SQ Magazine The Threat Index Data Breach Tracker

Data Breach Tracker

This tracker records breaches where a regulator register or the organization itself published the disclosure, from January 2024 onward. Each row gives the organization, the disclosure date, how many people were affected, and the attack vector. Coverage follows what those registers publish, so it is a record of disclosure rather than a complete census of incidents.

26 records newest disclosure 13 Aug 2026 last verified 8 Oct 2026

Current through 13 Aug 2026. Records disclosed since then are not yet listed.

Breaches tracked: 26
At least affected · 10 disclosed counts: 79,596,881
Sectors: 7
Re-verify cycle: 30day

At a glance

Largest by individuals affected: Coupang 33,000,000 individuals
Most recent disclosure: RingCentral 13 Aug 2026

All records

26 breaches, newest disclosure first. Filter or search below.

How to use this tracker

Search & filter
Filter by sector, vector or month, or use the search box to find a specific breach.
Explore the data
Sort by newest first, oldest first, most records or A to Z.
Inspect records
Select Detail on any row to open its full record, then copy a link that opens that row directly.
Verify sources
Every row links the primary source it came from, most often sec.gov.

Organization	Disclosed	Records (as disclosed)	Sector	Vector	Our report
RingCentral	13 Aug 2026	1,596,490 records in Have I Been Pwned not a confirmed disclosure figure	not available	Phishing	Have I Been Pwned
What was exposed Names Email addresses Postal addresses Phone numbers Disclosed via Company statement only Occurred → disclosed 27 Jul 2026 → 13 Aug 2026 17-day gap Attributed to ShinyHunters (claimed) Primary source Have I Been Pwned ↗ Last confirmed 14 Aug 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 14 Aug 2026. RingCentral confirmed that a social-engineering campaign led to unauthorized access to data of a limited portion of its customers in July 2026; the company is notifying affected customers directly and has published no affected count, so the confirmed-count cell stays empty. The 1,596,490 figure is the unique-email corpus Have I Been Pwned indexed on 13 Aug 2026 from data the ShinyHunters extortion group leaked, alleging roughly 623 GB taken; corpus counts are not confirmed disclosure figures and are recorded in the corpus column only. Exposed categories per the leaked corpus: names, email addresses, physical addresses, phone numbers. Vector recorded as phishing on the company own description of a social-engineering campaign.
Amgen INC	31 Jul 2026	Undisclosed	not available	Unknown	SEC EDGAR (Form 8-K, Item 1.05)
What was exposed Medical records Disclosed via SEC Form 8-K Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 14 Aug 2026 against the Form 8-K and press coverage. Amgen identified unauthorized activity in cloud storage environments hosted by external service providers in July 2026, determined on 29 Jul that the incident was material, and filed the 8-K on 31 Jul. Exfiltrated material includes patient protected health information and proprietary company data; the proprietary loss has no token in the exposed vocabulary and is recorded here instead. Amgen has published no affected-individuals count, so that cell stays empty, and no intrusion method or attribution, so the vector stays unknown. The company states it does not expect impact on financial position, products or manufacturing. Investigation ongoing; revisit for a count when notifications or an OCR entry appear.
Unlimited Technology Systems, LLC	21 Jul 2026	3,803,750	Healthcare	Third-party / supply chain	HHS Office for Civil Rights breach portal
