# 600 million records, no verdict: Marriott, Equifax and Anthem

The three biggest data breaches on the list took about 606.8 million records between them. One has no charges. Two have charges that remain unproven. None has a verdict.

Updated November 10, 2026. Interactive version: https://www.autumn.ai/resources/china-spy-cases/records

| Company | Records | Details | Outcome | Sources |
|---|---|---|---|---|
| Marriott (Starwood) | up to 383 million guest records | Taken over four years, including 5.25 million unencrypted passport numbers. First put at up to 500 million. In December 2018 the US secretary of state said China was behind it. | No charges | [NPR: secretary of state on the Marriott hack, December 12, 2018](https://www.npr.org/2018/12/12/676199045/pompeo-says-china-is-responsible-for-marriott-computer-hack-espionage-is-growing); [Fox Business: Marriott revises the count to 383 million](https://www.foxbusiness.com/financials/marriott-says-fewer-guests-affected-in-starwood-hack); [Al Jazeera: US blames China for the Marriott data theft](https://www.aljazeera.com/economy/2018/12/13/us-accuses-china-for-massive-marriott-hotel-chain-data-theft) |
| Equifax | about 145 million Americans | Names, birth dates and Social Security numbers, the indictment says. Four military personnel were charged in 2020. | Charged 2020 · unproven | [US Attorney, N.D. Georgia: indictment in the Equifax breach](https://www.justice.gov/usao-ndga/pr/chinese-military-personnel-charged-computer-fraud-economic-espionage-and-wire-fraud) |
| Anthem | 78.8 million people | Names, health ID numbers, birth dates, Social Security numbers, addresses, and employment and income data, the indictment says. One named person and a John Doe were charged in 2019. | Charged 2019 · unproven | [US Attorney, S.D. Indiana: indictment in the Anthem breach](https://www.justice.gov/usao-sdin/pr/member-sophisticated-china-based-hacking-group-indicted) |

Marriott’s figure is the company’s revised upper limit and counts some guests more than once. The Equifax and Anthem figures are from the indictments, which are allegations.

## Sources

- [NPR: secretary of state on the Marriott hack, December 12, 2018](https://www.npr.org/2018/12/12/676199045/pompeo-says-china-is-responsible-for-marriott-computer-hack-espionage-is-growing)
- [Fox Business: Marriott revises the count to 383 million](https://www.foxbusiness.com/financials/marriott-says-fewer-guests-affected-in-starwood-hack)
- [Al Jazeera: US blames China for the Marriott data theft](https://www.aljazeera.com/economy/2018/12/13/us-accuses-china-for-massive-marriott-hotel-chain-data-theft)
- [US Attorney, N.D. Georgia: indictment in the Equifax breach](https://www.justice.gov/usao-ndga/pr/chinese-military-personnel-charged-computer-fraud-economic-espionage-and-wire-fraud)
- [US Attorney, S.D. Indiana: indictment in the Anthem breach](https://www.justice.gov/usao-sdin/pr/member-sophisticated-china-based-hacking-group-indicted)

Only cases that name the company are counted; many never do. “Charged” cases are unproven allegations and defendants are presumed innocent. Compiled by Autumn (https://www.autumn.ai).