passwords without involving sensitive personal identifying information. These breach incidents will be included by name but without the total number of compromised records included in the cumulative total. 
   
   There are currently two ITRC breach reports which are updated and posted on-line on a weekly basis. The ITRC Breach Report presents detailed information about data exposure events along with running totals for a specific year. Breaches are broken down into five categories, as follows: business, financial/credit/financial, educational, governmental/military and medical/healthcare. The ITRC Breach Stats Report provides a summary of this information by category. Other more detailed reports may be generated on a quarterly basis or as dictated by trends. 
   
   It should be noted that data breaches are not all alike. Security breaches can be broken down into a number of additional sub-categories by what happened and what information (data) was exposed. What they all have in common is they usually contain personal identifying information (PII) in a format easily read by thieves, in other words, not encrypted. 
   
   The ITRC currently tracks seven categories of data loss methods: 
   
   ● Insider Theft ● Hacking / Computer Intrusion ( includes Phishing, Ransomware/Malware and Skimming) ● Data on the Move ● Physical Theft ● Employee Error / Negligence / Improper Disposal / Lost ● Accidental Web/Internet Exposure ● Unauthorized Access 
   
   Please note that the Subcontractor/Third Party/BA category is no longer identified as a "method" for a breach but is coupled with one of the types of the breaches above. 
   
   The ITRC currently tracks various types of information compromised: 
   
   
   
   ● Social Security number ● Credit/Debit Card number ● Email/Password/User Name ● Protected Health Information (PHI) 
   
   ● Driver's License ● Financial Accounts ● Other/Undefined type of records 
   
   ITRC has been tracking and compiling statistics on data breaches since 2005. Our findings are reported below or you can view the multi-year chart: 
   
   Regarding the rules of inclusion, the ITRC has given a considerable amount of thought to the development of the criteria used when assessing breaches and the integrity of its sources. For example, breaches that occurred in any given year or a previous year are included in the year in which the breach was publicized. Each selected incident is required to have been reported to a state Attorney General's office or published by a credible media source, such as TV, radio, press, etc. The item will not be included at all if ITRC is not certain that the source is real and credible. Larger breaches often have multiple attributions, and we usually cite more than one source. 
   
   We include, in each reported data breach item, a link or source of the article, and the information presented by that article. Many times, we have attributions from a multitude of media sources and outlets. ITRC adheres to the facts as reported, and does not alter the previously published information. We always attempt to provide live links back to the original article, but these remain good only as long as the source retains the article at that web URL. 
   
   As an authority on data breach exposures, the ITRC is frequently asked if there are more security breaches now than ever before. This question is hard to answer. More companies are revealing that they have had a data breach, either due to laws or public pressure. It is the opinion of the ITRC that the criminal population is stealing more data from companies, AND data breaches are being more frequently publicized. ITRC is also aware that many breaches go unreported, and as a result of we are certain that our ITRC Breach List under-reports the problem. One thing we can say with certainty is that this is NOT a new problem. 
   
   Other websites and resources for data breaches include:
target: – Given the recent Equifax security breach—alongside a 630% increase in data breaches in the past year, according to one report—identity theft is bound to be a concern for many Americans. But it turns out the state you call home has a lot to do with your risk. WalletHub reviewed identity theft and fraud complaints and policy across the US to come up with the most vulnerable states.