What was exposed Names Dates of birth Social Security numbers Medical records Disclosed via HHS OCR breach portal Discovered 19 Oct 2025 14-day dwell Occurred → disclosed 5 Oct 2025 → 21 Jul 2026 289-day gap Country United States Primary source HHS Office for Civil Rights breach portal ↗ Last confirmed 14 Aug 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 14 Aug 2026 against the HHS OCR portal entry and press coverage. Unlimited Technology Systems, an Ohio revenue cycle management vendor processing billing for over 4,500 oncology practices and 6,500 specialty providers, reported 3,803,750 individuals to OCR on 21 Jul 2026. The intrusion ran 5 to 10 Oct 2025 and was identified that October; disclosure followed nine months later, the second-largest US healthcare breach reported in 2026 behind DentaQuest. Stolen data includes names, birthdates, Social Security numbers, driver license scans, and medical and health-insurance information; driver licenses have no separate token and ride under the note. No public attribution, and the intrusion method is not described, so the vector stays unknown.
DentaQuest, LLC	16 Jul 2026	15,000,000	Healthcare	Unknown	HHS Office for Civil Rights breach portal
What was exposed Names Postal addresses Social Security numbers Medical records Disclosed via HHS OCR breach portal Occurred → disclosed 17 May 2026 → 16 Jul 2026 60-day gap Country United States Attributed to ShinyHunters (claimed) Primary source HHS Office for Civil Rights breach portal ↗ Last confirmed 14 Aug 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 14 Aug 2026 against the HHS OCR portal entry and press coverage of the company notices. DentaQuest, the second-largest US dental benefits administrator, reported 15,000,000 individuals to OCR on 16 Jul 2026 after unauthorized access to its systems between 17 and 20 May 2026; notification letters began 17 Jul. The recorded figure is the OCR-submitted count. HIPAA Journal aggregates state filings to a potentially higher 23.4 million, and state attorney-general filings in Texas, Massachusetts and South Carolina cover at least 4.5 million between them; the column keeps the figure DentaQuest itself submitted. The ShinyHunters extortion group claimed the theft and reportedly leaked about 234 GB; DentaQuest did not describe the intrusion method, so the vector stays unknown. Exposed categories per the notices: names, addresses, Social Security numbers, member and Medicaid or Medicare identifiers, and dental or vision treatment and billing information.
Navient	2 Jul 2026	Undisclosed	Finance & banking	Ransomware	SEC EDGAR (Form 8-K, Item 1.05)
What was exposed Names Postal addresses Dates of birth Social Security numbers Disclosed via SEC Form 8-K Discovered 8 Jun 2026 Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 2026-07-23 via primary sources (Navient SEC 8-K). Ransomware attack against a third-party law firm that provides services to Navient; Navient became aware 2026-06-08 and determined materiality 2026-06-29. Borrower data exposed via the firm included names, dates of birth, addresses and Social Security numbers. No evidence of access to Navient own systems. Individual count not stated in the filing. Originally ingested from SEC EDGAR Item 1.05.
AdaptHealth	2 Jul 2026	Undisclosed	Healthcare	Phishing	SEC EDGAR (Form 8-K, Item 1.05)
What was exposed Medical records Credentials / passwords Disclosed via SEC Form 8-K Discovered 15 Jun 2026 Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 2026-07-23 via primary sources (AdaptHealth SEC 8-K). Threat actor contacted the company 2026-06-15; materiality determined 2026-06-27. Attacker compromised a third-party contractor user session via social engineering and accessed cloud-based patient-management systems and document storage, exfiltrating stored password files tied to insurance-billing and external EHR portals containing patient PHI. Volume at risk not quantified. Large US home-medical-equipment provider. Originally ingested from SEC EDGAR Item 1.05.
MCBS, LLC	26 Jun 2026	1,261,464	Healthcare	Third-party / supply chain	HHS Office for Civil Rights breach portal
