Our Breach Tables keep you on top of all the data breaches we track each month. Learn about which companies were breached, how many were affected and much more!

Find the latest in breach news:

December 2020

Company# BreachedInformation ExposedCauseProtective Services
Aetna 484,000Names, dates of birth, vision insurance ID numbers, health insurance ID numbers and, for a limited number of individuals, Social Security numbers, birth certificates, diagnoses, and financial informationThird-Party BreachUnknown
Spotify TBDEmail address, your preferred display name, password, gender, and date of birth only to certain business partners of SpotifySoftware VulnerabilityUnknown
Dental Care Alliance1 MillionNames, addresses, dental diagnosis and treatment information, patient account numbers, billing information, bank account numbers, the name of the patient’s dentist, and health insurance informationHackUnknown
FireEyeTBDFireEye hacking software tools and government client recordsHackNone
EyeMed/Tufts Health Plan 60,545Names, addresses, dates of birth, phone numbers, email addresses, vision insurance account/identification numbers, health insurance account/identification numbers, Medicaid or Medicare numbers, driver’s license, birth or marriage certificates, partial or full social security numbers and/or financial information, medical diagnoses and conditions, treatment information, and passport numbersPhishing AttackYes, two years of credit monitoring and identity protection services

November 2020

Company# BreachedInformation ExposedCauseProtective Services
Pray.com10 MillionPhotos uploaded by the app’s users, names, home and email addresses, phone numbers, marital status, login information along with users’ phone contacts names, phone numbers, email, home and business addresses, company names and family tiesUnsecured DatabaseUnknown
Vertafore27 MillionName, date of birth, address, vehicle registration histories and Texas driver license numbersHackUnknown
Expedia, Hotels.com & Booking.com10 MillionName, email address, national ID number, phone number, reservation number, dates of a stay, the price paid per night, credit card details from over 100,000 guests, including card number, cardholder’s name, CVV, and expiration data, and total cost of hotel reservationsUnsecured DatabaseUnknown
Mashable.comTBDName, email address, country, gender, job description, online behavior related details, date of registration, IP addresses, social media profile links, and authentication tokensUnsecured DatabaseUnknown
JM BullionTBDName, address, and payment card details including account numbers, card expiration dates, and the security codesMalwareUnknown

October 2020

Company# BreachedInformation ExposedCauseProtective Services
Fragomen, Del Rey, Bernsen & LoewyTBDName, date of birth, phone number, social security number, passport numbers, mailing address, and email addressHackYes, one year of free credit monitoring
PfizerTBDName, phone number, home address, email address, customer support messages, health data, medical status, phone call transcripts, and prescription informationUnsecured DatabaseUnknown
Broadvoice365 MillionName, caller identification number, phone number, location, voicemails and call transcripts, and medical informationUnsecured DatabaseNone
Dickey’s BBQ3 MillionPayment card detailsPoint-of-Sale (POS) system breachNone
Barnes & NobleTBDBilling and shipping address, telephone number, and email addressData BreachNone
Chowbus800,000Name, phone number, and mailing and email addressData LeakNone
Blackbaud6 Million Name, email, phone number, date of birth, gender, provider names, dates of service, department visited, and philanthropic giving historyRansomwareNone

September 2020

Company# BreachedInformation ExposedCauseProtective Services
Warner Music Group (WMG)TBDName, email address, telephone number, billing address, shipping address, card number, CVC/CVV, and expiration dateThird-Part Data BreachNone
Activision500,000Username and passwordCredential StuffingNone
Children's Hospitals and Clinics of Minnesota160,000Name, address, phone number, age, date of birth, gender, medical record number, dates of treatment, locations of treatment, names of doctors and health insurance statusThird-Party Data BreachNone
Staples2,500Name, address, email address, phone number, last four credit card digits, and order detailsData BreachUnknown
Razer100,000name, email, phone number, customer internal ID, order number, order details, billing and shipping addressUnsecured DatabaseNone
NorthShore University HealthSystem348,000Name, date of birth, address, phone number, e-mail, admission and discharge dates, locations of services, and physician names and specialtiesThird-Party Data BreachUnknown
Imperium Health140,000Name, address, date of birth, medical record numbers, account numbers, health insurance information, Medicare numbers, Medicare Health Insurance Claim Numbers (which can include Social Security numbers), and limited clinical and treatment informationPhishing AttackUnknown
Digital Point863,412 Name, email, internal user ID numbers, Internal records and user postsUnsecured DatabaseNone
Telmate1 MillionName, offense, religion, facility, relationship status, medications, gender, email address, physical address, IP address, phone number and driver’s license IDUnsecured DatabaseNone

August 2020

Company# BreachedInformation ExposedCauseProtective Services
Utah Pathology Services112,000Name, gender, date of birth, mailing address, phone number, Social Security number, email address, health insurance information, internal record numbers, and diagnostic information related to pathology servicesHackYes, one year of free identity monitoring
Dynasplint Systems103,000Name, address, date of birth, Social Security number, and medical informationMalwareUnknown
FreePik8.3 MillionEmails and hashed passwordsMalwareNone
ProctorU444,000Name, email address, address, phone number, hashed password, and affiliated organizationHackUnknown
Instagram, TikTok & Youtube235 MillionName, age, gender, profile photo, account description, statistics about follower engagement and demographic such as number of likes, followers, follower growth rate, engagement rate, audience demographic (gender, age and location), and whether the profile belongs to a business or has advertisementsUnsecured DatabaseNone

