Tracker · Cybersecurity
Data breaches
Breach notices that companies and other organizations must file with state attorneys general when residents’ personal information is exposed.
Updated Nov 2, 2026, 3:49 p.m. ET from California, Washington, Oregon attorneys general
Notices, last 30 days
71
California, Washington, Oregon
California, last 90 days
166
Counts not published
Washington, last 90 days
38
776,959 residents affected
Oregon, last 90 days
50
26,799,556 residents affected
Weeks start Monday, dated by when the notice was reported. The latest week may be incomplete. States: California, Washington, Oregon.
All notices, newest first
1,072 entries. Page 22 of 22.
| Reported | Organization | State | Breach date | Residents affected | Data exposed |
|---|---|---|---|---|---|
| Oct 6, 2025 | AppFolio, Inc. | CA | Aug 8, 2025 | – | – |
| Oct 6, 2025 | Spokane Produce, Inc. | WA | Jul 18, 2025 | 788 | Name; Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth |
| Oct 6, 2025 | AppFolio, Inc. | WA | Aug 8, 2025 | 2,882 | Name; Social Security Number; Full Date of Birth |
| Oct 3, 2025 | WestJet | WA | Jun 13, 2025 | 7,333 | Name; Full Date of Birth; Passport Number; Medical Information; Other |
| Oct 3, 2025 | Brightstar Global Solutions Corporation (IGT Group, Brightstar Lottery Group) | WA | Nov 17, 2024 | 1,796 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Military ID Number; Passport Number; Health Insurance Policy or ID Number; Medical Information |
| Oct 3, 2025 | WestJet | OR | Jun 13, 2025 | 1,200,000 | – |
| Oct 3, 2025 | Brightstar Global Solutions Corporation | CA | Nov 17, 2024 | – | – |
| Oct 3, 2025 | Sunnyvale Elementary School District | CA | – | – | – |
| Oct 3, 2025 | Brightstar Global Solutions Corporation | OR | – | 103,879 | – |
| Oct 2, 2025 | City of Pittsburg, California | CA | Aug 6, 2024 | – | – |
| Oct 2, 2025 | Allied Services Division Welfare Fund | CA | Oct 9, 2024 | – | – |
| Oct 1, 2025 | County of Stanislaus | CA | Jul 28, 2025 | – | – |
| Oct 1, 2025 | Allianz Life Insurance Company of North America | CA | Jul 16, 2025 | – | – |
| Oct 1, 2025 | Boyd Gaming Corporation | CA | Sep 5, 2025 | – | – |
| Oct 1, 2025 | Episource, LLC | CA | Jan 27, 2025 | – | – |
| Sep 30, 2025 | WestJet | CA | Jun 13, 2025 | – | – |
| Sep 30, 2025 | Motility Software Solutions, Inc. | OR | Aug 11, 2025 | 766,670 | – |
| Sep 30, 2025 | Motility Software Solutions Inc | WA | Aug 11, 2025 | 8,349 | Name; Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth; Passport Number |
| Sep 29, 2025 | Belkorp Ag, LLC | CA | Apr 18, 2025 | – | – |
| Sep 29, 2025 | Forest & Einstein Staffing, Inc. d/b/a The Job Shop | CA | Jun 10, 2025 | – | – |
| Sep 29, 2025 | Motility Software Solutions, Inc. | CA | Aug 11, 2025 | – | – |
| Sep 29, 2025 | Superior Vision Services, Inc. | CA | Jul 9, 2025 | – | – |
How this tracker works
Every state requires organizations to notify residents of breaches of personal information, and some also require a copy of the notice to the attorney general, who publishes it. We read the public lists of California, Washington and Oregon twice a day and keep the last 13 months.
“Residents affected” counts only that state’s residents, not the breach’s total size. The same breach often appears in several states’ lists. A notice means an organization reported a breach; the notice itself, linked from each name where the state publishes it, explains what happened.