What was exposed Names Postal addresses Dates of birth Social Security numbers Medical records Disclosed via HHS OCR breach portal Occurred → disclosed 22 Sep 2025 → 26 Jun 2026 277-day gap Country United States Attributed to PEAR (claimed) Primary source HHS Office for Civil Rights breach portal ↗ Last confirmed 14 Aug 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 14 Aug 2026 against the HHS OCR portal entry and press coverage. Medical Computer Business Services, an Augusta, Georgia medical billing and practice-management vendor, reported 1,261,464 individuals to OCR after an intrusion between 22 and 26 Sep 2025; the investigation concluded in late May 2026 and the OCR entry followed on 26 Jun. Potentially stolen files held names, addresses, birthdates, Social Security numbers, and health-insurance and medical information. The extortion group PEAR claimed the intrusion and alleges 3.3 TB taken; the company did not describe the method, so the vector stays unknown.
Xsolis	5 Jun 2026	1,396,519	Healthcare	Phishing	HHS Office for Civil Rights breach portal
What was exposed Names Dates of birth Social Security numbers Medical records Disclosed via HHS OCR breach portal Discovered 22 Jan 2026 2-day dwell Occurred → disclosed 20 Jan 2026 → 5 Jun 2026 136-day gap Country United States Primary source HHS Office for Civil Rights breach portal ↗ Last confirmed 23 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 2026-07-23 via HHS OCR (1,396,519) plus multiple outlets citing the Xsolis notice. Tennessee healthcare-AI vendor (HIPAA business associate) breached via a targeted phishing email to a single employee; unauthorized access 2026-01-20 to 2026-01-22. Exposed names, dates of birth, Social Security numbers, health-insurance and medical-treatment information for 1,396,519 individuals across seven-to-eight hospital systems including Mayo Clinic. HHS OCR posted the figure 2026-06-22; breach report dated 2026-06-05. One of the largest US healthcare incidents of the year. Originally ingested from the HHS OCR breach portal.
West Pharmaceutical Services	11 May 2026	Undisclosed	Healthcare	Ransomware	SEC EDGAR (Form 8-K, Item 1.05)
Disclosed via SEC Form 8-K Discovered 4 May 2026 Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 23 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 2026-07-23 via primary sources (West SEC 8-K and 8-K/A). Detected a compromise 2026-05-04; determined material 2026-05-07. Ransomware: data exfiltrated and systems encrypted; company took systems offline globally and engaged Palo Alto Unit 42. Scope of affected data still under investigation; individual count not disclosed. S&P 500 pharmaceutical-packaging and drug-delivery supplier. Fold of 8-K/A 27890 (2026-05-20, operations restored). Originally ingested from SEC EDGAR Item 1.05.
Stryker	9 Apr 2026	Undisclosed	Healthcare	Unknown	Iran Linked Hackers Claim Massive Attack on Stryker
Disclosed via SEC Form 8-K Discovered 11 Mar 2026 0-day dwell Occurred → disclosed 11 Mar 2026 → 9 Apr 2026 29-day gap Country United States Attributed to Handala (Iran-linked hacktivist group) Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 23 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 23 Jul 2026 against primary sources: Stryker's SEC Form 8-K/A and its customer notice. Identified 11 March 2026 and attributed to Handala, an Iran-linked hacktivist group, which weaponized Stryker's Microsoft Intune device-management platform to wipe data from thousands of devices in a destructive attack. It disrupted order processing, manufacturing and shipping, with a material impact on first-quarter 2026 results but none to full-year guidance; the 8-K/A was filed 9 April 2026. No affected-individuals count is recorded because exfiltration of personal data remains unconfirmed: the attackers claim data theft, the company has not confirmed it, and class-action litigation is ongoing. The record will be updated if that resolves.
Nacogdoches Memorial Hospital	30 Mar 2026	2,507,073	Healthcare	Unknown	HHS OCR Breach Portal (Cases Currently Under Investigation)
