Tracker · Cybersecurity
Data breaches
Breach notices that companies and other organizations must file with state attorneys general when residents’ personal information is exposed.
Updated Nov 2, 2026, 3:48 a.m. ET from California, Washington, Oregon attorneys general
Notices, last 30 days
60
California, Washington, Oregon
California, last 90 days
155
Counts not published
Washington, last 90 days
38
776,959 residents affected
Oregon, last 90 days
50
26,799,556 residents affected
Weeks start Monday, dated by when the notice was reported. The latest week may be incomplete. States: California, Washington, Oregon.
All notices, newest first
1,062 entries. Page 3 of 22.
| Reported | Organization | State | Breach date | Residents affected | Data exposed |
|---|---|---|---|---|---|
| Sep 21 | Fun For Less Tours, Inc. | CA | Oct 27, 2025 | – | – |
| Sep 21 | Friesen Group | CA | May 15, 2025 | – | – |
| Sep 21 | Ridgeway Pharmacy Ltd | OR | Jun 7 | 258,920 | – |
| Sep 18 | IDScan.net | OR | Apr 1 | 13,000,000 | – |
| Sep 18 | Opportune LLP | CA | Jun 22 | – | – |
| Sep 18 | Seyfarth Shaw LLP | CA | Aug 18 | – | – |
| Sep 18 | The Office of the Los Angeles City | CA | Dec 28, 2025 | – | – |
| Sep 17 | CallonDoc, Inc. | WA | Dec 22, 2025 | 12,186 | Name; Medical Information; Protected Health Information owned or licensed by a HIPAA covered entity |
| Sep 17 | Partnership HealthPlan of California | CA | May 13 | – | – |
| Sep 17 | CallonDoc, Inc. | CA | Dec 22, 2025 | – | – |
| Sep 17 | Boston Capital Holdings LP | WA | Jan 16 | 1,355 | Name; Social Security Number; Driver's License or Washington ID Card Number |
| Sep 15 | Kaniksu Community Health | OR | Dec 2, 2025 | 81,136 | – |
| Sep 15 | Alliance Environmental Group, LLC | CA | Apr 24 | – | – |
| Sep 15 | Tarter Krinsky & Drogin LLP | CA | Sep 9, 2025 | – | – |
| Sep 15 | Leggett & Platt, Incorporated Employee Benefits Plan | CA | Oct 18, 2025 | – | – |
| Sep 14 | Cambridge Mercantile Corp. (U.S.A.) | CA | Jun 11 | – | – |
| Sep 14 | Paradigm Healthcare Services | CA | Oct 8, 2025 | – | – |
| Sep 14 | Craneware, Inc. | OR | Jul 7 | 1 | – |
| Sep 14 | Accela, Inc. | CA | Dec 11, 2025 | – | – |
| Sep 14 | See's Candies - Corporate Office | OR | Apr 11 | 459 | – |
| Sep 11 | zHealth, Inc. | OR | Jan 20 | 118,563 | – |
| Sep 11 | Cornerstone Staffing Solutions, Inc. | CA | Nov 6, 2025 | – | – |
| Sep 11 | Cornerstone Staffing Solutions, Inc. | OR | Nov 6, 2025 | 366,122 | – |
| Sep 11 | Suffolk Federal Credit Union | CA | Sep 17, 2025 | – | – |
| Sep 11 | Cornerstone Staffing Solutions, Inc. | WA | Nov 6, 2025 | 681 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Military ID Number; Passport Number; Health Insurance Policy or ID Number; Medical Information; Username and Password/Security Question Answers; Other |
| Sep 11 | zHealth, Inc. | CA | Jan 20 | – | – |
| Sep 11 | zHealth, Inc. | WA | Jan 20 | 1,332 | Name; Health Insurance Policy or ID Number; Medical Information |
| Sep 11 | Catalyst Physician Group | CA | Dec 2, 2025 | – | – |
| Sep 9 | Northwest Paper Box Manufacturers | OR | Jan 1, 1 | 752 | – |
| Sep 9 | Quatrro Business Support Services, Inc. | OR | Nov 11, 2025 | 188,218 | – |
| Sep 9 | ASOS US Sales LLC | OR | Jul 28 | 138,828 | – |
| Sep 9 | Greenberg Traurig, LLP (“GT”) | OR | Aug 26 | 150,000 | – |
| Sep 9 | Quatrro Business Support Services, Inc. | WA | Nov 11, 2025 | 10,008 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Passport Number; Health Insurance Policy or ID Number; Medical Information |
| Sep 9 | Greenberg Traurig, LLP (“GT”) | CA | Aug 26 | – | – |
| Sep 9 | Quatrro Business Support Services, Inc. | CA | Nov 11, 2025 | – | – |
| Sep 8 | BestCare treatment Services, Inc. | OR | Jun 15 | 250 | – |
| Sep 8 | Hibbett Retail, Inc. | WA | Apr 22 | 510 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Student ID Number; Military ID Number; Passport Number; Health Insurance Policy or ID Number; Medical Information |
| Sep 8 | Hibbett Retail, Inc. | CA | Apr 22 | – | – |
| Sep 4 | Elixir Medical Corporation | CA | Jul 20 | – | – |
| Sep 4 | Bimbo Bakeries USA (Oracle) | WA | Aug 9, 2025 | 786 | Name; Social Security Number; Financial & Banking Information |
| Sep 4 | Bimbo Bakeries USA | OR | Aug 9, 2025 | 46,064 | – |
| Sep 4 | Catalyst Brands LLC | OR | May 20 | 187,341 | – |
| Sep 4 | Catalyst Brands LLC | CA | May 20 | – | – |
| Sep 4 | Bimbo Bakeries USA | CA | Aug 9, 2025 | – | – |
| Sep 4 | LHC Group, Inc. | WA | Apr 7 | 6,602 | Name; Social Security Number; Financial & Banking Information; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information; Protected Health Information owned or licensed by a HIPAA covered entity |
| Sep 4 | Catalyst Brands LLC | WA | May 20 | 4,015 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Military ID Number; Passport Number; Email Address and Password/Security Question Answers; Other |
| Sep 3 | Mogren, Glessner & Ahrens, P.S. | WA | Jun 9 | 1,379 | Name; Social Security Number; Financial & Banking Information; Full Date of Birth; Medical Information; Username and Password/Security Question Answers; Email Address and Password/Security Question Answers; Protected Health Information owned or licensed by a HIPAA covered entity |
| Sep 3 | Boston Health Care for the Homeless Program | OR | Oct 31, 2025 | 201,260 | – |
| Sep 3 | Virta Health Corp. and Virta Medical, PC (Department of Health And Human Services) | WA | Mar 19 | 134 | Name; Social Security Number; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information; Protected Health Information owned or licensed by a HIPAA covered entity |
| Sep 3 | The Lighthouse for the Blind, Inc. | WA | Apr 9 | 520 | Name; Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information |
How this tracker works
Every state requires organizations to notify residents of breaches of personal information, and some also require a copy of the notice to the attorney general, who publishes it. We read the public lists of California, Washington and Oregon twice a day and keep the last 13 months.
“Residents affected” counts only that state’s residents, not the breach’s total size. The same breach often appears in several states’ lists. A notice means an organization reported a breach; the notice itself, linked from each name where the state publishes it, explains what happened.