Resource
Breach Notice Tracker
Recent data breach notices filed with a state attorney general, with the dates and the official source for each one. Use it to check whether a breach letter you received matches a notice on file.
Recent notices
| Organization | Breach date(s) | Reported to California AG | Primary source | Status | Last verified |
|---|---|---|---|---|---|
| DreamHost, LLC | Aug 15, 2026 | Nov 2, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| EyeMed Vision Care, LLC | Sep 22, 2026 | Oct 30, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| Baanx US Corp. | Sep 23, 2026 | Oct 30, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| El Camino Health | Aug 26 and Sep 2, 2026 | Oct 30, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| Revolve Group, Inc. | Sep 11, 2026 | Oct 29, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| HCA Healthcare, Inc. | Aug 12, 2026 | Oct 29, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| Marathon Health | Aug 24, 2026 | Oct 29, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
| Tradier Brokerage Inc. | Aug 28, 2026 | Oct 27, 2026 | California AG notice | Notice filed | Nov 4, 2026 |
Dates are as listed in the California Attorney General’s breach notice database. Newest reports first.
How to read this tracker
- Breach date(s) are the dates the organization reported for the incident. Some notices list a range or more than one date.
- Reported to California AG is when the notice was submitted to the state, not necessarily the date letters reached individuals.
- Primary source links to the official listing, which includes a sample copy of the notice sent to affected people.
- Status shows the stage official records confirm. “Notice filed” means a breach notice exists. It does not mean a lawsuit or settlement exists.
Where these notices come from
California law requires businesses and agencies to notify California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. When a notice goes to more than 500 California residents, a sample copy must be provided to the California Attorney General, which publishes them in its data breach notice database. This tracker starts with notices from that database.
What this tracker doesn’t tell you
- Whether you were affected. Only the notice sent to you, or the organization, can confirm that.
- Whether a lawsuit or settlement exists. We list one only after verifying it in court records. See Lawsuits & Settlements.
- Every breach. Not every incident requires a filing in California, and filings can lag behind the incident.
Got a breach letter?
Compare it with the official notice, then follow our guides on verifying a data breach letter and what a breach notice actually tells you. If your Social Security number was exposed, consider a credit freeze or fraud alert.
Know of a notice we should add? Submit a tip.
General information, not legal advice. Last checked: November 4, 2026