What was exposed Names Email addresses Postal addresses Phone numbers Dates of birth Social Security numbers Medical records Disclosed via HHS OCR breach portal Discovered 31 Jan 2026 16-day dwell Occurred → disclosed 15 Jan 2026 → 30 Mar 2026 74-day gap Country United States Primary source HHS OCR Breach Portal (Cases Currently Under Investigation) ↗ Last confirmed 24 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 24 Jul 2026 against the HHS OCR breach portal, which lists Nacogdoches Memorial Hospital, healthcare provider (TX), 2,507,073 individuals, hacking/IT incident on a network server, submitted 30 March 2026. Counts differ by roughly ten times across sources: the hospital's own messaging and early trade press cite about 250,000 to 257,073 individuals, while the figure filed with HHS OCR is 2,507,073. This table uses the regulator filing and states the gap rather than choosing quietly between them. Unauthorized network access ran 15 to 31 January 2026, was discovered on 31 January, and consumer notifications began 31 March. Data involved: names, addresses, phone numbers, email addresses, Social Security numbers, dates of birth, medical record and account numbers, health plan beneficiary numbers and photographs. No group claimed responsibility and the threat actor was not disclosed.
NYC Health + Hospitals	24 Mar 2026	Undisclosed	Healthcare	Third-party / supply chain	NYC Health + Hospitals - Notice of Data Breach (official)
What was exposed Names Postal addresses Medical records Financial account data Social Security numbers Government ID numbers Biometric data Disclosed via Company statement only Discovered 2 Feb 2026 69-day dwell Occurred → disclosed 25 Nov 2025 → 24 Mar 2026 119-day gap Country United States Primary source NYC Health + Hospitals - Notice of Data Breach (official) ↗ Last confirmed 24 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 24 Jul 2026. No affected-individuals count is published: the HHS OCR portal shows no exact figure for this incident, and every source describes it as approximately, up to, or at least 1.8 million current and former patients and employees. The count is therefore left blank rather than estimated from an approximation. A separate, unrelated NYC Health + Hospitals entry of 5,728 individuals submitted 6 June 2025 appears on the same portal and is a different, much smaller incident. Per the official notice of data breach, an unauthorized third party exploited a flaw at an unnamed third-party vendor and had access from 25 November 2025 to 11 February 2026; suspicious activity was discovered on 2 February 2026. Data involved: demographic, medical, insurance and billing information, Social Security numbers, government identification numbers, and biometric data including fingerprints and palm prints.
Navia Benefit Solutions	18 Mar 2026	2,151,330	Healthcare		2.7 Million Affected in Navia Cyberattack Linked to API Flaw
What was exposed Names Postal addresses Phone numbers Email addresses Social Security numbers Dates of birth Disclosed via HHS OCR breach portal Discovered 23 Jan 2026 32-day dwell Occurred → disclosed 22 Dec 2025 → 18 Mar 2026 86-day gap Country United States Primary source HHS OCR Breach Portal (Cases Currently Under Investigation) ↗ Last confirmed 24 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 24 Jul 2026 against the HHS OCR breach portal, which lists Navia Benefit Solutions, Inc., business associate (WA), 2,151,330 individuals, hacking/IT incident on a network server, submitted 18 March 2026. Sources disagree on the count: much of the press reports roughly 2.7 million, while 2,151,330 is the protected-health-information count Navia itself filed with HHS OCR, and that filing is what this table records. Navia administers employee health and benefits plans as a HIPAA business associate. Unauthorized access ran 22 December 2025 to 15 January 2026 and suspicious activity was identified around 23 January. Data involved: names, Navia identification numbers, addresses, phone numbers, email addresses, enrollment dates, employee identifiers, Social Security numbers and dates of birth. The intrusion vector was not disclosed.
QualDerm Partners	22 Feb 2026	3,117,874	Healthcare	Unknown	HHS OCR Breach Portal (Cases Currently Under Investigation)