July 2020

Company# BreachedInformation ExposedCauseProtective Services
Avon19 MillionName, phone number, date of birth, email and home address, GPS coordinates, and other technical informationUnsecured DatabaseNone
Promo.com22 MillionName, email address, IP address, user location, gender and encrypted passwordsThird-Party BreachNone
Drizly2.5 MillionEmail address, date of birth, hashed passwords, phone number, IP address and geolocation data HackNone
Dave Mobile Banking App7.5 MillionName, email, birth date, address, phone number, and encrypted Social Security numberHackUnknown
Ancestry.com60,000Email address, geolocation data, IP address, system user ID, support messages and technical detailsUnsecured DatabaseNone
LiveAuctioneers3.4 MillionName, email address, mailing address, phone number, and encrypted passwordsHackUnknown
Benefit Recovery Specialists275,000Protected Health Information (PHI), names, Social Security numbers, dates of birth, dates of service, provider names, policy identification numbers, procedure codes, and/or diagnosis codesMalwareNone
EDP Renewables North America10 TB DataName, Social Security number potentially exposedRansomware AttackYes, one year of free identity protection services
Clubillion200 Million Records Per DayIP addresses, email addresses, amounts won, and private app messagesUnsecured DatabaseUnknown

June 2020

Company# BreachedInformation ExposedCauseProtective Services
TwitterTBDbusiness users’ email address, phone number and the last four-digits of credit card number Unsecured DatabaseUnknown
Frost & SullivanTBDCustomer records, names, and emails; employee records, user names, emails, and passwordsExposed DatabaseUnknown
BlueLeaks1 MillionName, bank account number, phone number, documents, videos, emails, and audio filesHackUnknown
CognizantTBDName, Social Security number, tax identification number, financial account information, driver’s license, and passport informationRansomware Attack Unknown
Claire'sTBDPayment card informationMagecart AttackUnknown
AmtrakTBDUsername, password and some personal informationHackYes, one year of free credit monitoring

May 2020

Company# BreachedInformation ExposedCauseProtective Services
Mathway25 MillionEmail, password, and back-end system dataHackNone
Wishbone40 MillionUsername, email, phone number, location information and hashed passwordsHackNone
Home Chef8 MillionName, email address, phone number, address, scrambled passwords, and last four digits of credit card numberHackNone
GoDaddy28,000Username and passwordHackNone

April 2020

Company# BreachedInformation ExposedCauseProtective Services
Quidd4 MillionUsername, email address, and hashed account passwordHackNone
Unnamed U.K-Based Security Firm5 BillionHashtypes, leak dates, passwords, email addresses, email domains and leak sourcesData DumpNone
Ambry Genetics233,000Name, Social Security number, information related to customers’ use of the genetic laboratory’s services and medical information Phishing AttackYes, free identity monitoring services
Nintendo160,000Login ID and passwordCredential StuffingNone
Paay2.5 MillionFull plaintext credit card number, expiration date and amount spentUnsecured DatabaseNone
Facebook267 MillionName, Facebook ID, phone number, email address, birth date, and genderSale on the Dark WebNone
Beaumont Health112,000Name, birth date, Social Security number, driver’s license number, medical condition data and bank account data Phishing AttackNone
Zoom500,000Email address, password, personal meeting URL, and host keyCredential Stuffing AttackNone
San Francisco International Airport (SFO)UnknownUsername and password MalwareNone
Key Ring14 MillionName, full credit card details (including CVV numbers), email address, birth date, address, membership ID numbers, retail club and loyalty card memberships, government IDs, gift cards, medical insurance cards, medical marijuana IDs, IP address and encrypted passwordsUnsecured DatabaseNone

March 2020

Company# BreachedInformation ExposedCauseProtective Services
Marriott5.2 MillionName, address, email address, phone number, loyalty account numbers and points balances, company, gender, birth date, linked airline loyalty programs and numbers, room preferences and language preferencesThird Party VendorYes, one year of free identity theft protection
General Electric280,000Name, address, Social Security number, driver's license number, bank account number, passport number, dates of birthThird Party VendorUnknown
TrueFireTBDName, address, payment card account number, card expiration, and security codeHackNone
Whisper900 Million Nickname, age, ethnicity, gender, and location dataUnsecured DatabaseNone
J.CrewTBDUsername and passwordCredential StuffingNone
T-MobileTBDName, address, Social Security number, financial account information, government identification number, phone number, billing and account information, rate plans and featuresThird Party VendorYes, free credit monitoring and identity theft protection
Carnival Cruise LinesTBDName, address, Social Security number, passport number, driver’s license number, credit card and financial account information, and health-related informationHackYes, free credit monitoring and identity theft protection
WalgreensTBDName, prescription numbers and drug names, store numbers, and shipping addressUnsecured Mobile AppNone

