# Breach Census

> A global, entity-centred register of confirmed cyber attacks and data breaches, built from published regulator filings — US state attorneys general, HHS OCR, SEC EDGAR, ICO, CNIL, FCA/PRA — court records and company disclosures, with every confirmed incident backed by a citable source; leak-site claims are tracked separately and stay unverified until corroborated.

Corpus: 15,592 entities tracked; 23,193 confirmed incidents; 346 regulator actions; 34,183 unverified claims monitored. Data as of 2026-10-25.

This is the long-form file; https://breachcensus.com/llms.txt is the short map of the site.

## How confirmation works

claim < press < self_report < regulator < court — an incident is marked confirmed, and only then indexed, once at least one event reaches self_report, regulator or court; a bare claim or press report never confirms one on its own. Full ladder, per-source list and FAQ: https://breachcensus.com/methodology.

### The confirmation ladder

Breach Census is built from a claim→outcome lifecycle: every confirmed incident, cost figure and regulator action shown on the site carries a citation back to a source document, and a claim is never allowed to look the same as a confirmed fact.

Every incident-related fact on the site carries one of five confirmation levels, in ascending order of certainty:

1. **Claim** — someone or something (typically a ransomware group’s own leak site) says an organisation was compromised. Reproduced as posted, on the Threat groups page only, and never treated as fact.
2. **Press reported** — a news outlet reported the incident, but no self-report, regulator filing or court record has been found yet. Still not enough to confirm.
3. **Self report** — the organisation itself disclosed the incident (an SEC 8-K Item 1.05 filing, a state attorney general breach notification, a public statement). Confirms the incident.
4. **Regulator** — a data-protection or financial regulator (ICO, CNIL, FCA, PRA, a US state AG in an enforcement capacity) took or published an action tied to the incident. A filing on an official register, not a press release about one. Confirms the incident.
5. **Court** — a court record (via CourtListener/RECAP) ties litigation to the incident. Confirms the incident.

An incident’s confirmed flag is only true once at least one event on it reaches self-report, regulator or court. A bare claim or press report is not enough: the incident is forced to noindex, shown with an explicit “claimed victim (as posted), unverified” label, and the page is not allowed to use breach-asserting language (“was breached”, “suffered a breach”) against it.

### The claim-only rules

A handful of rules keep an unverified claim from ever looking like, or becoming, a confirmed breach:

- A leak-site claim never creates an organisation page on its own — see “How entities are resolved” below.
- No breach-asserting language is used against a claim-only or press-only incident; it is always labelled a claim, as posted, unverified.
- Threat groups and Vendors stay noindex by design while they hold only claim-derived material — they only become indexable once a confirmed incident actually backs them.
- Anyone named on a claim-only page has a right of reply — see Contact.

### Records affected vs. residents affected

“Records affected” on an organisation or incident page is the organisation’s own reported total for that incident. A US state breach notice (from any of the 10 state registers listed below) reports something narrower: residents of that one state who were notified — not the organisation’s total. That state-residents figure is kept in a separate field and is never added into records affected, so a national total is never quietly inflated by re-counting the same incident state by state.

### How entities are resolved

An organisation is only created or matched against a registry identifier — a US SEC Central Index Key (CIK), a UK Companies House number, or a Legal Entity Identifier (LEI) — or against a name that is globally unique across the register. Where a name match is ambiguous (more than one live candidate survives), it is refused rather than guessed, and the row is queued for manual review instead of being attached to the wrong organisation. This is also what keeps a leak-site claim from ever manufacturing a page: entity creation only happens through registry-id or globally-unique-name resolution, never from a claim alone.

### Freshness

Ingest jobs for each source run on a daily cron schedule. The totals on the weekly report are live and recomputed on every request; each Monday a frozen snapshot of that week’s totals is published and never changes again, so a past week’s report always matches what was true that week.

## Frequently asked questions

### Why is an organisation listed with no details?

Some incidents are confirmed by a single source document — a state attorney general notice or a regulator filing — that itself says little beyond an organisation name, a date and a headline figure. The page shows what the source shows; nothing is invented to fill it out.

### Why isn't a threat group's claim shown as a breach?

A ransomware or extortion group posting a victim on its own leak site is a claim, not a confirmation. Claims are reproduced on the Threat groups page as posted, labelled unverified, and never promote an incident to confirmed on their own — see the confirmation ladder below.

### How do I correct or remove an entry?

Email contact@breachcensus.com with the page URL, what is wrong, and a source for the correction. See the Contact page for the full right-of-reply process.

### What does 'confirmed' mean?

An incident's confirmed flag is only true when at least one event on it carries a self-report, regulator or court confirmation level — a bare claim or press report is not enough.

### Where does the data come from?

Public regulator filings, court records and company disclosures — HHS OCR, SEC EDGAR, US state attorneys general, the ICO, CNIL, the FCA and PRA, CourtListener, CISA KEV / NVD, and ransomware-group leak-site trackers. See the source list below.

### Can I use the data?

Yes. Derived signals, narratives and aggregates are CC BY 4.0 with attribution to breachcensus.com — see Developers for the free JSON and CSV endpoints and the full dataset export.

### Why does a company from a leak-site claim not get its own page?

A claim is never allowed to manufacture an organisation page on its own. An entity is only created by matching a registry identifier (SEC CIK, Companies House number, LEI) or a globally unique name — an unresolved or ambiguous name is refused, not guessed.

### Why aren't Massachusetts, Washington or other state figures in a national total?

A state attorney general notice counts residents of that state who were notified, not an organisation's total records affected. That state-residents figure is never summed into records_affected — the two are kept in separate fields so they are never mixed.

## Sources and coverage

### Source registers

Registers cited by confirmed incidents, each with the number of confirmed incidents citing it. An incident can cite several registers, so these counts overlap.

- [the Massachusetts Attorney General breach-notification register](https://breachcensus.com/source/state_ag_ma): 15,228 confirmed incidents
- [the California Attorney General breach-notification register](https://breachcensus.com/source/state_ag_ca): 4,953 confirmed incidents
- [the Washington State Attorney General breach-notification register](https://breachcensus.com/source/state_ag_wa): 1,665 confirmed incidents
- [the HHS OCR breach portal](https://breachcensus.com/source/hhs_ocr): 852 confirmed incidents
- [the Texas Attorney General breach-notification register](https://breachcensus.com/source/state_ag_tx): 748 confirmed incidents
- [the Delaware Attorney General data security breach database](https://breachcensus.com/source/state_ag_de): 498 confirmed incidents
- [the Vermont Attorney General breach-notification register](https://breachcensus.com/source/state_ag_vt): 471 confirmed incidents
- [the Iowa Attorney General security breach notification list](https://breachcensus.com/source/state_ag_ia): 348 confirmed incidents
- [the CourtListener federal court docket archive](https://breachcensus.com/source/courtlistener): 327 confirmed incidents
- [the Wisconsin DATCP data breach list](https://breachcensus.com/source/state_ag_wi): 230 confirmed incidents
- [the New Hampshire Attorney General breach-notification register](https://breachcensus.com/source/state_ag_nh): 131 confirmed incidents
- [an SEC 8-K filing](https://breachcensus.com/source/edgar_8k): 60 confirmed incidents
- [the Hawaii Office of Consumer Protection breach-notice list](https://breachcensus.com/source/state_ag_hi): 54 confirmed incidents
- [the ICO enforcement register](https://breachcensus.com/source/ico): 39 confirmed incidents
- [the FCA enforcement register](https://breachcensus.com/source/fca): 4 confirmed incidents
- [the PRA enforcement register](https://breachcensus.com/source/pra): 4 confirmed incidents

### How much is known

Share of the 23,193 confirmed, non-hidden incidents that carry each field.

- Records affected: 1,604 incidents with a value (6.9%)
- Data types: 5,495 incidents with a value (23.7%)
- Attack type: 2,429 incidents with a value (10.5%)

### State breach-notification registers

10 US states publish a breach-notification register that is ingested directly: each has its own statute, its own rule for whether and when a state office must be notified, and its own definition of what the published “affected” figure counts. This is the same data that backs the “What a <state> notice means” box shown on an incident card — one set of facts, not two that could drift apart.