What was exposed Names Email addresses Postal addresses Dates of birth Government ID numbers Medical records Disclosed via HHS OCR breach portal Discovered 24 Dec 2025 1-day dwell Occurred → disclosed 23 Dec 2025 → 22 Feb 2026 61-day gap Country United States Primary source HHS OCR Breach Portal (Cases Currently Under Investigation) ↗ Last confirmed 24 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 24 Jul 2026 against the HHS OCR breach portal, which lists QualDerm Partners, LLC, healthcare provider (TN), 3,117,874 individuals, hacking/IT incident on a network server, submitted 22 February 2026 — matching the company notice exactly. QualDerm is a dermatology practice group. An unauthorized actor accessed a limited number of systems over roughly two days, 23 to 24 December 2025; the incident was discovered on 24 December and notification letters were mailed from 22 February 2026. Data involved: names, addresses, dates of birth, email addresses, medical record numbers, treating-physician names, treatment and diagnosis information, health insurance information, dates of death, and in some cases government-issued identification. No group claimed the attack and the vector was not disclosed.
TriZetto Provider Solutions	6 Feb 2026	3,433,965	Healthcare	Unknown	HHS OCR Breach Portal (Cases Currently Under Investigation)
What was exposed Names Postal addresses Dates of birth Social Security numbers Medical records Disclosed via HHS OCR breach portal Discovered 2 Oct 2025 317-day dwell Occurred → disclosed 19 Nov 2024 → 6 Feb 2026 444-day gap Country United States Primary source HHS OCR Breach Portal (Cases Currently Under Investigation) ↗ Last confirmed 24 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 24 Jul 2026 against the HHS OCR breach portal, which lists TriZetto Provider Solutions, business associate (MO), 3,433,965 individuals, hacking/IT incident on a network server, submitted 6 February 2026 — matching the figure in the company notice exactly. TriZetto is Cognizant's revenue-cycle and clearinghouse subsidiary. An unauthorized third party first accessed historical eligibility transaction reports in November 2024; only the month is stated in the notice, so no exact incident date is recorded. Suspicious activity was identified in a customer web portal on 2 October 2025, healthcare-client notifications began 9 December 2025, and consumer notifications in early February 2026. Data involved: names, addresses, dates of birth, Social Security numbers, health insurance and Medicare beneficiary numbers, and provider and insurer details. The company states no financial information was involved. The intrusion vector was not disclosed.
Coupang	16 Dec 2025	33,000,000	Retail & e-commerce	Insider	Coupang Faces Backlash Over $1.1 Billion Data Breach Payout in Vouchers
What was exposed Names Email addresses Postal addresses Phone numbers Disclosed via SEC Form 8-K Discovered 18 Nov 2025 Country South Korea Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 23 Jul 2026 against Coupang's SEC Form 8-K. Coupang became aware on 18 November 2025. A former employee may have obtained names, phone numbers, delivery addresses and email addresses associated with up to 33 million customer accounts, plus order histories for a subset. No banking, payment-card or login credentials were compromised. The count recorded is the up-to-33-million figure the company itself stated; later Korean forensic reporting indicated data from roughly 3,000 accounts was actually stored, and both are noted here rather than one being chosen silently.
F5	15 Oct 2025	Undisclosed	Technology	Unknown	SEC EDGAR (Form 8-K, Item 1.05)
Disclosed via SEC Form 8-K Discovered 9 Aug 2025 Country United States Attributed to Nation-state threat actor (unnamed by F5; public reporting links to China) Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 2026-07-23 via primary sources (F5 SEC 8-K + CISA ED-26-01). Nation-state actor held persistent access for an extended period; F5 became aware 2025-08-09 and disclosed 2025-10-15 after a DOJ-authorized delay. Stolen: portions of BIG-IP source code, undisclosed vulnerability research, and limited customer configuration data. CISA issued Emergency Directive ED-26-01 ordering federal agencies to patch or disconnect F5 devices. No consumer PII record count stated. Systemic security-vendor supply-chain event. Originally ingested from SEC EDGAR Item 1.05.