February 2020

Company# BreachedInformation ExposedCauseProtective Services
Slickwraps850,000Name, email address, physical address, phone number, and purchase historyUnsecured DatabaseNone
PhotoSquared100,000Name, address, user photos, order receipts, shipping labelsUnsecured DatabaseNone
MGM Resorts10.6 MillionName, home address, phone number, email, and date of birthData DumpNone
Health Share of Oregon654,000Name, address, phone number, date of birth, Social Security number, and Medicaid ID numberThird Party VendorYes, one year of free credit monitoring
Fifth Third BankUnknownName, Social Security number, driver's license information, mother's maiden name, address, phone number, date of birth and account numbersEmployee Negligence Yes, free identity theft protection
Estee Lauder440 MillionEmail address, IP address, ports, pathways and storage informationUnsecured DatabaseNone

January 2020

Company# BreachedInformation ExposedCauseProtective Services
THSuite85,000Name, date of birth, phone number, email, street address, patient name and medical ID number, cannabis variety and quantity purchased, total transaction cost, date received, and photographs of scanned government and employee IDsUnsecured DatabaseNone
Microsoft250 millionEmail address, IP address, and support case detailsUnsecured DatabaseNone
Hanna AnderssonUnknownName, shipping address, billing address, payment card number, CVV code, and expiration dateMalware AttackNone
Peekaboo MomentsUnknownEmail addresses, geographic location data, detailed device data, and links to photos and videosUnsecured DatabaseNone
Landry's RestaurantsUnknownName, credit and debit card numbers, expiration dates, verification codes Malware AttackNone

December 2019

Company# BreachedInformation ExposedCauseProtective Services
Wyze2.4 MillionUser name, email address, WiFi network names, lists of camera names and personal health informationData LeakNone
WawaUnknownName, credit and debit card numbers and expiration datesMalwareYes, free credit monitoring and identity theft protection
Facebook267 MillionName, phone number, Unique Facebook ID, phone number Unsecured DatabaseNone
LightInTheBox1.6 BillionEmail address, IP address, country of residence, destination pages and user activityUnsecured DatabaseNone
TrueDialog1 BillionNames of recipients, account holders and users, email addresses, phone numbers of recipients and users, content of messages, dates and times messages were sent, message status, and account detailsUnsecured DatabaseNone

November 2019

Company# BreachedInformation ExposedCauseProtective Services
Unknown1.2 BillionName, mail address, phone number, employer, location, job title and social media profilesUnsecured DatabaseNone
T-Mobile1 MillionName, billing address, phone number, account number, rate, plan and calling featuresHackNone
Macy'sUnknownName, address, phone number, email address, payment card number, card security code, and payment expiration dateHackNone
Disney PlusUnknownUsername and passwordCredential StuffingNone

October 2019

Company# BreachedInformation ExposedCauseProtective Services
Network SolutionsUnknownName, address, phone numbers, email address and service informationHackNone
Bed Bath & BeyondUnknownAccount login information including email and passwordCredential StuffingNone
Adobe7.5 MillionEmail address, username, country of origin, Adobe products, account creation date, date of last login, subscription and payment statusSecurity VulnerabilityNone
Kalispell Regional Healthcare130,000Name, Social Security number, address, medical record number, date of birth, telephone number, email address, medical history and treatment information, dates of service, treating/referring physicians, medical bill account number and/or health insurance informationPhishing AttackYes, free fraud consultation and identity theft restoration services
AutoclerkUnknownName, date of birth, home address, phone number, dates, travel costs, check-in times, room numbers, and masked credit card detailsSecurity VulnerabilityNone
Methodist Hospitals of Indiana68,000Name, address, date of birth, Social Security number, driver’s license/state ID/passport number, credit card information and patient health recordPhishing AttackNone

September 2019

Company# BreachedInformation ExposedCauseProtective Services
Zynga218 MillionName, email address, login ID, hashed password, phone numbers, Facebook ID and Zynga account IDHackNone
DoorDash4.9 MillionName, email and delivery addresses, order history, phone number, hashed and salted passwords, last four digits of credit card and bank account, and driver's license informationThird Party BreachNone
Dealer Leads198 MillionName, email address, phone number, home address and IP address Security VulnerabilityNone
Facebook419 MillionUnique Facebook ID, phone number, name, gender, and locationSecurity VulnerabilityNone
Providence Health Plan122,000Name, address, email address, date of birth, Social Security number, member identification number, group number and subscriber numberHackYes, two years of free credit monitoring and identity protection services

August 2019

Company#BreachedInformation ExposedCauseProtective Services
Foxit328,000Name, email address, password, phone number, company name, and IP addressHackUnknown
Hostinger14 MillionFirst name, username, email address, IP address and hashed passwordsHackNone
MoviePass58,000Name, address, MoviePass debit card number, card expiration date, card balance and activation dateSecurity VulnerabilityNone
BioStar 227.8 MillionFingerprint data, facial recognition information, and unencrypted usernames and passwordsSecurity VulnerabilityNone
Choice Hotels700,000Name, email address, and phone numberSecurity VulnerabilityNone
Hy-Vee5.3 MillionPayment card dataHackNone
State FarmUnknownUsername and passwordCredential StuffingUnknown
CafePress23.2 MillionName, address, email address, phone number and hashed passwords HackUnknown
PoshmarkUnknownName, usernames, gender, city data, email addresses, size preferences and scrambled passwords.HackNone
StockX6.8 MillionName, email address, scrambled password, shoe size, trading currency, user’s device type and other profile information HackNone
Presbyterian Healthcare Services183,000Name, date of birth, Social Security number, health plan and clinical informationPhishing AttackYes, one year of free credit monitoring and identity protection services
Capital One100 MillionName, Social Security number, address, zip code, phone number, email address, date of birth, linked bank account number, self-reported income, credit score, credit limit, balance, payment history, contact information and transaction dataEmployee ErrorYes, free credit monitoring and identity protection services

