Tracker · Cybersecurity
Data breaches
Breach notices that companies and other organizations must file with state attorneys general when residents’ personal information is exposed.
Updated Nov 2, 2026, 3:48 a.m. ET from California, Washington, Oregon attorneys general
Notices, last 30 days
60
California, Washington, Oregon
California, last 90 days
155
Counts not published
Washington, last 90 days
38
776,959 residents affected
Oregon, last 90 days
50
26,799,556 residents affected
Weeks start Monday, dated by when the notice was reported. The latest week may be incomplete. States: California, Washington, Oregon.
All notices, newest first
1,062 entries. Page 6 of 22.
| Reported | Organization | State | Breach date | Residents affected | Data exposed |
|---|---|---|---|---|---|
| Aug 3 | CTS Journey Holdings, LLC, a Delaware limited liability comp | WA | Dec 3, 2025 | 2,226 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Passport Number; Medical Information |
| Aug 3 | CTS Journey Holdings, LLC, a Delaware limited liability company (DBA Corporate Travel Service) | CA | Dec 3, 2025 | – | – |
| Jul 31 | Stanislaus County Health Services Agency | CA | Dec 2, 2025 | – | – |
| Jul 31 | Everside Health (Aesto, LLC) | WA | Dec 2, 2025 | 21,308 | Name; Social Security Number; Full Date of Birth; Medical Information |
| Jul 31 | Everside Health | CA | Dec 2, 2025 | – | – |
| Jul 31 | The Moody Bible Institute of Chicago | OR | Jun 12 | 155,226 | – |
| Jul 30 | SM Energy Company | CA | May 15 | – | – |
| Jul 30 | Microcode, Inc. (CommonSpirit Health) | WA | Jan 19 | 4,096 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Passport Number; Medical Information |
| Jul 30 | SM Energy Company | OR | May 15 | 40,109 | – |
| Jul 29 | TransGlobal Insurance Agency | OR | Feb 19 | 71,597 | – |
| Jul 29 | Clinical Registry Solutions | CA | Apr 9 | – | – |
| Jul 28 | Sunrise Company | CA | Apr 23 | – | – |
| Jul 28 | Fresno County Department of Social Services | CA | Aug 26, 2025 | – | – |
| Jul 28 | ADT, Inc. | WA | Apr 20 | 5,129 | Name; Social Security Number; Full Date of Birth |
| Jul 28 | ADT, Inc. | OR | Apr 20 | 331,536 | – |
| Jul 27 | SPay Inc dba Stack Sports | WA | May 8 | 1,190 | Name; Financial & Banking Information |
| Jul 27 | JRK Property Holdings, Inc. | CA | Mar 26 | – | – |
| Jul 27 | Regional Center of Orange County | CA | May 27 | – | – |
| Jul 27 | SPay Inc dba Stack Sports | CA | May 8 | – | – |
| Jul 27 | JRK Property Holdings, Inc. | WA | Mar 26 | 5,667 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Military ID Number; Passport Number; Other |
| Jul 25 | CareCloud, Inc. | CA | Mar 10 | – | – |
| Jul 24 | CareCloud, Inc. | WA | Mar 10 | 20,706 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information |
| Jul 24 | Bridgeway Benefit Technologies LLC | WA | Mar 5 | 640 | Name; Social Security Number; Full Date of Birth; Other; Protected Health Information owned or licensed by a HIPAA covered entity |
| Jul 24 | The LINE Los Angeles | CA | Sep 25, 2025 | – | – |
| Jul 24 | Eyemart Express, LLC | WA | Feb 12 | 1,704 | Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Full Date of Birth; Passport Number; Health Insurance Policy or ID Number; Medical Information; Protected Health Information owned or licensed by a HIPAA covered entity |
| Jul 24 | Bridgeway Benefit Technologies LLC | OR | Mar 5 | 54,838 | – |
| Jul 24 | Bridgeway Benefit Technologies LLC | CA | Mar 5 | – | – |
| Jul 24 | Eyemart Express, LLC | CA | Feb 13 | – | – |
| Jul 23 | Safetyfirst Systems, LLC | WA | Jan 16 | 1,157 | Name; Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth |
| Jul 23 | Safetyfirst Systems, LLC | CA | Jan 16 | – | – |
| Jul 23 | The Moody Bible Institute of Chicago | CA | Jun 12 | – | – |
| Jul 23 | Safetyfirst Systems, LLC | OR | Jan 16 | 141,230 | – |
| Jul 23 | Devereux Foundation | CA | Nov 6, 2025 | – | – |
| Jul 23 | The Moody Bible Institute of Chicago | WA | Jun 12 | 8,955 | Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth |
| Jul 22 | LaserShip, Inc. dba OnTrac Final Mile | CA | Mar 20 | – | – |
| Jul 22 | Kootenai County, Idaho | WA | – | 746 | Name; Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information; Biometric Data |
| Jul 22 | The Lawson Roofing Co Inc. | CA | Apr 23 | – | – |
| Jul 21 | Unlimited Technology Systems, LLC | OR | Oct 2, 2025 | 3,836,316 | – |
| Jul 21 | Unlimited Technology Systems, LLC | CA | Oct 5, 2025 | – | – |
| Jul 21 | Xsolis, Inc. | CA | Jan 20 | – | – |
| Jul 21 | Unlimited Technology Systems, LLC | WA | Oct 5, 2025 | 724 | Name; Social Security Number; Driver's License or Washington ID Card Number; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information; Other; Protected Health Information owned or licensed by a HIPAA covered entity |
| Jul 20 | TransGlobal Insurance Agency, Inc. | CA | Feb 18 | – | – |
| Jul 17 | The Estée Lauder Companies (Oracle) | WA | Aug 9, 2025 | 2,110 | Name; Social Security Number; Financial & Banking Information; Full Date of Birth; Passport Number; Medical Information; Other |
| Jul 17 | ZenPatient, Inc. | CA | Dec 5, 2025 | – | – |
| Jul 17 | Quontic Bank Acquisition Corp. | CA | – | – | – |
| Jul 17 | The Estée Lauder Companies | CA | Aug 9, 2025 | – | – |
| Jul 17 | BAYADA Home Health Care, Inc. | CA | Mar 2 | – | – |
| Jul 17 | ZenPatient, Inc. | WA | Dec 5, 2025 | 651 | Name; Full Date of Birth; Passport Number; Medical Information |
| Jul 16 | DentaQuest LLC | OR | May 17 | 15,000,000 | – |
| Jul 16 | Fox Rothschild LLP | CA | May 21 | – | – |
How this tracker works
Every state requires organizations to notify residents of breaches of personal information, and some also require a copy of the notice to the attorney general, who publishes it. We read the public lists of California, Washington and Oregon twice a day and keep the last 13 months.
“Residents affected” counts only that state’s residents, not the breach’s total size. The same breach often appears in several states’ lists. A notice means an organization reported a breach; the notice itself, linked from each name where the state publishes it, explains what happened.