Jaguar Land Rover	2 Sep 2025	Undisclosed	Other	Unknown	Jaguar Land Rover Faces Massive £540 Million Blow from Unprecedented Cyberattack
Disclosed via Company statement only Occurred → disclosed 31 Aug 2025 → 2 Sep 2025 2-day gap Country United Kingdom Attributed to Scattered Lapsus$ Hunters / Scattered Spider (claimed) Primary source Jaguar Land Rover - Statement on Cyber Incident (official) ↗ Last confirmed 24 Jul 2026Past this tracker’s re-check cycle Revision Record count revised. Verified 24 Jul 2026 against Jaguar Land Rover's own statements and UK official bodies. No affected-individuals count is recorded: JLR confirmed data theft but never published one, and the stolen material was an internal employee dataset alongside source code and development logs rather than a defined set of consumer records. Personal-data categories are likewise left empty because JLR did not enumerate them; third-party analysis of attacker-claimed data describes employee usernames, email addresses, display names and time zones. The attack began 31 August 2025; JLR took systems offline and disclosed publicly on 2 September, initially stating no evidence of customer data theft, then confirmed on 10 September that some data had been affected, and notified the ICO and the NCSC. The UK Cyber Monitoring Centre rated this a Category 3 systemic event on its five-point scale, estimating UK financial impact at 1.9 billion pounds (modelled range 1.6 to 2.1 billion) across more than 5,000 UK organizations — the most economically damaging cyber event to hit the UK.
Aflac	8 Aug 2025	13,924,906	Healthcare	Unknown	HHS Office for Civil Rights breach portal
Disclosed via HHS OCR breach portal Country United States Primary source HHS Office for Civil Rights breach portal ↗ Revision Record count revised. VERIFIED 2026-07-21: read directly from the HHS OCR portal — "Aflac Incorporated", 13,924,906 individuals affected, submitted 08/08/2025, Hacking/IT Incident, business associate not present. This is a national entity-submitted figure and is the only count in this batch confirmed from a primary source today. Date shown is the HHS submission date, not the public announcement date.
Columbia University	7 Aug 2025	Undisclosed	Education	Unknown	Oregon Department of Justice breach registry
Disclosed via US state attorney general filing Discovered 8 Jul 2025 53-day dwell Occurred → disclosed 16 May 2025 → 7 Aug 2025 83-day gap Country United States Primary source Oregon Department of Justice breach registry ↗ Revision Record count revised. Verified 21 Jul 2026 from the Oregon Department of Justice breach registry: reported 7 August 2025, breach dates 16 May and 24 June 2025, discovered 8 July. The disclosure date recorded is Oregon's regulatory reporting date rather than a press announcement, and the incident date is the earlier of the two breach dates. No affected-individuals count has been published by a primary source, so the count is left blank rather than estimated. This record is Columbia University and is distinct from the HHS OCR entries for Columbia Eye Clinic, Columbia Orthopaedic Group and Columbia Medical Practice, which are unrelated entities.
Ingram Micro	5 Jul 2025	Undisclosed	Technology	Ransomware	SEC EDGAR (Form 8-K, Item 8.01 — company statement)
Disclosed via SEC Form 8-K Country United States Primary source SEC EDGAR (Form 8-K, Item 8.01 — company statement) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. VERIFIED 2026-07-21 by reading the filed press release in full. Ingram Micro Holding Corporation (NYSE: INGM) issued the statement dated July 5, 2025; the 8-K was filed 2025-07-07. Vector is set to ransomware because the company states it directly — "Ingram Micro recently identified ransomware on certain of its internal systems" — rather than being inferred. Filed under Item 8.01 (Other Events), NOT Item 1.05, which is why an Item 1.05 sweep does not surface it; a material-looking incident is not always filed as one. The statement gives no records-affected figure, so that stays undisclosed. `occurred` and `discovered` are empty: the release says only "recently identified" and gives no dates.