July 2019

Company#BreachedInformation ExposedCauseProtective Services
MyCastingFile.com260,000 Name, address, email address, phone number, work history, date of birth, height and weight, ethnicity, physical features, vehicle ownership information and casting photographUnsecured DatabaseUnknown
Polk County450,000 Driver’s license number and Social Security numberPhishing AttackUnknown
Los Angeles' Personnel Department20,000Name, birth date, partial Social Security numbers, email address, and applicant account passwordsHackUnknown
Capital One100 MillionNames, addresses, phone numbers, email addresses, dates of birth, income, credit scores, credit limits, and credit balancesUnauthorized AccessYes, free credit monitoring and identity protection services
SprintUnknownName, billing address, phone number, device type, device ID, monthly recurring charges, subscriber ID, account number, account creation date, upgrade eligibility and add-on servicesHackUnknown
Clinical Pathology Laboratories (CPL)2.2 MillionName, address, phone number, date of birth, dates of service, balance information, treatment provider information, credit card and banking informationThird-Party BreachUnknown
Fieldwork SoftwareUnknownName, credit card number, alarm codes, client information, and other sensitive details of the company’s small business customersUnsecured DatabaseUnknown
Essentia Health1,000Patient demographic detail, medical record and patient account number, date of birth, admission and discharge dates, and dates of servicesThird-Party BreachYes, free credit monitoring services
Los Angeles County Department of Health Services14,000Name, Social Security number, home address, date of birth, phone number and various data related to medical services providedPhishing AttackYes, free credit monitoring and identity protection services
Maryland Department of Labor78,000Name, Social Security number, date of birth, city or county of residence, graduation date and record numberHackYes, two years of free credit monitoring
Orvibo2 BillionEmail address, password, account reset code, precise geolocation, IP address, username, user ID, family name, family ID, smart device, devices that accessed account, and scheduling informationHackUnknown

June 2019

Company#BreachedInformation ExposedCauseProtective Services
Dominion National95,000Name, address, date of birth, email address, Social Security number, tax ID number, bank account and routing numbers, and member ID numberHackNone
Desjardins2.9 MillionName, date of birth, social insurance number, address, phone number, email address, details of banking habits and Desjardins products, business name, business address, business phone number, owner's name and names of users on the AccèsD Affaires accountEmployee ErrorNone
Oregon Department of Human Services645,000Name, address, date of birth, Social Security number, case number, personal health information, and other information used in DHS programsPhishing AttackNone
EatStreetUnknownName, credit card numbers , expiration date, card verification code, billing address, email address, phone number, company name, clients name, company address, bank account and routing numberHackNone
Evernote4.6 MillionAuthentication, financials, private conversations in social media, and personal emailsSecurity VulnerabilityNone
Total RegistrationUnknownNames of students and parents, dates of birth, Social Security numbers, languages, grade level, gender, and student IDSecurity VulnerabilityNone
Evite100 MillionUsernames, email addresses, IP addresses, and cleartext passwords, birth phone numbers, and postal addresses.HackNone
US Customs and Border Protection100,000Images of travelers’ faces and license platesHackNone
Emuparadise1.1 MillionEmail address, IP address, username, and passwordSecurity VulnerabilityNone
Opko Health422,600Credit card numbers, bank account information, email addresses, physical addresses, phone numbers, balance informationHackNone
LabCorp7.7 MillionName, address, date of birth and balance informationHackNone
Quest Diagnostics12 MillionCredit card and bank account numbers, Social Security number, and medical information HackNone

May 2019

Company#BreachedInformation ExposedCauseProtective Services
Checkers and Rally'sUnknownName, payment card number, card verification code, and expiration dateHackUnknown
FlipboardUnknownUsernames, encrypted passwords, emails and digital tokensHackNone
Canva140 MillionUsername and email addressHackNone
First American Financial Corp.885 MillionBank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license imagesUnsecured DatabaseUnknown
Inmediata Health Group1.5 MillionName, address, date of birth, Social Security number, gender, and medical informationSecurity Vulnerability None
Instagram49 MillionBio information, profile photo, location, verification status, email address and phone numberUnsecured DatabaseNone
Uniqlo460,000Names, address, contact details, and partial credit card informationHackUnknown
Indiana PacersUnknownName, address, date of birth, Social Security number, passport number, medical and health insurance information, driver's license/state identification number, account number, credit/debit card number, digital signature, and username and passwordPhishing EmailUnknown
Freedom Mobile1.5 MillionName, email address, phone number, physical address, dates of birth, account numbers, and credit card informationUnsecured DatabaseUnknown
WyzantUnknownName, email address, ZIP code and Facebook profile information and pictures if social media account used to loginHackUnknown

