US data breaches

Who got breached in America, and how

Washington State requires any organisation — anywhere — to report a breach to its Attorney General when 500 or more Washington residents are affected, and publishes every notification as open data. Because almost every large US company has customers in Washington, it works as a national record. Figures below are Washington residents notified, exactly as reported.

Registry refreshed today

1,653 breaches on record

133 reported in 2026

72% caused by a cyberattack

10 days median time to spot a breach

The 100 largest on record

Ranked by the number of Washington residents notified. National totals are higher — often far higher — but this is the like-for-like figure every organisation had to report.

Equifax, Inc. Cyberattack · Other · Finance
3,243,664 people notified 07 Sept 2017
Change Healthcare Inc. Cyberattack · Ransomware · Health
3,121,209 people notified 03 Aug 2024
Comcast Cable Communications LLC Cyberattack · Other · Business
3,100,608 people notified 18 Dec 2023
T-Mobile USA Cyberattack · Malware · Business
2,079,648 people notified 24 Aug 2021
Fred Hutchinson Cancer Center Cyberattack · Other · Health
1,694,184 people notified 22 Dec 2023
ACTIVEOutdoors Unauthorised access · Government
1,449,645 people notified 19 Sept 2016
Washington State Auditor's Office Cyberattack · Malware · Government
1,420,520 people notified 12 Feb 2021
Boy Scouts of America Cyberattack · Ransomware · Non-Profit/Charity
981,068 people notified 21 Aug 2020
MGM Resorts International Cyberattack · Other · Business
811,740 people notified 05 Oct 2023
Neopets, Inc. Unauthorised access · Business
788,415 people notified 29 Aug 2022
Conduent Business Services LLC Cyberattack · Ransomware · Business
786,927 people notified 24 Oct 2025
Caesars Entertainment, Inc. Unauthorised access · Business
784,234 people notified 06 Oct 2023
T-Mobile USA Unauthorised access · Business
772,593 people notified 19 Jan 2023
Washington State University Theft or human error · Education
769,088 people notified 08 Jun 2017
QuoteWizard Unauthorised access · Business
717,781 people notified 05 Aug 2024
Sea Mar Community Health Centers Cyberattack · Unclear/unknown · Health
628,569 people notified 15 Nov 2021
CommonSpirit Health Cyberattack · Ransomware · Health
582,285 people notified 01 Dec 2022
Washington Gastroenterology Cyberattack · Other · Health
556,349 people notified 23 May 2025
loanDepot.com, LLC Cyberattack · Ransomware · Finance
502,513 people notified 15 Feb 2024
Washington State Department of Licensing Unauthorised access · Government
483,904 people notified 24 Feb 2022
Laboratory Services Cooperative Cyberattack · Ransomware · Non-Profit/Charity
475,487 people notified 10 Apr 2025
March of Dimes Cyberattack · Ransomware · Non-Profit/Charity
446,097 people notified 14 Aug 2020
Aflac Incorporated Unauthorised access · Business
432,025 people notified 11 Jul 2025
Nationstar Mortgage LLC (dba Mr. Cooper) Cyberattack · Ransomware · Finance
408,616 people notified 15 Dec 2023
Morgan Stanley Unauthorised access · Finance
401,246 people notified 10 Jul 2020
Shoreline Community College Cyberattack · Ransomware · Education
400,000 people notified 14 Apr 2023
AT&T Inc. Theft or human error · Business
378,471 people notified 10 Apr 2024
Community Health Plan of Washington Unauthorised access · Health
353,388 people notified 21 Dec 2016
Northwest Radiologists, Inc./Mount Baker Imaging Cyberattack · Ransomware · Health
348,118 people notified 10 Jul 2025
Pierce County Library System Unauthorised access · Government
336,826 people notified 20 Jun 2025
Western Washington Medical Group Cyberattack · Ransomware · Health
334,360 people notified 08 Nov 2023
Washington State University Foundation Cyberattack · Ransomware · Non-Profit/Charity
334,219 people notified 17 Aug 2020
Proliance Surgeons Cyberattack · Ransomware · Health
329,291 people notified 20 Nov 2023
T-Mobile USA/Experian Unauthorised access · Business
328,889 people notified 01 Oct 2015
Navia Benefit Solutions, Inc. Cyberattack · Other · Business
319,208 people notified 18 Mar 2026
PowerSchool Group LLC Cyberattack · Other · Education
314,107 people notified 27 Jan 2025
Rebound Orthopedics & Neurosurgery Unauthorised access · Health
313,093 people notified 07 Mar 2024
Boeing Employees Credit Union Unauthorised access · Finance
305,987 people notified 25 Jul 2022
MultiCare Health System Cyberattack · Ransomware · Health
302,769 people notified 21 Aug 2020
Get Air Management, Inc. Unauthorised access · Business
294,217 people notified 09 Jan 2025
Evolve Bank & Trust Cyberattack · Ransomware · Finance
275,716 people notified 08 Jul 2024
Marquis Software Solutions Cyberattack · Ransomware · Finance
269,773 people notified 17 Mar 2026
Marquis Software Solutions Cyberattack · Ransomware · Business
269,773 people notified 26 Nov 2025
Prosper Marketplace, Inc Cyberattack · Other · Finance
249,848 people notified 09 Dec 2025
AARP, Inc. & AARP Foundation Cyberattack · Ransomware · Non-Profit/Charity
248,615 people notified 14 Sept 2020
Virginia Mason Medical Center Cyberattack · Ransomware · Health