Fidelity Investments	9 Oct 2024	Undisclosed	Finance & banking	Unknown	Oregon Department of Justice breach registry
Disclosed via US state attorney general filing Discovered 19 Aug 2024 2-day dwell Occurred → disclosed 17 Aug 2024 → 9 Oct 2024 53-day gap Country United States Primary source Oregon Department of Justice breach registry ↗ Revision Record count revised. Verified 21 Jul 2026 from the Oregon Department of Justice breach registry: reported 9 October 2024, breach dates 17 and 19 August 2024, discovered 19 August, notice sent 9 October. The disclosure date recorded is Oregon's regulatory reporting date, not a press-announcement date. No affected-individuals count has been published by a primary source, so the count is left blank rather than estimated. This record is Fidelity Investments specifically. Oregon separately lists Fidelity National Information Services, Fidelity & Guaranty Life Insurance and Fidelity Life Association, which are unrelated companies with their own 2023 filings and should not be merged with this one.
National Public Data	5 Sep 2024	Undisclosed	Other	Unknown	Oregon Department of Justice breach registry
Disclosed via US state attorney general filing Country United States Primary source Oregon Department of Justice breach registry ↗ Revision Record count revised. Verified 21 Jul 2026 from the Oregon Department of Justice breach registry, filed as Jerico Pictures, Inc. doing business as National Public Data, reported 5 September 2024. Oregon lists no breach dates and no discovery date for this filing, so both are left empty rather than inferred, and the disclosure date recorded is the regulatory reporting date. No affected-individuals count has been published by a primary source, so the count is left blank rather than estimated.
AT&T	12 Jul 2024	Undisclosed	Telecom	Unknown	SEC EDGAR (Form 8-K, Item 1.05)
Disclosed via SEC Form 8-K Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 21 Jul 2026: the SEC Form 8-K Item 1.05 filing date and document URL were confirmed live on EDGAR (accession 0000732717-24-000046). This record covers both 2024 incidents, the March forum dump and the July Snowflake-related breach. No affected-individuals count has been published by a primary source, so the count is left blank rather than estimated.
Cencora	27 Feb 2024	Undisclosed	Healthcare	Unknown	SEC EDGAR (Form 8-K, Item 1.05)
Disclosed via SEC Form 8-K Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05) ↗ Last confirmed 8 Oct 2026 Revision Record count revised. Verified 21 Jul 2026: the SEC Form 8-K Item 1.05 filing date and document URL were confirmed live on EDGAR. Cencora filed a second Item 1.05 on 31 July 2024. The sector is recorded as healthcare deliberately: Cencora's SIC code (5122, drug wholesale) maps to retail, which misdescribes a pharmaceutical distributor whose breach exposed patient data. No affected-individuals count has been published by a primary source, so the count is left blank rather than estimated.
Change Healthcare	22 Feb 2024	Undisclosed	Healthcare	Unknown	SEC EDGAR (Form 8-K, Item 1.05, filed by UnitedHealth Group)
Disclosed via SEC Form 8-K Discovered 21 Feb 2024 4-day dwell Occurred → disclosed 17 Feb 2024 → 22 Feb 2024 5-day gap Country United States Primary source SEC EDGAR (Form 8-K, Item 1.05, filed by UnitedHealth Group) ↗ Revision Record count revised. Verified 21 Jul 2026: filed by parent UnitedHealth Group, with the SEC Form 8-K Item 1.05 filing date and document URL confirmed live on EDGAR. No affected-individuals count is recorded. The widely-cited figure of about 192.7 million has not been confirmed against a primary source, and this table does not publish a number it has not verified. HHS OCR is where it would be confirmed, but the incident has aged out of the portal's 24-month window and sits in the archive.