- [California](https://breachcensus.com/state/ca): 5,360 notices on file. Cal. Civ. Code §1798.82. A copy of the notification must be sent to the Attorney General when a single breach requires notifying more than 500 California residents. Published counts: no affected-count is published on this register.
- [Delaware](https://breachcensus.com/state/de): 1,392 notices on file. 6 Del. C. §12B-102. Notice to the Attorney General is required when a breach affects more than 500 Delaware residents. Published counts: the count is Delaware residents only, not a total.
- [Hawaii](https://breachcensus.com/state/hi): 55 notices on file. HRS §487N-2. Notice to the Office of Consumer Protection is required when a breach affects 1,000 or more Hawaii residents. Published counts: the count is Hawaii residents only, not a total.
- [Iowa](https://breachcensus.com/state/ia): 348 notices on file. Iowa Code §715C.2. Notice to the Attorney General is required within five business days of notifying consumers, for a breach requiring notification to more than 500 Iowa residents. Published counts: no affected-count is published on this register.
- [Massachusetts](https://breachcensus.com/state/ma): 15,273 notices on file. M.G.L. c. 93H. Notice to the Attorney General is required for a breach affecting any number of Massachusetts residents' personal information -- the statute sets no minimum count. Published counts: the count is Massachusetts residents only, not a total.
- [New Hampshire](https://breachcensus.com/state/nh): 131 notices on file. RSA 359-C:20. Notification to the Attorney General is required. Published counts: the count is New Hampshire residents.
- [Texas](https://breachcensus.com/state/tx): 768 notices on file. Tex. Bus. & Com. Code §521.053. Notice to the Attorney General is required when a breach affects at least 250 Texas residents. Published counts: the published count is a total, not limited to Texas residents.
- [Vermont](https://breachcensus.com/state/vt): 472 notices on file. 9 V.S.A. §2435. Notification to the Attorney General is required. Published counts: the count is Vermont residents.
- [Washington](https://breachcensus.com/state/wa): 1,677 notices on file. RCW 19.255.010. Notice to the Attorney General is required when a breach affects more than 500 Washington residents. Published counts: the count is Washington residents only, not a total.
- [Wisconsin](https://breachcensus.com/state/wi): 230 notices on file. Wis. Stat. §134.98. No state agency must be notified. Affected individuals must be told within 45 days, and the national credit bureaus too when 1,000 or more people are notified; DATCP lists breaches reported to it or found to affect Wisconsin consumers. Published counts: the count is Wisconsin residents only when published, not a total; many notices do not include one.

## Incidents by year

### Confirmed incidents by year

Years are assigned by disclosure date, falling back to discovery, then occurrence date.

- [2026](https://breachcensus.com/year/2026): 3,138 confirmed incidents
- [2025](https://breachcensus.com/year/2025): 2,927 confirmed incidents
- [2024](https://breachcensus.com/year/2024): 2,640 confirmed incidents
- [2023](https://breachcensus.com/year/2023): 2,871 confirmed incidents
- [2022](https://breachcensus.com/year/2022): 2,457 confirmed incidents
- [2021](https://breachcensus.com/year/2021): 2,816 confirmed incidents
- [2020](https://breachcensus.com/year/2020): 2,517 confirmed incidents
- [2019](https://breachcensus.com/year/2019): 1,986 confirmed incidents
- [2018](https://breachcensus.com/year/2018): 326 confirmed incidents
- [2017](https://breachcensus.com/year/2017): 411 confirmed incidents
- [2016](https://breachcensus.com/year/2016): 289 confirmed incidents
- [2015](https://breachcensus.com/year/2015): 236 confirmed incidents
- [2014](https://breachcensus.com/year/2014): 214 confirmed incidents
- [2013](https://breachcensus.com/year/2013): 187 confirmed incidents
- [2012](https://breachcensus.com/year/2012): 135 confirmed incidents

### Regulator fines by year and currency

Totals are not summed across currencies.

- 2026, EUR: 5 actions, total 47,026,000 EUR
- 2026, GBP: 6 actions, total 16,213,990 GBP
- 2025, EUR: 21 actions, total 6,054,000 EUR
- 2025, GBP: 8 actions, total 18,732,283 GBP
- 2024, EUR: 14 actions, total 1,065,000 EUR
- 2024, GBP: 11 actions, total 1,887,500 GBP
- 2023, EUR: 13 actions, total 33,416,000 EUR
- 2023, GBP: 12 actions, total 24,756,020 GBP
- 2022, EUR: 8 actions, total 4,075,000 EUR
- 2022, GBP: 2 actions, total 56,750,000 GBP
- 2021, EUR: 7 actions, total 1,825,000 EUR
- 2020, EUR: 6 actions, total 2,679,000 EUR
- 2019, EUR: 3 actions, total 600,000 EUR
- 2019, GBP: 2 actions, total 2,665,100 GBP
- 2018, GBP: 1 action, total 16,400,000 GBP
- 2014, GBP: 1 action, total 14,000,000 GBP

### Median days from occurrence to disclosure

Every sector combined, by jurisdiction and the year the incident occurred, shown only where at least 10 confirmed incidents support the figure; n is the number of confirmed incidents behind it. The jurisdiction is the one the register reports: for a state notice it is the state whose residents were notified, not necessarily where the organisation is based; for an HHS breach-portal entry it is the state the portal lists for the organisation; an SEC filing carries US.

- US-CA, occurred 2023: median 153 days (n = 445)
- US-CA, occurred 2024: median 156 days (n = 374)
- US-CA, occurred 2020: median 152 days (n = 363)
- US-CA, occurred 2021: median 136 days (n = 363)
- US-TX, occurred 2025: median 200 days (n = 291)
- US-WA, occurred 2023: median 121 days (n = 280)
- US-CA, occurred 2022: median 147 days (n = 275)
- US-CA, occurred 2025: median 130 days (n = 257)
- US-CA, occurred 2017: median 68 days (n = 237)
- US-WA, occurred 2020: median 200.5 days (n = 222)
- US-CA, occurred 2019: median 155 days (n = 221)
- US-WA, occurred 2024: median 160.5 days (n = 220)
- US-CA, occurred 2016: median 93 days (n = 217)
- US-CA, occurred 2018: median 131 days (n = 213)
- US-CA, occurred 2014: median 92 days (n = 169)
- US-TX, occurred 2026: median 77 days (n = 165)
- US-CA, occurred 2015: median 79 days (n = 153)
- US-WA, occurred 2021: median 137 days (n = 153)
- US-WA, occurred 2025: median 137 days (n = 140)
- US-CA, occurred 2013: median 70.5 days (n = 136)
- US-CA, occurred 2026: median 72 days (n = 131)
- US-WA, occurred 2022: median 119 days (n = 121)
- US-CA, occurred 2012: median 56.5 days (n = 114)
- US-WA, occurred 2016: median 272 days (n = 69)
- US-WA, occurred 2019: median 162 days (n = 62)
- US-WA, occurred 2026: median 80 days (n = 60)
- US-DE, occurred 2023: median 108 days (n = 59)
- US-WA, occurred 2017: median 171.5 days (n = 54)
- US-WA, occurred 2018: median 159 days (n = 43)
- US-DE, occurred 2024: median 118 days (n = 39)
- US-TX, occurred 2024: median 439 days (n = 38)
- US-WI, occurred 2017: median 30 days (n = 37)
- US-DE, occurred 2020: median 143 days (n = 35)
- US-DE, occurred 2022: median 100 days (n = 30)
- US-DE, occurred 2021: median 182 days (n = 29)
- US-CA, occurred 2011: median 417 days (n = 25)
- US-WA, occurred 2015: median 230.5 days (n = 22)
- US-WI, occurred 2016: median 28 days (n = 19)
- US-DE, occurred 2025: median 131 days (n = 17)
- US-DE, occurred 2019: median 88.5 days (n = 16)
- US-WI, occurred 2014: median 53 days (n = 15)
- US-WI, occurred 2013: median 27 days (n = 13)
- US-WI, occurred 2018: median 114 days (n = 13)
- US-WI, occurred 2021: median 52 days (n = 11)

## Sectors

Only sectors with at least one confirmed incident are listed.