April 2019

Company#BreachedInformation ExposedCauseProtective Services
CitrixUnknownSocial Security number, financial information, and other data on current and former employeesHackUnknown
Unknown80 MillionName, address, geographic location, age, date of birth, and other demographic information Unsecured Database None
Docker190,000 Username, hashed password, Github, and Bitbucket tokens for Docker auto-buildsHackNone
Atlanta HawksUnknownNames, date of birth, and payment card detailsWebsite VulnerabilityNone
BodyBuilding.com7 MillionName, email address, billing/shipping address, phone number, order history, birth date, and information included in BodySpace profilesHackNone
EmCare60,000Name, Social Security number, date of birth, age, clinical information and driver's license numbersHackNone
Steps to Recovery150,000Name and details of the treatmentsSecurity Vulnerability None
MicrosoftUnknownEmail address, folder names, subject lines of emails, and email contentsHackNone
City of TallahasseeUnknownPayroll accounts containing bank account informationPhishing EmailNone
Prisma Health23,811 Name, Social Security number, email credentials, health insurance information, and financial informationPhishing EmailCredit monitoring and identity theft protection
Baystate Health of Springfield12,000Name, date of birth, Social Security number, Medicare information and medical recordsPhishing EmailCredit monitoring and identity theft protection
Facebook540 MillionAccount name, Facebook ID, and user activityThird Party None
Georgia Tech1.3 Million Name, address, Social Security Number and birth dateHackCredit monitoring services

March 2019

Company#BreachedInformation ExposedCauseProtective Services
Verifications.io982 MillionName, birth date, address, social media accounts and places of employmentSecurity VulnerabilityNone
Earl Enterprise2 MillionName, credit and debit card numbers, and expiration dates HackNone
Verity Health14,894Name, address, date of birth, Social Security number, driver’s license, phone number, patient identification number, health plan name, treatment details, medical procedures and conditions, lab test data, medical equipment information, billing codes, dates of service, payment information, claims history, health insurance policy numbers, subscriber identification, health insurance identifiers, and application and claims historyPhishing EmailIdentity theft protection and credit monitoring services
Asus1 MillionUnknownHackNone
Milestone Family Medicine32,178Name, date of birth, address, Social Security number, health insurance information, and medical services HackIdentity theft protection and credit monitoring services
Family Locator238,000Name, email address, profile photo, passwords, and user and family members’ real-time locations.Security VulnerabilityNone
Federal Emergency Management Agency (FEMA)2.5 MillionName, address, birth date, and bank account information Security VulnerabilityNone
Oregon Department of Human Services2 MillionName, address, date of birth, Social
Security Number, case number and other information used to administer DHS programs
Phishing EmailIdentity Theft Protection
Facebook200-600 MillionPasswordsSecurity VulnerabilityNone
Zoll Medical277,000Name, address, date of birth and medical informationServer Migration ErrorNone
MyPillow and AmerisleepTBDCredit card credentialsHackNone
Rutland Regional Medical Center72,000Name, Social Security Number, diagnosis, treatment information, prescription information, doctor's name, medical record number (MRN) and FINEmail HackNone
Spectrum Health Lakeland60,000Name, address, Social Security Number, types of health services provided, dates of those services, health insurance provider and amounts due on the patient accountRansomwareCredit monitoring and financial investigative services
Pasquotank-Camden Emergency Medical Services20,420Social Security number, date of birth and medical informationHackIdentity Theft Protection
Health Alliance Plan120,000Name, address, date of birth, member ID number, patient ID number, healthcare provider name, and claim informationRansomwareIdentity Theft Protection

February 2019

Company#BreachedInformation ExposedCauseProtective Services
UConn Health326,000Name, birth date, Social Security number, limited medical informationPhishing EmailIdentity Theft Protection
UW Medicine974,000Name, medical record number, Security VulnerabilityNone
Coinmama450,000Email and hashed passwordSecurity VulnerabilityNone
AdventHealth50,000Name, phone number, address, Social Security number, medical history, and insurance informationHackNone
North Country Business ProductsTBDName, credit card number, expiration date, and CVVNone
500px14.8 MillionName, username, hashed password, email address, birthdate, general geographic location, and genderHackNone
Coffee Meets Bagel6 MillionName and email addressHackNone
Facebook1 MillionAccess to accountData LeakNone
Dunkin' DonutsTBDName, email address, 16-digit DD Perks account number and DD Perks QR codeCredential StuffingNone
EyeSouth Partners24,000Name, health insurance carrier, and account balancesHackNone
Huddle HouseTBDName, credit/debit card number, expiration date, cardholder verification value, and service codeSecurity Vulnerability in POS SystemsNone
Catawba Valley Medical Center20,000Name, birth date, Social Security Number, and health informationPhishing EmailNone
HouzzTBDName, city, state, country, email address, profile description, username, and hashed passwordsHackNone

