Given the sheer number of high-profile data breaches in recent years, and the varying levels of personal information stolen, it can be difficult to quantify how many American consumers were affected. A new survey tries to answer the questions of how many people have had their info stolen (a lot) and what consumers are doing to protect themselves (not much).

Using data from a nationally representative sample of thousands of respondents, our colleagues at Consumer Reports calculate that nearly 70 million Americans had their data stolen in 2014.

While online retail — with your credit card data going out over the Internet and without any face-to-face interaction between customer and seller — might seem like fertile breeding ground for data theft, only 18% of respondents say their info was stolen as a result of an online transaction. The overwhelming majority (76%) of compromised data originated from the respondents’ dealings with bricks-and-mortar retailers and financial institutions.

In fact, only 18% of consumers say their issue originated by an online retailer.

According to Consumer Reports, the new survey’s findings are supported by research from non-profit organization Identity Theft Resource Center (ITRC), which found 2014 was a hallmark year for breaches.

ITRC found that the occurrence of data breached increased more than 27.5% from 2013 to 2014, with nearly 783 breaches reported last year.

Despite the fact that compromised personal information can cause lasting negative affects for consumers, the survey found those affected by the breaches have done little to protect themselves after the fact.

Just half of those surveyed said they changed their online behavior after their information was compromised.

Consumer Reports argues this blasé response highlights the need for stronger consumers protections.

The magazine offers several tips and steps that consumers can take to safeguard their information both online and in physical stores.

Consumers Union, CR’s policy and advocacy arm, believes that Congress could enact new laws to make shopping safer.

The latest effort of which is a recently introduced legislation called the Consumer Privacy Protection Act, which would guard a wide swath of consumers’ personal data including financial information, as well as videos, photos.

In the event that a breach occurs, the bill would require companies to notify consumes within 30 days.

“This measure, as well as another bill introduced by Senator Nelson will move the ball forward on better data protection for consumers,” says Consumers Union’s Ellen Bloom. “Congress needs to set strong federal standards for defending consumer data while allowing states to enact or maintain more stringent laws if necessary to protect their residents.”

70 million Americans report stolen data [Consumer Reports]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.