- [Education](https://breachcensus.com/sector/education): 6 confirmed incidents; 3 organisations. Education covers schools, universities, school districts and the ed-tech vendors that process student and staff records on their behalf.
- [Energy](https://breachcensus.com/sector/energy): 12 confirmed incidents; 10 organisations. Energy covers utilities, grid operators, and oil and gas companies, along with the vendors that run their industrial control systems.
- [Finance](https://breachcensus.com/sector/finance): 103 confirmed incidents; 45 organisations. Finance covers banks, credit unions, broker-dealers, payment processors and other lenders, along with the fintech vendors that handle money movement on their behalf.
- [Healthcare](https://breachcensus.com/sector/healthcare): 1,212 confirmed incidents; 853 organisations. Healthcare covers hospitals, clinics, insurers and the vendors and business associates that process patient records on their behalf, and the data at risk is protected health information: diagnoses, treatment history, insurance and billing detail.
- [Hospitality](https://breachcensus.com/sector/hospitality): 19 confirmed incidents; 8 organisations. Hospitality covers hotels, restaurants, and travel and events companies that hold guest reservation, loyalty-program and payment-card data, often collected through a mix of the operator's own systems and third-party booking platforms.
- [Insurance](https://breachcensus.com/sector/insurance): 65 confirmed incidents; 19 organisations. Insurance covers carriers, brokers and claims administrators holding policyholder, applicant and claims data, which can include health, financial and, for life and health lines, medical underwriting detail.
- [Manufacturing](https://breachcensus.com/sector/manufacturing): 81 confirmed incidents; 54 organisations. Manufacturing covers producers of physical goods and the operational-technology vendors that run their plants, and typically holds employee, supplier and customer records rather than large consumer databases, though an incident can also touch product-design or industrial-control data.
- [Media](https://breachcensus.com/sector/media): 10 confirmed incidents; 6 organisations. Media covers publishers, broadcasters and platforms that hold subscriber, advertiser and, increasingly, source and contributor data.
- [Nonprofit](https://breachcensus.com/sector/nonprofit): 1 confirmed incident; 1 organisation. Nonprofit covers charities, foundations and membership organizations holding donor, member and, for service-delivery charities, client records, which can include payment-card details from fundraising and event registration alongside the same kind of case data a service-delivery charity's staff hold on the people it serves.
- [Other](https://breachcensus.com/sector/other): 1 confirmed incident; 1 organisation. Other is a catch-all for an organization whose activity does not fit any of the site's named sector labels.
- [Pharma](https://breachcensus.com/sector/pharma): 33 confirmed incidents; 20 organisations. Pharma covers pharmaceutical and biotech companies, which hold employee, clinical-trial participant and, for companies that also run patient-support programs, patient data -- but most are not themselves a HIPAA covered entity, since HIPAA's notification duty attaches to health plans, providers and clearinghouses rather than to a drug manufacturer.
- [Professional Services](https://breachcensus.com/sector/professional-services): 61 confirmed incidents; 31 organisations. Professional Services covers accounting, consulting and other advisory firms holding client financial, tax and business records as part of an engagement.
- [Real Estate](https://breachcensus.com/sector/real-estate): 20 confirmed incidents; 14 organisations. Real Estate covers brokerages, title and escrow companies, appraisers and mortgage lenders, which routinely hold Social Security numbers, bank account details and other data needed to close a property transaction.
- [Retail](https://breachcensus.com/sector/retail): 69 confirmed incidents; 41 organisations. Retail covers stores and e-commerce merchants holding customer order, loyalty and payment-card data.
- [Technology](https://breachcensus.com/sector/technology): 95 confirmed incidents; 50 organisations. Technology covers software, cloud and IT-services vendors, which hold both their own employee and customer data and, as processors, the data of the businesses they serve.
- [Telecoms](https://breachcensus.com/sector/telecoms): 11 confirmed incidents; 6 organisations. Telecoms covers carriers, ISPs and communications providers, which hold customer proprietary network information: call records, billing data and account credentials.
- [Transport](https://breachcensus.com/sector/transport): 19 confirmed incidents; 9 organisations. Transport covers airlines, railways, shipping and logistics companies holding passenger, employee and cargo-tracking data, and can also hold payment-card and loyalty-program information collected at the point of booking.

## Countries

Only countries with at least one confirmed incident are listed.

- [United States of America](https://breachcensus.com/country/us): 23,144 confirmed incidents; 15,544 organisations
- [United Kingdom](https://breachcensus.com/country/gb): 47 confirmed incidents; 46 organisations
- [Canada](https://breachcensus.com/country/ca): 1 confirmed incident; 1 organisation
- [India](https://breachcensus.com/country/in): 1 confirmed incident; 1 organisation

## Attack types

Only attack types with at least one confirmed incident are listed.

- [Data Interception](https://breachcensus.com/attack-type/data-interception): 19 confirmed incidents. Data interception covers an attack that captures data while it is moving between two parties, rather than reading it off a system it is stored on.
- [Hacking/IT Incident](https://breachcensus.com/attack-type/hacking-it-incident): 1,017 confirmed incidents. Hacking/IT incident is a regulator reporting category, not a MITRE ATT&CK technique: it is the label the HHS Office for Civil Rights breach portal and similar state breach-notification forms use when a reporting organization checks the general "hacking incident" box without specifying the technique involved.
- [Improper Disposal](https://breachcensus.com/attack-type/improper-disposal): 1 confirmed incident. Improper disposal is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used on the HHS Office for Civil Rights breach portal and similar state breach-notification forms when personal data was exposed by disposing of records, paper files, hard drives or backup tapes, without properly destroying or sanitizing them first.
- [Malware Deployment](https://breachcensus.com/attack-type/malware-deployment): 224 confirmed incidents. Malware deployment covers an incident where malicious software was installed on a victim's systems, most often to steal data, enable further access or set up a later ransomware attack.
- [Phishing Attack](https://breachcensus.com/attack-type/phishing): 112 confirmed incidents. Phishing covers a social-engineering attack delivered by email, text message or a similar channel that tries to get the recipient to click a malicious link, open an attachment or hand over information directly.
- [Ransomware Attack](https://breachcensus.com/attack-type/ransomware): 586 confirmed incidents. Ransomware covers an attack that encrypts a victim's files and demands payment for the decryption key, frequently combined with a threat to publish stolen data if the ransom is not paid.
- [Social Engineering](https://breachcensus.com/attack-type/social-engineering): 2 confirmed incidents. Social engineering covers an attack that manipulates a person, rather than a system, into taking an action that leads to exposure, impersonating a colleague or vendor by phone, for example, to get a password reset or a wire transfer approved.
- [Theft](https://breachcensus.com/attack-type/theft): 5 confirmed incidents. Theft is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used on the HHS Office for Civil Rights breach portal and similar state breach-notification forms for an incident where a physical item carrying personal data, a laptop, phone, paper file or storage device, was stolen.
- [Unauthorized Access/Disclosure](https://breachcensus.com/attack-type/unauthorized-access): 463 confirmed incidents. Unauthorized access/disclosure is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used on the HHS Office for Civil Rights breach portal and similar state breach-notification forms for an incident where someone not authorized to see or use certain data did so, including a case where an authorized user accessed or sent data beyond what their role permitted, with no external attacker involved at all.

## Data types

Categories of personal data reported as involved. An incident can report several, so these counts overlap.

- [Social Security number](https://breachcensus.com/data-type/ssn): 4,261 confirmed incidents
- [Bank account or payment card number](https://breachcensus.com/data-type/financial-account): 2,049 confirmed incidents
- [Driver's license number](https://breachcensus.com/data-type/drivers-license): 1,885 confirmed incidents
- [Medical information](https://breachcensus.com/data-type/medical): 1,417 confirmed incidents
- [Credit or debit card number](https://breachcensus.com/data-type/credit-debit): 1,017 confirmed incidents
- [Full name](https://breachcensus.com/data-type/name): 836 confirmed incidents
- [Home or mailing address](https://breachcensus.com/data-type/address): 414 confirmed incidents
- [Date of birth](https://breachcensus.com/data-type/dob): 410 confirmed incidents
- [Passport or government ID number](https://breachcensus.com/data-type/government-id): 369 confirmed incidents
- [Health insurance information](https://breachcensus.com/data-type/health-insurance): 323 confirmed incidents
- [Other reported data type](https://breachcensus.com/data-type/other): 126 confirmed incidents

## Regulators

Only regulators with at least one published enforcement action on file are listed.