January 2019

Company#BreachedInformation ExposedCauseProtective Services
Critical Care, Pulmonary & Sleep Associates23,000Name, address, date of birth, Social Security Number, clinical data like dates of service, diagnoses, and medical conditions, labs and diagnostic studies, medications, treatment details, , and other treatment information.Phishing EmailNone
RubrikTBDNames, contact information, and other details related to corporate accountsEmployee ErrorNone
The Department of Health and Social Services in Alaska100,000Name, address, date of birth, Social Security number, health information, benefit information and other personal information such as incomeSecurity VulnerabilityNone
Ascension24 Million Name, address, birth date, Social Security number, bank and checking account numbers, loan and mortgage agreements, repayment schedules and other highly sensitive financial and tax documents Security VulnerabilityNone
ElasticSearch108 MillionName, address, phone number, email address, birth date, username, account balances, IP address, browser and OS details, games played, and win and loss informationData Leak from Online Betting SitesNone
Greater's Ice Cream12,000Name, address, phone number, fax number, payment card type, payment card numbers, expiration dates, and verification codesWebsite VulnerabilityNone
BlackRock20,000Name and email address of financial advisersEmployee NegligenceNone
Collection #1773 MillionEmail and passwordData LeakNone
Oklahoma Department of Securities (ODS)TBDPersonal FBI data, system credentials, internal communication records, spreadsheets of IT credentials, credentials required for remote access to ODS workstations, training documents, email histories, and files relating to ODS investigationsSecurity VulnerabilityNone
Fortnite80 MillionName, security tokens to access Fortnite accounts, make in-app purchases and record conversations among players.Security VulnerabilityNone
Managed Health Services of Indiana31,000Name, address, date of birth, insurance ID number, dates of service, and medical conditionsPhishing EmailNone
OXO InternationalTBDNames, billing and shipping address, and credit card informationHackYes, free credit monitoring services
BenefitMallTBDName, address, Social Security number, date of birth, bank account number, and information on the payment of insurance premium.Phishing EmailNone
DiscountMugs.comTBDName, address, phone number, email address, ZIP code, credit card number, security code, and expiration date. HackNone
Town of Salem Game7.6 MillionEmail address, username, password, IP address, game & forum activity, purchased game premium featuresHackNone
Blur2.4 Million Name, email address, password hints, IP address, and encrypted Blur passwordSecurity VulnerabilityNone

December 2018

Company#BreachedInformation ExposedCauseProtective Services
BevMo14,000Name, address, phone number credit and debit card numbers and security codesHackNone
San Diego Unified School District500,000Name, address, Social Security number, date of birth, phone numbers, payroll and compensation information, viewable paychecks and pay invoices, deduction information, tax information, direct deposit financial institution name, routing number and account number, salary and leave information, health benefits enrollment information, beneficiary identify information, dependent identity information, savings or flexible spending account informationPhishing AttackNone
Caribou CoffeeTBDName, card number, expiration date, and card security codeSecurity Vulnerability None
Warby Parker198,000Name, email address, payment card information, and prescription informationHackNone
NASATBDSSN and other personally identifiable information (PII) on current and past NASA employeesHackYes, free identity protection services
Elizabethtown Community Hospital32,000Name, address, date of birth, medical record numbers, dates of service and summary of services providedHackNone
Wright County72,000TBDEmployee Negligence None
Facebook6.8 MillionPrivate photos, Facebook Stories, and Marketplace photosSecurity BugNone
Baylor Scott & White Medical Center Frisco48,000Name, address, telephone number, date of birth, medical record number, date of service, insurance provider, account number, last four digits of the credit card, CCV number, type of credit card, date of recurring payment, account balance, invoice number, and status of transactionHackNone
City of Topeka10,000TBDHackNone
Google+52.5 MillionName, age, email address, occupation, and profile dataSecurity Vulnerability None
Quora100 MillionName, email address, encrypted password, and publicly posted questions/answers/commentsHackNone

November 2018

Company#BreachedInformation ExposedCauseProtective Services
Marriott500 MillionName, address, phone number, date of birth, gender, email address, passport number, Starwood’s rewards information (including points and balance), arrival and departure information, reservation date, and their communication preferencesHackYes, one year of online account monitoring
Dunkin' DonutsTBDName, username, 16-digit DD Perks account number and DD PerksHackUnknown
ElasticSearch57 MillionName, address, email address, state, ZIP code, phone number, and IP addressSecurity VulnerabilityUnknown
Atrium Health2.65 MillionName, address, date of birth, Social Security, insurance policy information, service date, medical record numbers, and account balancesHackYes, credit monitoring and identity protection services
AmazonTBDName and email addressTechnical ErrorUnknown
USPS60 MillionEmail address, username, user ID, account number, street address, phone number, authorized users, mailing campaign data, real time tracking data Security Vulnerability Unknown
Voxox26 MillionSMS text messages including Password reset links, Two-Factor authentication codes, and shipping notifications Security Vulnerability Unknown
Health First42,000Address, date of birth, Social Security numberPhishing EmailYes, one year of identify theft protection service
Nordstrom75,000Name, address, phone number, date of birth, Social Security number, pay card number, checking account and routing number, insurance provider information, and salary. Employee errorYes, two years of identity theft protection
Bankers Life566,000Name, address, date of birth, insurance information, Social Security number, driver’s license, state identification card number, bank account number, credit and debit card information, medications, diagnosis, and treatment plans HackYes, credit monitoring and identify theft protection service
Huntsville Hospital15,000Name, address, phone number, email address, and Social Security numberHackYes, identity theft protection
Canada Post4,500Name, initials, postcodes, dates of delivery, Ontario Cannabis Store (OCS) reference numbers, Canada Post tracking numbers, and OCS corporate names and business addressesHackUnknown
HSBC14,000Name, address, phone number, email address, date of birth, account number, account type, account balance, transaction history, and statement historyHackYes, one year of credit monitoring and identify theft protection service