227,371 people notified 08 Sept 2020
Samsung Electronics America, Inc. Cyberattack · Unclear/unknown · Business
174,929 people notified 02 Sept 2022
Western Washington University Foundation Cyberattack · Ransomware · Education
165,000 people notified 17 Sept 2020
Yakima Valley Radiology PC Cyberattack · Ransomware · Health
161,768 people notified 01 Mar 2024
Lakeview Loan Servicing, LLC Unauthorised access · Finance
156,630 people notified 18 Mar 2022
Pierce College District Cyberattack · Ransomware · Education
155,811 people notified 08 Sept 2023
The Kroger Co. Cyberattack · Malware · Business
153,800 people notified 19 Feb 2021
The Estée Lauder Companies Inc. Cyberattack · Other · Business
150,535 people notified 31 Aug 2023
Zoetop Business Co. Ltd. Cyberattack · Unclear/unknown · Business
148,785 people notified 30 Dec 2020
DentaQuest, LLC Cyberattack · Phishing · Health
148,300 people notified 16 Jul 2026
Fidelity National Information Services, Inc. / Umpqua Bank Cyberattack · Malware · Finance
145,274 people notified 11 Aug 2023
Edmonds School District No. 15 Cyberattack · Other · Education
143,536 people notified 06 Oct 2023
Bolt Solutions Inc. (“bolt”) Unauthorised access · Business
140,249 people notified 26 Feb 2026
Columbia Surgical Specialists Cyberattack · Ransomware · Health
131,260 people notified 07 Mar 2019
Fetch Rewards, Inc. Unauthorised access · Business
128,598 people notified 10 Jul 2020
NEC Networks dba CaptureRx Unauthorised access · Health
126,193 people notified 05 May 2021
SEIU 775 Benefits Group Unauthorised access · Non-Profit/Charity
124,760 people notified 05 May 2021
700Credit, LLC Cyberattack · Other · Business
121,828 people notified 12 Dec 2025
Heifer Project International Cyberattack · Ransomware · Non-Profit/Charity
120,041 people notified 21 Aug 2020
Zoosk, Inc. Unauthorised access · Business
115,158 people notified 10 Jun 2020
Smile Brands Inc. Cyberattack · Ransomware · Health
108,927 people notified 08 Oct 2021
Chelan Douglas Health District Cyberattack · Malware · Health
108,906 people notified 15 Mar 2022
Delta Dental of California and its affiliates Unauthorised access · Health
106,098 people notified 14 Dec 2023
Welfare & Pension Administration Service, Inc. (WPAS) Cyberattack · Malware · Business
103,557 people notified 18 Feb 2022
Episource, LLC Cyberattack · Ransomware · Health
102,913 people notified 06 Jun 2025
HealthEquity, Inc. Cyberattack · Other · Health
102,140 people notified 26 Jul 2024
Corebridge Financial, Inc. Cyberattack · Other · Business
101,027 people notified 25 Jul 2023
Rite Aid Corporation Cyberattack · Phishing · Health
96,270 people notified 15 Jul 2024
Kootenai Health Cyberattack · Ransomware · Health
94,530 people notified 13 Aug 2024
Highline School District Cyberattack · Ransomware · Education
92,954 people notified 02 Apr 2025
Vimly Benefits Solution Cyberattack · Phishing · Business
91,807 people notified 19 Dec 2019
Health Care Authority Unauthorised access · Government
91,187 people notified 09 Feb 2016
Trans Union LLC. Unauthorised access · Finance
88,689 people notified 27 Aug 2025
Grays Harbor Community Hospital Cyberattack · Ransomware · Health
88,000 people notified 14 Aug 2019
Cerebral, Inc Unauthorised access · Health
86,669 people notified 03 Mar 2023
American Civil Liberties Union, Inc. Cyberattack · Ransomware · Non-Profit/Charity
86,269 people notified 14 Aug 2020
Teamsters Local Union No. 117 Cyberattack · Ransomware · Non-Profit/Charity
86,122 people notified 15 Jul 2025
VeriSource Services Inc Cyberattack · Ransomware · Health
85,880 people notified 25 Apr 2025
Sight Partners Physicians, P.C. Cyberattack · Unclear/unknown · Health
83,848 people notified 14 Jun 2022
Fred Hutchinson Cancer Center Unauthorised access · Health
78,834 people notified 25 May 2022
TaskRabbit, Inc. Unauthorised access · Business
77,618 people notified 09 May 2018
UNITE HERE Cyberattack · Ransomware · Business
76,574 people notified 23 Feb 2024
TriZetto Provider Solutions Unauthorised access · Health
76,562 people notified 06 Feb 2026
Eddie Bauer Cyberattack · Malware · Business
73,508 people notified 18 Aug 2016
Arthur J. Gallagher & Co. Cyberattack · Ransomware · Finance
72,378 people notified 13 Jul 2021
Cornish College of the Arts Cyberattack · Ransomware · Education
72,139 people notified 06 May 2022
DICK'S Sporting Goods, Inc. Cyberattack · Other · Business
72,012 people notified 17 Sept 2024
Port of Seattle Cyberattack · Ransomware · Government
71,939 people notified 03 Apr 2025
Maximus, Inc. Unauthorised access · Business
70,847 people notified 25 Aug 2023
Apria Healthcare LLC Unauthorised access · Health
69,686 people notified 22 May 2023
Kaiser Foundation Health Plan of Washington Cyberattack · Phishing · Health
69,589 people notified 03 Jun 2022
A&A Services, d/b/a Sav-Rx Unauthorised access · Health
69,051 people notified 24 May 2024
Minted, LLC Unauthorised access · Business
68,900 people notified 27 May 2020
Cerner Corporation Unauthorised access · Health
67,911 people notified 25 Jul 2025
Wolf Haldenstein Adler Freeman & Herz LLP Cyberattack · Ransomware · Business
67,820 people notified 16 Jan 2025