- [Information Commissioner's Office](https://breachcensus.com/regulator/ico): 228 published enforcement actions (GB)
- [Commission Nationale de l'Informatique et des Libertes](https://breachcensus.com/regulator/cnil): 110 published enforcement actions (FR)
- [Financial Conduct Authority](https://breachcensus.com/regulator/fca): 4 published enforcement actions (GB)
- [Prudential Regulation Authority](https://breachcensus.com/regulator/pra): 4 published enforcement actions (GB)

## Glossary

### Data types

- [ssn](https://breachcensus.com/data-type/ssn): A US Social Security number.
- [financial-account](https://breachcensus.com/data-type/financial-account): A bank account or payment card number.
- [drivers-license](https://breachcensus.com/data-type/drivers-license): A driver’s license (or equivalent) number.
- [government-id](https://breachcensus.com/data-type/government-id): A passport or other government-issued identity document number.
- [medical](https://breachcensus.com/data-type/medical): Medical records or treatment information.
- [health-insurance](https://breachcensus.com/data-type/health-insurance): Health insurance policy or claims information.
- address: A home or mailing address.
- dob: Date of birth.
- name: A full name.
- other: A data type reported by the source that does not map to one of the categories above.

### Confirmation levels

The five confirmation levels, in ascending order of certainty.

- Claim: A ransomware group’s own leak-site listing. Reproduced as posted, never treated as fact.
- Press reported: A news outlet reported the incident, with no self-report, regulator filing or court record yet.
- Self report: The organisation itself disclosed the incident. Confirms the incident.
- Regulator: A data-protection or financial regulator took or published an action tied to the incident. Confirms the incident.
- Court: A court record ties litigation to the incident. Confirms the incident.

## Largest confirmed incidents

The largest confirmed incidents on file, ranked by records affected as reported by the source (the same ranking as https://breachcensus.com/largest). Each line is one incident as filed with one register, so an organisation can appear more than once, and one event notified to several registers appears once per register. The jurisdiction is the one the site shows for the incident: for a state notice it is the state whose residents were notified, not necessarily where the organisation is based; for an HHS breach-portal entry it is the state the portal lists for the organisation; an SEC filing carries US. Only organisations with an indexed page on the site are listed.

