Last year, there were 1,244 reported data breaches, down from an all-time high of 1,632 the previous year. Even so, the number of exposed records more than doubled from 197.6 million in 2017 to 446.5 million last year.

The findings come from a report released Monday by the nonprofit Identity Theft Resource Center and security and privacy services firm CyberScout. The annual study counts data breaches confirmed by media sources or by state government agencies.

While it appears that more companies have improved their security practices, resulting in fewer breaches, the amount of data created and collected is exponentially rising.

“The increased exposure of sensitive consumer data is serious,” Eva Velasquez, CEO of the ITRC, said in a statement. “Never has there been more information out there putting consumers in harm’s way.”

Some other key findings from the report: In addition to the 446.5 million records exposed, 1.68 billion “non-sensitive” records—including information like passwords, usernames, and email addresses. Hacking was the most common type of data breach followed by unauthorized access, or accessing data via the proper channels without consent, and then “employee error/negligence/improper disposal/lost” data.

Note: The report does not include incidents in which data was misused like when Cambridge Analytica violated Facebook policy by harvested data from up to 87 million Facebook accounts.

The business sector had the highest number of data incidents in 2018, with a total of 571 breaches that exposed 415.2 million sensitive records, according to the report. Meanwhile, the healthcare sector had the highest average number of exposure per breach, with 9.9 million sensitive records exposed in 363 breaches.

The good news is it looks like more companies and entities that collect data are securing sensitive information. The bad news is that the average data breach is bigger than ever.