About this data

Scope: Breaches where a regulator register or the organization itself published the disclosure.
Key facts: 26 disclosed breaches. The most affected sector is Healthcare with 15.
10 of 26 disclose how many people were affected; the rest publish none, and this table leaves those cells empty rather than estimating them.
This cycle14 Aug 2026: The register catches up with three giant vendor breaches at once: DentaQuest reports 15 million people to federal regulators, the largest US healthcare breach of 2026, with the ShinyHunters group claiming a 234 GB theft; Unlimited Technology Systems follows at 3.8 million from a five-day 2025 intrusion disclosed nine months later; and billing firm MCBS adds 1.26 million with the PEAR group claiming 3.3 TB. Amgen files a material 8-K for cloud-storage exfiltration of patient data without publishing a count, and RingCentral confirms a social-engineering breach whose leaked corpus indexes 1.6 million unique emails. Four of the five publish no intrusion method; those vectors stay unknown rather than guessed.
Reading the table: Every row links our own report where we have one. Counts are as stated at disclosure and are often revised later. 15 of these 24 records are healthcare, which reflects which regulators publish breach notices in public registers rather than where breaches actually happen.

Using this data in research or journalism?

Quoting a figure with a link to this page needs no permission. Reuse of the compiled dataset is licensed under CC BY 4.0: credit SQ Magazine and link back.

Download CSV

What the data shows

The charts below redraw the table above as the trends and comparisons a table cannot show.

Records affected by month

Grouped by disclosure month. Breaches with no stated record count are excluded rather than counted as zero.

Breaches by sector

Disclosed breaches per sector.

Largest by records affected

Of breaches with a verified record count; many disclosures never state one.

Longest disclosure lags

Days from occurrence to disclosure, where both dates are verified.

If your data was in one of these

Every record above names the public register its notice was filed in, because that notice is the document that says what was taken. Start there rather than with coverage: it is dated, official, and specific to you.

Read the organization’s own notice. Each row’s detail links the primary source. It states what categories of data were involved, which is the fact that decides what to do next.
Check the register for your jurisdiction. The routes below are the ones this page cites.
Watch the notice date. Counts on this page are as stated at disclosure and are often revised upward later, so a notice can be more current than the number here.

HHS OCR breach portal ↗ US health data. Searchable by organization; lists every breach of 500 or more records.
US state attorney general filings ↗ Many states publish the notice letters themselves, which name the exact data involved.
SEC Form 8-K ↗ What a listed company told its investors, on the record and dated.

This page tracks disclosures. It is not legal advice, and it cannot tell you whether you personally appear in a given breach; only the notice and the register can.

Verification ledger

5 most recent of 6 logged updates · RSS

8 Oct 2026 Latest Re-verified
Re-verify pass: 25 rows due. 8 re-confirmed against their cited source, 0 updated, 17 not re-checked this pass and left at their old date.
14 Aug 2026 Updated
Five disclosures added after the register sweep: DentaQuest (15,000,000, largest US healthcare breach of 2026), Unlimited Technology Systems (3,803,750), MCBS (1,261,464), Amgen (count not published), RingCentral (company-confirmed; 1,596,490-email leaked corpus). Sub-million register entries stay parked as drafts per the publication floor.
30 Jul 2026 Re-verified
Five-lens page audit passed; Dataset creator reference corrected in schema (3.83.1).
30 Jul 2026 Updated
Notice pathway recorded on all 21 records: how each disclosure reached its public register (state attorney general filing, HHS OCR portal, SEC 8-K, data protection authority notice, or company statement).
24 Jul 2026 Re-verified
Every new row verified against SEC filings, the HHS OCR portal, or the company's own notice; counts publish only where a primary source states one

How this tracker is maintained

Every record passes the same checks before it appears, and stays under review after.

Sourced

Each record traces to a primary disclosure: an SEC filing, a state attorney general notice, the HHS breach portal, or the company’s own statement. Counts stay as disclosed, and a third-party corpus count is always labeled as one.
Dated

Each row carries its disclosure date, and where the source states it, the gap between occurrence and disclosure.
Re-checked

Records are re-verified on a 30-day cycle, and disclosed counts get corrected when organizations revise their filings.

Where do these come from?: Regulator portals and company disclosures only, linked on every row. An absent count renders as Undisclosed rather than zero, because absence is a real answer.
Why is healthcare so common here?: The HHS breach portal is the most complete public disclosure feed, so healthcare incidents surface more reliably than other sectors. That reflects disclosure rules, not how attacks distribute across industries.

This is informational content. Disclosed figures reflect what organizations reported as of the stated dates, and companies revise counts. Confirm with the linked primary source before relying on a number.

Breach data from Have I Been Pwned, licensed under CC BY 4.0. Corpus counts are the number of records in that dataset and are not confirmed disclosure figures.