1. [Change Healthcare Inc.](https://breachcensus.com/org/change-healthcare-inc): records affected 192,700,000; disclosed October 14, 2025; jurisdiction US-TX
2. [Conduent Business Services, LLC (revised submission)](https://breachcensus.com/org/conduent-business-services-llc-revised-submission-new-jersey): records affected 62,486,662; disclosed May 20, 2026; jurisdiction US-TX
3. [Conduent Business Services LLC](https://breachcensus.com/org/conduent-business-services-llc-nj): records affected 62,224,658; disclosed October 8, 2025; jurisdiction US-NJ
4. [DriveWealth](https://breachcensus.com/org/drivewealth): records affected 30,000,000; disclosed September 30, 2026; jurisdiction US-CA
5. [Aflac Incorporated](https://breachcensus.com/org/aflac-incorporated): records affected 22,653,844; disclosed December 22, 2025; jurisdiction US-TX
6. [Cerner Corporation](https://breachcensus.com/org/cerner-corporation): records affected 18,565,730; disclosed July 25, 2025; jurisdiction US-WA
7. [DentaQuest, LLC](https://breachcensus.com/org/dentaquest-llc-ma): records affected 15,000,000; disclosed July 16, 2026; jurisdiction US-MA
8. [DentaQuest, LLC](https://breachcensus.com/org/dentaquest-llc-ma): records affected 15,000,000; disclosed July 16, 2026; jurisdiction US-WA
9. [Aflac Incorporated (“Aflac”)](https://breachcensus.com/org/aflac-incorporated-aflac-ga): records affected 13,924,906; disclosed August 8, 2025; jurisdiction US-GA
10. [Prosper Marketplace, Inc](https://breachcensus.com/org/prosper-marketplace-inc): records affected 13,076,476; disclosed December 10, 2025; jurisdiction US-TX
11. [IDScan.net](https://breachcensus.com/org/idscan-net): records affected 13,000,000; disclosed September 21, 2026; jurisdiction US-TX
12. [Aesto, LLC](https://breachcensus.com/org/aesto-llc): records affected 9,540,683; disclosed July 31, 2026; jurisdiction US-AL
13. [iRhythm Technologies Inc.](https://breachcensus.com/org/irhythm-technologies-inc-california): records affected 8,179,772; disclosed October 6, 2026; jurisdiction US-TX
14. [AssuranceAmerica Managing General Agency, LLC](https://breachcensus.com/org/assuranceamerica-managing-general-agency-llc): records affected 6,998,886; disclosed June 17, 2026; jurisdiction US-WA
15. [TriZetto Provider Solutions](https://breachcensus.com/org/trizetto-provider-solutions-mo): records affected 6,974,232; disclosed February 6, 2026; jurisdiction US-WA
16. [Episource, LLC](https://breachcensus.com/org/episource-llc-ca): records affected 6,725,572; disclosed June 6, 2025; jurisdiction US-CA
17. [Episource, LLC](https://breachcensus.com/org/episource-llc-ca): records affected 6,725,572; disclosed June 6, 2025; jurisdiction US-WA
18. [Carnival Corporation](https://breachcensus.com/org/carnival-corporation): records affected 5,995,277; disclosed May 27, 2026; jurisdiction US-CA
19. [700Credit, LLC](https://breachcensus.com/org/700credit-llc): records affected 5,836,521; disclosed December 16, 2025; jurisdiction US-TX
20. [TransUnion LLC](https://breachcensus.com/org/transunion-llc-illinois): records affected 4,461,511; disclosed September 4, 2025; jurisdiction US-TX
21. [Heights Finance Holdings Co.](https://breachcensus.com/org/heights-finance-holdings-co-south-carolina): records affected 4,132,834; disclosed August 14, 2026; jurisdiction US-TX
22. [AdaptHealth Corp.](https://breachcensus.com/org/adapthealth-corp): records affected 4,115,802; disclosed July 2, 2026; jurisdiction US
23. [AdaptHealth Corp.](https://breachcensus.com/org/adapthealth-corp): records affected 4,115,802; disclosed August 14, 2026; jurisdiction US-CA
24. [Unlimited Technology Systems, LLC](https://breachcensus.com/org/unlimited-technology-systems-llc-oh): records affected 3,836,316; disclosed July 21, 2026; jurisdiction US-WA
25. [Medtronic Inc.](https://breachcensus.com/org/medtronic-inc): records affected 3,834,294; disclosed June 29, 2026; jurisdiction US-WA
26. [Unlimited Technology Systems, LLC](https://breachcensus.com/org/unlimited-technology-systems-llc-oh): records affected 3,803,750; disclosed July 21, 2026; jurisdiction US-OH
27. [CareCloud, Inc.](https://breachcensus.com/org/carecloud-inc): records affected 3,756,469; disclosed July 24, 2026; jurisdiction US-NJ
28. [CareCloud, Inc.](https://breachcensus.com/org/carecloud-inc): records affected 3,756,469; disclosed August 18, 2026; jurisdiction US-TX
29. [University of Phoenix, Inc.](https://breachcensus.com/org/university-of-phoenix-inc): records affected 3,489,274; disclosed December 21, 2025; jurisdiction US-WA
30. [TriZetto Provider Solutions](https://breachcensus.com/org/trizetto-provider-solutions-mo): records affected 3,433,965; disclosed February 6, 2026; jurisdiction US-MO
31. [Texas Parks and Wildlife](https://breachcensus.com/org/texas-parks-and-wildlife-texas): records affected 3,187,000; disclosed June 26, 2026; jurisdiction US-TX
32. [QualDerm Partners, LLC](https://breachcensus.com/org/qualderm-partners-llc-tn): records affected 3,117,874; disclosed February 22, 2026; jurisdiction US-TN
33. [QualDerm Partners, LLC](https://breachcensus.com/org/qualderm-partners-llc-tn): records affected 3,117,874; disclosed February 23, 2026; jurisdiction US-WA
34. [Columbia University](https://breachcensus.com/org/columbia-university): records affected 3,067,242; disclosed August 7, 2025; jurisdiction US-WA
35. [PIH Health, Inc.](https://breachcensus.com/org/pih-health-inc-ca): records affected 2,947,264; disclosed January 31, 2025; jurisdiction US-CA
36. [Baylor Genetics](https://breachcensus.com/org/baylor-genetics): records affected 2,810,878; disclosed August 18, 2026; jurisdiction US-TX
37. [Baylor Genetics](https://breachcensus.com/org/baylor-genetics): records affected 2,810,878; disclosed August 14, 2026; jurisdiction US-TX
38. [Navia Benefit Solutions, Inc.](https://breachcensus.com/org/navia-benefit-solutions-inc-wa): records affected 2,697,540; disclosed March 18, 2026; jurisdiction US-WA
39. [DaVita Inc.](https://breachcensus.com/org/davita-inc-co): records affected 2,689,826; disclosed August 1, 2025; jurisdiction US-CO
40. [Veradigm LLC](https://breachcensus.com/org/veradigm-llc-il): records affected 2,672,036; disclosed September 22, 2025; jurisdiction US-IL
41. [Veradigm LLC](https://breachcensus.com/org/veradigm-llc-il): records affected 2,672,036; disclosed December 2, 2025; jurisdiction US-WA
42. [Xsolis, Inc.](https://breachcensus.com/org/xsolis-inc-tn): records affected 2,523,302; disclosed June 19, 2026; jurisdiction US-WA
43. [Nacogdoches Memorial Hospital n](https://breachcensus.com/org/nacogdoches-memorial-hospital-n-tx): records affected 2,507,073; disclosed March 30, 2026; jurisdiction US-TX
44. [Navia Benefit Solutions, Inc.](https://breachcensus.com/org/navia-benefit-solutions-inc-wa): records affected 2,151,330; disclosed March 18, 2026; jurisdiction US-WA
45. [Insightin Health, Inc.](https://breachcensus.com/org/insightin-health-inc-md): records affected 1,949,534; disclosed January 16, 2026; jurisdiction US-MD
46. [Anne Arundel Dermatology](https://breachcensus.com/org/anne-arundel-dermatology-md): records affected 1,905,000; disclosed July 11, 2025; jurisdiction US-MD
47. [Summit Pathology and Summit Pathology Laboratories, Inc.](https://breachcensus.com/org/summit-pathology-and-summit-pathology-laboratories-inc-co): records affected 1,813,538; disclosed October 18, 2024; jurisdiction US-CO
48. [New York City Health and Hospitals Corporation](https://breachcensus.com/org/new-york-city-health-and-hospitals-corporation-ny): records affected 1,800,000; disclosed March 24, 2026; jurisdiction US-NY
49. [Insightin Health, Inc.](https://breachcensus.com/org/insightin-health-inc-md): records affected 1,777,141; disclosed March 10, 2026; jurisdiction US-TX
50. [Kettering Adventist Healthcare](https://breachcensus.com/org/kettering-adventist-healthcare-oh): records affected 1,695,382; disclosed July 21, 2025; jurisdiction US-OH
51. [CenterPoint Energy, Inc.](https://breachcensus.com/org/centerpoint-energy-inc-texas): records affected 1,611,625; disclosed October 13, 2026; jurisdiction US-TX