October 2018

Company#BreachedInformation ExposedCauseProtective Services
Raley's10,000Name, gender, date of birth, health plan, plan member identification number, medical condition, pharmacy location visitedDevice TheftUnknown
Tomorrowland64,000 Name, address, age, postcode, and genderHackUnknown
Jones Eye Center40,000Name, address, birth date, service dates, medical record number, Social Security number, insurance informationHackYes, one year of free credit monitoring
Cathay Pacific9.4 millionName, address, email address, birth date, phone number, passport number, ID card number, nationality, payment card dataHackUnknown
U.S. Centers for Medicare & Medicaid Services (CMS)75,000Name, address, Social Security numberHackUnknown
FitMetrix236,391,692Name, email address, birth date, phone number, username, Facebook ID, gender, height, weight MisconfigurationUnknown
Google+496,951Full name, email address, birth date, gender, profile picture, places lived, occupation, relationship statusAPI bugNo, Google plans to shut down Google+ platform altogether, with the exception of Google+ enterprise version.
Central Maine Power77,300Name, address, former account numberEmployee errorNo
Toyota Industries North America, Inc.19,000Name, address, birth date, phone number, financial account number, Social Security number, driver's license number, email address, birth certificate, passwords, healthcare treatment/diagnosis information, medical insurance numbers, username, password, security questionsEmail compromiseYes, one year of free identity protection and credit monitoring

September 2018

Company#BreachedInformation ExposedCauseProtective Services
Facebook90 millionUser accountsSecurity vulnerabilityNo
SHEIN6.42 millionEmail address, encrypted passwordHackNo, company urges all users to reset passwords
Chegg40 millionUsername, email address, shipping address, hashed passwordsHackNo, company will reset all user account passwords
Independence Blue Cross17,000Name, date of birth, diagnosis information, provider details, insurance claim detailsAccidental uploadYes, two years of free identity protection services
Guardant Health1,100Name, date of birth, Social Security number, medical informationMisconfigurationUnknown
MedCall Advisors3,000 Name, date of birth, medical information, Social Security number PhishingUnknown
GovPayNet14 millionName, address, phone number, partial credit card informationWebsite vulnerabilityNo
Blue Cross Blue Shield Rhode Island1,567ID number, service provider, type of service provided, cost of claimEmployee errorNo
Tucson Medical Center1,800Name, birth date, address, medical record number, insurance ID number, Social Security number, protected health informationUnsecured storageYes, one year of free credit monitoring and identity protection services
Foosackly's165,000Payment card dataHackNo
Orrstown Bank50,000UnknownHackNo

August 2018

Company#BreachedInformation ExposedCauseProtective Services
Air Canada20,000Name, email address, phone number, passport number, passport country of issuance, Aeroplan number, NEXUS number, gender, date of birth, nationality, country of residenceHackNo
T-Mobile2.3 millionName, billing zip code, phone number, email address, account number, account typeUnknownUnknown
Eastern Maine Community College42,000 current and former studentsName, address, birth date, Social Security number, username, passwordMalwareFree credit monitoring and identity restoration
Sitter93,000Address, phone number, transactional history, phone book contacts, partial credit card numbers, encrypted passwordsData dumpNo
Legacy Health38,000Name, birth date, health insurance information, billing information, medical information, Social Security number, driver's license numberEmail hackFree credit monitoring for victims whose SSN was exposed
Augusta University Health417,000Demographic information, medical record numbers, treatment information, surgical details, diagnoses, medications, dates of service, insurance information, Social Security number, driver's license numberPhishing1-year free credit monitoring
MedSpring Urgent Care (Austin, TX)13,034Name, account number, medical record number, dates of medical servicesPhishingNo
Adams County (Wisconsin)258,120Personal data, health records, tax information, username, passwordUnauthorized accessNo
SSM Health St. Mary's Hospital301,000Name, medical record number, demographic information, financial informationImproper disposalNo
Institute on Aging (San Francisco, CA)3,900Name, address, Social Security number, email, phone number, birth date, financial information, medical information. Email hackYes
RedditUnknownEmail address, hashed password, private and public messagesHackNo
UnityPoint Health1,400,000Name, address, medical information, treatment information, lab results, health insurance information, some Social Security numbers, some payment card dataPhishingNo

July 2018

Company#BreachedInformation ExposedCauseProtective Services
Yale UniversityUnknownSocial Security Number, name, birth dateHackYes
Boys Town National Research Hospital105,309 employees and patientsName, birth date, Social Security number, diagnosis/treatment information, health insurance number, birth and marriage certificates, employer identification number, driver's license number, passport details, financial information, login credentialsEmail hackNo
TradeMotionUnknownName, billing/shipping address, email address, phone number, payment card number, CVV code, payment card expiration dateHackYes
ComplyRight660,000Name, address, phone number, email address, Social Security number Third-party breachYes
Algonquin College111,499Name, student ID number, college email address, birth date, phone number, personal email address, home addressHackNo
International Mission Board (IMB)UnknownName, address, birth date, contact information, Social Security number, health informationUnauthorized accessYes
University Medical Center Physicians18,000Name, address, phone number, medical record number, diagnoses, Social Security number, birth date, health insurance informationEmail hackYes, one year of credit monitoring and identity restoration services
Metro Health Department (Tennessee)UnknownHIV diagnosis, Social Security number, medical historyEmployee errorNo
Purdue University26,598 applicantsName, birth date, Social Security numberEmployee errorYes
Macy'sUnknownUsername, passwordPhishing scamYes
Timehop21 millionName, email address, phone numberHackNo
Exactis340 millionPhone number, address, date of birth, estimated income, number of children, education level, credit rating, other behavioral dataMisconfigured databaseNo
Adidas (U.S. Online Retail Store)UnknownContact information, user name, encrypted passwordHackUnknown

