While overall incidents have gone down since 2015, the GAO found that personally identifiable information breaches have been on the rise.