52. [Strategic Education Inc.](https://breachcensus.com/org/strategic-education-inc): records affected 1,513,518; disclosed June 1, 2026; jurisdiction US-WA
53. [The Phia Group](https://breachcensus.com/org/the-phia-group): records affected 1,512,742; disclosed January 30, 2026; jurisdiction US-WA
54. [Allianz Life Insurance Company of North America](https://breachcensus.com/org/allianz-life-insurance-company-of-north-america): records affected 1,497,036; disclosed July 25, 2025; jurisdiction US-WA
55. [Radiology Associates of Richmond, Inc.](https://breachcensus.com/org/radiology-associates-of-richmond-inc-va): records affected 1,419,091; disclosed July 1, 2025; jurisdiction US-VA
56. [Kaplan North America, LLC](https://breachcensus.com/org/kaplan-north-america-llc): records affected 1,403,060; disclosed March 17, 2026; jurisdiction US-WA
57. [Xsolis, Inc.](https://breachcensus.com/org/xsolis-inc-tn): records affected 1,396,519; disclosed June 5, 2026; jurisdiction US-TN
58. [Everside Health](https://breachcensus.com/org/everside-health): records affected 1,389,758; disclosed July 31, 2026; jurisdiction US-WA
59. [PIH Health, Inc.](https://breachcensus.com/org/pih-health-inc-ca): records affected 1,369,533; disclosed March 3, 2026; jurisdiction US-TX
60. [DermCare Management](https://breachcensus.com/org/dermcare-management-fl): records affected 1,367,176; disclosed April 10, 2026; jurisdiction US-TX
61. [DermCare Management](https://breachcensus.com/org/dermcare-management-fl): records affected 1,361,735; disclosed May 2, 2025; jurisdiction US-FL
62. [SimonMed Imaging](https://breachcensus.com/org/simonmed-imaging-arizona): records affected 1,275,669; disclosed October 14, 2025; jurisdiction US-TX
63. [MCBS, LLC](https://breachcensus.com/org/mcbs-llc-ga): records affected 1,261,464; disclosed June 26, 2026; jurisdiction US-GA
64. [Citizens Bank](https://breachcensus.com/org/citizens-bank): records affected 1,260,000; disclosed October 19, 2026; jurisdiction US-CA
65. [MCBS, LLC](https://breachcensus.com/org/mcbs-llc-ga): records affected 1,241,154; disclosed June 26, 2026; jurisdiction US-CA
66. [Absolute Dental Group, LLC](https://breachcensus.com/org/absolute-dental-group-llc-nv): records affected 1,223,635; disclosed May 2, 2025; jurisdiction US-NV
67. [WestJet](https://breachcensus.com/org/westjet): records affected 1,200,000; disclosed October 3, 2025; jurisdiction US-WA
68. [Palomar Health](https://breachcensus.com/org/palomar-health): records affected 1,140,221; disclosed June 21, 2023; jurisdiction US-CA
69. [Southeast Series of Lockton Companies, LLC (Lockton)](https://breachcensus.com/org/southeast-series-of-lockton-companies-llc-lockton-ga): records affected 1,124,727; disclosed February 28, 2025; jurisdiction US-GA
70. [Farmers Insurance Exchange, Farmers Group, Inc. (its attorney-in fact), and their subsidiaries and affiliates](https://breachcensus.com/org/farmers-insurance-exchange-farmers-group-inc-its-attorney-in-fact-and-their-subs-california): records affected 1,071,300; disclosed December 9, 2025; jurisdiction US-TX
71. [Community Health Center, Inc.](https://breachcensus.com/org/community-health-center-inc-ct): records affected 1,060,936; disclosed January 30, 2025; jurisdiction US-CT
72. [Paradigm Healthcare Services](https://breachcensus.com/org/paradigm-healthcare-services-ca): records affected 970,403; disclosed September 14, 2026; jurisdiction US-CA
73. [Paradigm Healthcare Services](https://breachcensus.com/org/paradigm-healthcare-services): records affected 970,000; disclosed September 14, 2026; jurisdiction US-CA
74. [Frederick Health](https://breachcensus.com/org/frederick-health-md): records affected 934,326; disclosed March 28, 2025; jurisdiction US-MD
75. [Wilmer Cutler Pickering Hale and Dorr LLP](https://breachcensus.com/org/wilmer-cutler-pickering-hale-and-dorr-llp): records affected 911,658; disclosed July 15, 2026; jurisdiction US-WA
76. [ATSG, Inc](https://breachcensus.com/org/atsg-inc-ny): records affected 909,469; disclosed October 4, 2024; jurisdiction US-NY
77. [Texas Tech University Health Sciences Center El Paso](https://breachcensus.com/org/texas-tech-university-health-sciences-center-el-paso-tx): records affected 815,000; disclosed November 25, 2024; jurisdiction US-TX
78. [Texas Tech University Health Sciences Center](https://breachcensus.com/org/texas-tech-university-health-sciences-center-tx): records affected 813,892; disclosed April 9, 2026; jurisdiction US-WA
79. [Motility Software Solutions](https://breachcensus.com/org/motility-software-solutions): records affected 767,562; disclosed October 23, 2026; jurisdiction US-TX
80. [Motility Software Solutions Inc](https://breachcensus.com/org/motility-software-solutions-inc): records affected 766,670; disclosed September 30, 2025; jurisdiction US-WA
81. [McLaren Health Care](https://breachcensus.com/org/mclaren-health-care-mi): records affected 743,131; disclosed June 24, 2025; jurisdiction US-MI
82. [OpenLoop Health, Inc.](https://breachcensus.com/org/openloop-health-inc-ia): records affected 716,000; disclosed March 17, 2026; jurisdiction US-IA
83. [Medusind Inc.](https://breachcensus.com/org/medusind-inc-fl): records affected 701,475; disclosed January 7, 2025; jurisdiction US-FL
84. [People's Community Clinic](https://breachcensus.com/org/people-s-community-clinic-texas): records affected 700,000; disclosed December 19, 2025; jurisdiction US-TX
85. [American First Finance LLC](https://breachcensus.com/org/american-first-finance-llc): records affected 689,000; disclosed September 12, 2025; jurisdiction US-WA
86. [SitusAMC Holdings Corporation](https://breachcensus.com/org/situsamc-holdings-corporation): records affected 662,701; disclosed February 20, 2026; jurisdiction US-WA
87. [Texas Tech University Health Sciences Center](https://breachcensus.com/org/texas-tech-university-health-sciences-center-tx): records affected 650,000; disclosed November 25, 2024; jurisdiction US-TX
88. [Call-on-Doc](https://breachcensus.com/org/call-on-doc-texas): records affected 648,535; disclosed September 21, 2026; jurisdiction US-TX
89. [Quantum Health, Inc.](https://breachcensus.com/org/quantum-health-inc-ohio): records affected 625,945; disclosed August 18, 2026; jurisdiction US-TX
90. [Washington Gastroenterology](https://breachcensus.com/org/washington-gastroenterology-wa): records affected 583,741; disclosed August 22, 2025; jurisdiction US-MA
91. [Erie Family Health Centers](https://breachcensus.com/org/erie-family-health-centers-il): records affected 570,000; disclosed March 27, 2026; jurisdiction US-IL
92. [AssetMark, Inc.](https://breachcensus.com/org/assetmark-inc): records affected 570,000; disclosed June 11, 2026; jurisdiction US-WA
93. [Kelly & Associates Insurance Group, Inc.](https://breachcensus.com/org/kelly-associates-insurance-group-inc-md): records affected 553,332; disclosed April 9, 2025; jurisdiction US-MD
94. [BAYADA Home Health Care, Inc.](https://breachcensus.com/org/bayada-home-health-care-inc-nj): records affected 550,164; disclosed July 21, 2026; jurisdiction US-TX
95. [Centers Lab NJ LLC](https://breachcensus.com/org/centers-lab-nj-llc-nj): records affected 542,377; disclosed June 18, 2026; jurisdiction US-NJ
96. [IMA Diligence Services, LLC](https://breachcensus.com/org/ima-diligence-services-llc): records affected 525,306; disclosed June 1, 2026; jurisdiction US-TX
97. [AssuranceAmerica Managing General Agency, LLC](https://breachcensus.com/org/assuranceamerica-managing-general-agency-llc): records affected 489,825; disclosed October 16, 2026; jurisdiction US-TX
98. [Covenant Health, Inc.](https://breachcensus.com/org/covenant-health-inc-massachusetts): records affected 478,188; disclosed January 5, 2026; jurisdiction US-TX
99. [Goshen Medical Center](https://breachcensus.com/org/goshen-medical-center-north-carolina): records affected 456,385; disclosed September 18, 2025; jurisdiction US-TX
100. [Allied Health MSO Holdco, LLC](https://breachcensus.com/org/allied-health-mso-holdco-llc-new-jersey): records affected 447,304; disclosed August 25, 2026; jurisdiction US-TX

## Recently disclosed

Up to 100 confirmed incidents from the last 90 days, newest first, sorted and windowed by disclosure date, falling back to discovery, then occurrence date (the full list is at https://breachcensus.com/recent). Each line is one incident as filed with one register, so an organisation can appear more than once, and one event notified to several registers appears once per register. The jurisdiction is the one the site shows for the incident: for a state notice it is the state whose residents were notified, not necessarily where the organisation is based; for an HHS breach-portal entry it is the state the portal lists for the organisation; an SEC filing carries US. Only organisations with an indexed page on the site are listed.

- [EyeMed Vision Care LLC](https://breachcensus.com/org/eyemed-vision-care-llc): dated October 23, 2026; jurisdiction US-VT
- [Stitch Connect Inc](https://breachcensus.com/org/stitch-connect-inc-california): dated October 23, 2026; jurisdiction US-VT
- [Photon Health](https://breachcensus.com/org/photon-health-new-york): records affected 3,085; dated October 23, 2026; jurisdiction US-TX
- [Region 9 Education Service Center](https://breachcensus.com/org/region-9-education-service-center-texas): records affected 259; dated October 23, 2026; jurisdiction US-TX
- [East Chambers Independent School District (Breach was through Frontline Education)](https://breachcensus.com/org/east-chambers-independent-school-district-breach-was-through-frontline-education-texas): records affected 801; dated October 23, 2026; jurisdiction US-TX
- [Motility Software Solutions](https://breachcensus.com/org/motility-software-solutions): records affected 767,562; dated October 23, 2026; jurisdiction US-TX
- [Sherman Independent School District](https://breachcensus.com/org/sherman-independent-school-district-texas): records affected 8,493; dated October 23, 2026; jurisdiction US-TX
- [Opportune LLP](https://breachcensus.com/org/opportune-llp): dated October 22, 2026; jurisdiction US-VT
- [Motility Software Solutions](https://breachcensus.com/org/motility-software-solutions): dated October 22, 2026; jurisdiction US-NH
- [DentaQuest, LLC](https://breachcensus.com/org/dentaquest-llc-ma): dated October 22, 2026; jurisdiction US-NH
- [Dill Dill Carr Stonbraker & Hutchings, P.C.](https://breachcensus.com/org/dill-dill-carr-stonbraker-hutchings-p-c): records affected 33,613; dated October 22, 2026; jurisdiction US-CA
- [Dorsata, Inc.](https://breachcensus.com/org/dorsata-inc): records affected 58,246; dated October 21, 2026; jurisdiction US-CA
- [Ohio Living](https://breachcensus.com/org/ohio-living-oh): dated October 21, 2026; jurisdiction US-VT
- [Networking Technology, Inc.](https://breachcensus.com/org/networking-technology-inc-nc): dated October 20, 2026; jurisdiction US-VT
- [CSX](https://breachcensus.com/org/csx): dated October 20, 2026; jurisdiction US-NH
- [Chevy Chase Club](https://breachcensus.com/org/chevy-chase-club): dated October 20, 2026; jurisdiction US-VT
- [Hardi Jefferson ISD](https://breachcensus.com/org/hardi-jefferson-isd-texas): records affected 426; dated October 20, 2026; jurisdiction US-TX
- [Toyo Tire Holdings of Americas Inc.](https://breachcensus.com/org/toyo-tire-holdings-of-americas-inc): records affected 17,707; dated October 20, 2026; jurisdiction US-TX
- [Computer Task Group, Incorporated](https://breachcensus.com/org/computer-task-group-incorporated): records affected 11,962; dated October 20, 2026; jurisdiction US-TX
- [Heritage Pediatrics PLLC](https://breachcensus.com/org/heritage-pediatrics-pllc-texas): records affected 3,318; dated October 20, 2026; jurisdiction US-TX
- [Alma Family Services](https://breachcensus.com/org/alma-family-services-ca): dated October 19, 2026; jurisdiction US-CA
- [EnTrans Holding, Inc.](https://breachcensus.com/org/entrans-holding-inc-tennessee): dated October 19, 2026; jurisdiction US-NH
- [fairlife, LLC](https://breachcensus.com/org/fairlife-llc): dated October 19, 2026; jurisdiction US-NH
- [American Board of Preventive Medicine](https://breachcensus.com/org/american-board-of-preventive-medicine): dated October 19, 2026; jurisdiction US-NH
- [Chevy Chase Club](https://breachcensus.com/org/chevy-chase-club): dated October 19, 2026; jurisdiction US-NH
- [Computer Task Group, Incorporated](https://breachcensus.com/org/computer-task-group-incorporated): dated October 19, 2026; jurisdiction US-VT
- [Citizens Bank](https://breachcensus.com/org/citizens-bank): records affected 1,260,000; dated October 19, 2026; jurisdiction US-CA
- [STS Aviation Group, LLC](https://breachcensus.com/org/sts-aviation-group-llc): records affected 54,027; dated October 19, 2026; jurisdiction US-CA
- [Stitch Connect Inc](https://breachcensus.com/org/stitch-connect-inc-california): dated October 18, 2026; jurisdiction US-CA
- [Taft Stettinius & Hollister LLP](https://breachcensus.com/org/taft-stettinius-hollister-llp): dated October 16, 2026; jurisdiction US-NH
- [BBC International LLC](https://breachcensus.com/org/bbc-international-llc): dated October 16, 2026; jurisdiction US-VT
- [Johnson Investment Counsel](https://breachcensus.com/org/johnson-investment-counsel): dated October 16, 2026; jurisdiction US-VT
- [Delek US Energy, Inc.](https://breachcensus.com/org/delek-us-energy-inc-tennessee): records affected 2,566; dated October 16, 2026; jurisdiction US-TX
- [Stitch Connect Inc](https://breachcensus.com/org/stitch-connect-inc-california): records affected 113,727; dated October 16, 2026; jurisdiction US-TX
- [The Krum Public Library](https://breachcensus.com/org/the-krum-public-library-texas): records affected 36,360; dated October 16, 2026; jurisdiction US-TX
- [Mountrail County Medical Center](https://breachcensus.com/org/mountrail-county-medical-center-north-dakota): records affected 24,447; dated October 16, 2026; jurisdiction US-TX
- [Klein Independent School District](https://breachcensus.com/org/klein-independent-school-district-texas): records affected 37,966; dated October 16, 2026; jurisdiction US-TX
- [AssuranceAmerica Managing General Agency, LLC](https://breachcensus.com/org/assuranceamerica-managing-general-agency-llc): records affected 489,825; dated October 16, 2026; jurisdiction US-TX
- [Encore Enterprises](https://breachcensus.com/org/encore-enterprises-texas): records affected 4,488; dated October 16, 2026; jurisdiction US-TX
- [JM Bullion, Inc.](https://breachcensus.com/org/jm-bullion-inc): records affected 78,451; dated October 16, 2026; jurisdiction US-TX
- [The Legal Aid Society](https://breachcensus.com/org/the-legal-aid-society): dated October 15, 2026; jurisdiction US-NH
- [Hood River Dental](https://breachcensus.com/org/hood-river-dental): dated October 15, 2026; jurisdiction US-NH
- [fairlife, LLC](https://breachcensus.com/org/fairlife-llc): dated October 15, 2026; jurisdiction US-VT
- [MLD Mortgage Inc. dba The Money Store](https://breachcensus.com/org/mld-mortgage-inc-dba-the-money-store): records affected 45,561; dated October 15, 2026; jurisdiction US-CA
- [Local Government Data Unit - Wales](https://breachcensus.com/org/local-government-data-unit-wales): dated October 14, 2026; jurisdiction GB
- [Ogi Networks Limited](https://breachcensus.com/org/ogi-networks-limited): dated October 14, 2026; jurisdiction GB
- [American Board of Preventative Medicine](https://breachcensus.com/org/american-board-of-preventative-medicine): dated October 14, 2026; jurisdiction US-VT
- [Minnesota Epilepsy Group, P.A.](https://breachcensus.com/org/minnesota-epilepsy-group-p-a-mn): dated October 14, 2026; jurisdiction US-MA
- [Encore Enterprises](https://breachcensus.com/org/encore-enterprises-texas): dated October 14, 2026; jurisdiction US-MA
- [Iroquois Memorial Hospital](https://breachcensus.com/org/iroquois-memorial-hospital-illinois): dated October 14, 2026; jurisdiction US-MA
- [Webster Five Cents Savings Bank](https://breachcensus.com/org/webster-five-cents-savings-bank): dated October 14, 2026; jurisdiction US-MA
- [Mountrail County Medical Center](https://breachcensus.com/org/mountrail-county-medical-center-north-dakota): dated October 14, 2026; jurisdiction US-MA
- [The Village Bank](https://breachcensus.com/org/the-village-bank): dated October 13, 2026; jurisdiction US-MA
- [Citibank, N.A.](https://breachcensus.com/org/citibank-n-a): dated October 13, 2026; jurisdiction US-MA
- [Eastern Bank](https://breachcensus.com/org/eastern-bank): dated October 13, 2026; jurisdiction US-MA
- [American Board of Preventive Medicine](https://breachcensus.com/org/american-board-of-preventive-medicine): records affected 23,692; dated October 13, 2026; jurisdiction US-CA
- [JM Bullion, Inc.](https://breachcensus.com/org/jm-bullion-inc): dated October 13, 2026; jurisdiction US-CA
- [Magna Hospitality Group](https://breachcensus.com/org/magna-hospitality-group): records affected 25,623; dated October 13, 2026; jurisdiction US-CA
- [Porter and Company](https://breachcensus.com/org/porter-and-company): records affected 18,728; dated October 13, 2026; jurisdiction US-CA
- [zizzl llc](https://breachcensus.com/org/zizzl-llc): records affected 6,447; dated October 13, 2026; jurisdiction US-TX
- [CenterPoint Energy, Inc.](https://breachcensus.com/org/centerpoint-energy-inc-texas): records affected 1,611,625; dated October 13, 2026; jurisdiction US-TX
- [Mercadien PC Certified Public Accountants](https://breachcensus.com/org/mercadien-pc-certified-public-accountants-new-jersey): dated October 13, 2026; jurisdiction US-TX
- [EnTrans Holding, Inc.](https://breachcensus.com/org/entrans-holding-inc-tennessee): records affected 3,311; dated October 13, 2026; jurisdiction US-TX
- [Arkansas Hospice Inc. dba LifeTouch Health](https://breachcensus.com/org/arkansas-hospice-inc-dba-lifetouch-health-arkansas): records affected 38,629; dated October 13, 2026; jurisdiction US-TX
- [Park Dental Partners, Inc.](https://breachcensus.com/org/park-dental-partners-inc): dated October 13, 2026; jurisdiction US
- [JM Bozeman Enterprises](https://breachcensus.com/org/jm-bozeman-enterprises-arkansas): records affected 3,211; dated October 12, 2026; jurisdiction US-TX
- [Squire Patton Boggs (US) LLP](https://breachcensus.com/org/squire-patton-boggs-us-llp): records affected 3,824; dated October 12, 2026; jurisdiction US-TX
- [Austin Independent School District](https://breachcensus.com/org/austin-independent-school-district-texas): records affected 44,652; dated October 12, 2026; jurisdiction US-TX
- [Terrell Independent School District](https://breachcensus.com/org/terrell-independent-school-district-texas): records affected 1,672; dated October 12, 2026; jurisdiction US-TX
- [Blueberry Pediatrics](https://breachcensus.com/org/blueberry-pediatrics): records affected 340,915; dated October 10, 2026; jurisdiction US-CA
- [Blueberry Pediatrics](https://breachcensus.com/org/blueberry-pediatrics): records affected 47,381; dated October 10, 2026; jurisdiction US-CA
- [Heuer Publishing](https://breachcensus.com/org/heuer-publishing): dated October 9, 2026; jurisdiction US-MA
- [zizzl llc](https://breachcensus.com/org/zizzl-llc): dated October 9, 2026; jurisdiction US-VT
- [Squire Patton Boggs (US) LLP](https://breachcensus.com/org/squire-patton-boggs-us-llp): dated October 9, 2026; jurisdiction US-MA
- [National Insurance Company](https://breachcensus.com/org/national-insurance-company): dated October 9, 2026; jurisdiction US-MA
- [BBC International LLC](https://breachcensus.com/org/bbc-international-llc): dated October 9, 2026; jurisdiction US-MA
- [Hood River Dental](https://breachcensus.com/org/hood-river-dental): dated October 8, 2026; jurisdiction US-MA
- [The Legal Aid Society](https://breachcensus.com/org/the-legal-aid-society): dated October 8, 2026; jurisdiction US-MA
- [EOVS - Veterans Home at Chelsea](https://breachcensus.com/org/eovs-veterans-home-at-chelsea): dated October 8, 2026; jurisdiction US-MA
- [Johnson Investment Counsel](https://breachcensus.com/org/johnson-investment-counsel): dated October 8, 2026; jurisdiction US-MA
- [The Village Bank](https://breachcensus.com/org/the-village-bank): dated October 8, 2026; jurisdiction US-MA
- [Squire Patton Boggs (US) LLP](https://breachcensus.com/org/squire-patton-boggs-us-llp): dated October 8, 2026; jurisdiction US-VT
- [Home, Hope and Healing, Inc.](https://breachcensus.com/org/home-hope-and-healing-inc-me): dated October 8, 2026; jurisdiction US-VT
- [National Life Insurance Company](https://breachcensus.com/org/national-life-insurance-company): dated October 8, 2026; jurisdiction US-VT
- [Winona County](https://breachcensus.com/org/winona-county): dated October 8, 2026; jurisdiction US-VT
- [The Village Bank](https://breachcensus.com/org/the-village-bank): dated October 7, 2026; jurisdiction US-MA
- [Rockland Trust](https://breachcensus.com/org/rockland-trust): dated October 7, 2026; jurisdiction US-MA
- [Hasbro Inc.](https://breachcensus.com/org/hasbro-inc): dated October 7, 2026; jurisdiction US-VT
- [The Village Bank](https://breachcensus.com/org/the-village-bank): dated October 6, 2026; jurisdiction US-MA
- [Fall River Municipal Credit Union](https://breachcensus.com/org/fall-river-municipal-credit-union): dated October 6, 2026; jurisdiction US-MA
- [Department of Revenue](https://breachcensus.com/org/department-of-revenue): dated October 6, 2026; jurisdiction US-MA
- [Community Teamwork, Inc.](https://breachcensus.com/org/community-teamwork-inc): dated October 6, 2026; jurisdiction US-MA
- [Morgan Services, Inc.](https://breachcensus.com/org/morgan-services-inc): dated October 6, 2026; jurisdiction US-MA
- [Penquis CAP](https://breachcensus.com/org/penquis-cap): dated October 6, 2026; jurisdiction US-VT
- [Capitol Pain Institute](https://breachcensus.com/org/capitol-pain-institute-co): records affected 666; dated October 6, 2026; jurisdiction US-TX
- [iRhythm Technologies Inc.](https://breachcensus.com/org/irhythm-technologies-inc-california): records affected 8,179,772; dated October 6, 2026; jurisdiction US-TX
- [Healthcare Highways, LLC](https://breachcensus.com/org/healthcare-highways-llc-texas): records affected 30,017; dated October 6, 2026; jurisdiction US-TX
- [Flowco Holdings Inc.](https://breachcensus.com/org/flowco-holdings-inc-texas): records affected 2,477; dated October 6, 2026; jurisdiction US-TX
- [Edgewood ISD](https://breachcensus.com/org/edgewood-isd-texas): records affected 3,000; dated October 6, 2026; jurisdiction US-TX
- [Cleburne Independent School District](https://breachcensus.com/org/cleburne-independent-school-district-texas): records affected 3,187; dated October 6, 2026; jurisdiction US-TX

## API

- https://breachcensus.com/api/register: paginated JSON entity register, filterable by country and sector.
- https://breachcensus.com/api/register.csv: the same register, unpaginated, as a CSV download (capped at 50,000 rows).
- https://breachcensus.com/api/org/{slug}: one organisation — identity, incidents, event timeline, regulator actions, litigation summary.
- https://breachcensus.com/api/incident/{id}: one incident — facts, its organisation, event timeline, regulator actions.
- https://breachcensus.com/api/health: health check, 200 with { ok: true, db: true } when the database is reachable, 503 otherwise.
- All endpoints are free, open-CORS GET requests — see https://breachcensus.com/developers for full documentation.
- Licence: Derived signals, narratives and aggregates: CC BY 4.0 with attribution to breachcensus.com. Underlying regulator filings, court records and disclosures remain the property of their original publishers.
- Dataset description and export notes: https://breachcensus.com/developers

## Pages

- [Home](https://breachcensus.com/): What Breach Census is, headline figures, and how incident confirmation works.
- [Organisations](https://breachcensus.com/org): Directory of every tracked organisation, paginated, with a confirmed-incident count and its own page per entity.
- [Sectors](https://breachcensus.com/sector): Confirmed incident and organisation counts by sector, with a page per sector and per sector-year.
- [Countries](https://breachcensus.com/country): Organisation and confirmed-incident counts by country, with a page per country.
- [Years](https://breachcensus.com/year): Confirmed incidents by year, with fines, sector breakdowns and top jurisdictions per year.
- [Attack types](https://breachcensus.com/attack-type): Confirmed incidents by attack type (MITRE ATT&CK / VERIS mapped), with a page per type.
- [Regulators](https://breachcensus.com/regulator): Data protection and financial regulators tracked, with published enforcement-action counts and a page per regulator.
- [States](https://breachcensus.com/state): US state breach-notification registers ingested on Breach Census, with a notice count and page per state.
- [Litigation](https://breachcensus.com/litigation): Incidents matched to exactly one CourtListener court docket, each linking to the filing.
- [Data types](https://breachcensus.com/data-type): Confirmed incidents by the type of personal data reported involved, with a definition, guidance and page per type.
- [Sources](https://breachcensus.com/source): The regulator filings, court records and other registers Breach Census cites, with a confirmed-incident count and page per register.
- [Statistics](https://breachcensus.com/stats): Year-by-year totals, disclosure delays and fines across all confirmed incidents on file.
- [Was I affected?](https://breachcensus.com/was-i-affected): Lookup and general guidance for confirmed incidents that meet a records-affected or regulator-action threshold.
- [Largest breaches](https://breachcensus.com/largest): The 100 largest confirmed incidents on file, ranked by total records affected as reported by the source.
- [Recently disclosed](https://breachcensus.com/recent): Confirmed incidents from the last 90 days, newest first.
- [Glossary](https://breachcensus.com/glossary): Plain-language definitions of the attack types, data types, regulators and confirmation levels used across the site.
- [Weekly report](https://breachcensus.com/report): Live current totals plus an archive of frozen weekly snapshot pages, one per published ISO week.
- [Developers](https://breachcensus.com/developers): Free JSON and CSV API endpoints and a full dataset export, with licence terms.
- [About](https://breachcensus.com/about): What Breach Census is, who runs it, and links to the methodology and developer docs.
- [Methodology](https://breachcensus.com/methodology): The confirmation ladder, the claim-only rules, source list and a visible FAQ.
- [Contact](https://breachcensus.com/contact): Contact address and the right-of-reply and correction process.
- [Privacy](https://breachcensus.com/privacy): How the site handles personal data — no accounts, no forms, hosting logs only.
- [Terms](https://breachcensus.com/terms): Terms of use: read-only site, no warranties, and the data licence.

## Unverified / empty surfaces (linked, not indexed)

- [Threat groups](https://breachcensus.com/group) (reason: claim-only): Ransomware/extortion group leak-site claims, reproduced as posted — unverified, noindex by design.
- [Vendors](https://breachcensus.com/vendor) (reason: empty): Vendor blast-radius pages — no incident_vendor_link rows yet, noindex by design until populated.

## Machine-readable

- [Short map of the site (llms.txt)](https://breachcensus.com/llms.txt)
- [Sitemap](https://breachcensus.com/sitemap.xml)
- [Atom feed of recently disclosed incidents](https://breachcensus.com/feed.xml)

[AI usage policy](https://breachcensus.com/ai.txt)