June 2018

Company#BreachedInformation ExposedCauseProtective Services
Michigan Medicine870Name, birth date, medical record number, gender, race, diagnosis, treatment-related informationLaptop theftNo
People Dedicated to Quality (PDQ)UnknownName, credit card number, expiration date, cardholder verification valueHackNo
Med Associates270,000Name, date of birth, address, dates of service, diagnosis codes, procedure codes, medical insurance ID numberHackNo
Flightradar24230,000Email address, passwords (hashed)UnknownNo
Chicago Public Schools3,700Name, email address, phone, student ID numberEmployee errorNo
HealthEquity23,000 Employee name, HealthEquity member ID, employer name, HealthEquity employer ID, deduction amount, Social Security numberPhishingYes
Dignity Health55,947Name, doctor nameEmployee errorNo
The Village of Wellington (Palm Beach) UnknownPayment card dataHackNo
MyHeritage92 millionEmail address, password (hashed)UnknownNo
Ticketfly26 millionName, address, email, phone numberRansomwareNo

May 2018

Company#BreachedInformation ExposedCauseProtective Services
Coca Cola8,000 employeesUnknownInsider theftNo
LifeBridge Health500,000Name, address, birth date, insurance information, Social Security numberThird-party back doorYes
University at Buffalo28 faculty and staff accounts
862 alumni accounts
1,800 student accounts
Username, passwordPhishingNo
TeenSafeUnknownChild's name, child's device information, child's Apple ID passwordsCloud misconfigurationNo
Chili'sUnknownCredit and debit card informationMalwareYes

April 2018

Company#BreachedInformation ExposedCauseProtective Services
Zippy's RestaurantsUnknownCredit/debit cardholder name, card number, expiration date, security codeUnknownNo
Access Group16,500Name, driver's license number, Social Security number Vendor errorYes
SunTrust Bank1.5 millionName, address, phone number, account balanceInsider theftYes
WEI MortgageUnknownName, Social Security number, date of birth, address, driver's license, state identification number, passport number, bank account information, credit/debit card information, tax identification number, username, password, loan package informationBusiness email compromiseYes
Unity Point Health16,000Details of medical procedures, health insurance informationCompromised employee email accountNo
Localblox48 millionName, physical address, employment information/job history data, IP address, phone number, behavioral data Data scraping (Facebook, LinkedIn, Twitter)No
Panera Bread37 millionName, email address, home address, phone number, birth date, customer loyalty account number, last four digits of saved payment cardsSecurity vulnerabilityNo
MyFitnessPal (Under Armour)r150 millionEmail, username, hashed passwordHackNo
Hudson's Bay Company (Saks Fifth Avenue, Saks OFF 5th, Lord & Taylor)5 millionPayment card dataHackYes
[24]7.ai (Sears, Delta Air Lines, Kmart stores)UnknownPayment card dataUnknownNo

March 2018

Company#BreachedInformation ExposedCauseProtective Services
Orbitz880,000Name, payment card information, date of birth, phone number, email address, physical and/or billing address, genderUnauthorized accessYes
BJC HealthCare33,420Name, address, phone number, date of birth, Social Security number, driver's license number, medical insurance information, treatment-related informationMisconfigured databaseYes
NIS America (online stores)UnknownPayment card data, billing address, shipping address, email addressPhishingNo, $5 discount vouchers for online store

February 2018

Company#BreachedInformation ExposedCauseProtective Services
Massachusetts Department of Revenue39,000Business name, tax identification number, tax payment amount, tax payment date, number of employees, banking information, one Social Security numberUnknownNo
University of Virginia Health System1,882Private medical records, physical addressMalwareNo
Department of Fish and Wildlife (California)2,300Name, Social Security numberAccidental exposureNo
FedExUnknownPassport information, driver's license, security IDsCloud misconfigurationNo
Staybridge Suites (Lexington, KY)UnknownName, credit card numbersMalwareNo
Octoly12,000UnknownCloud service misconfigurationNo
Waldo County (Maine)100 (employees)W-2 information (Social Security number, payroll information, salary, withholdings, residential address)Business email compromiseYes
Western Washington Medical GroupUnknownName, address, diagnoses, medical history form, appointment dates, medical history, health care insurance billing informationAccidental exposureYes

January 2018

Company#BreachedInformation ExposedCauseProtective Services
Charlotte Housing Authority (employees)UnknownW-2 information (name, address, Social Security number, wages)Business email compromiseNo
Jason's Deli2 million cards, 164 locationsPayment card data (cardholder name, credit/debit card number, expiration date, verification value and service code)UnknownNo
Homeland Security Office of the Inspector General247,167 (current/former employees)Name, Social Security number, birth date, email address, phone number, physical address Insider TheftYes
Forever 21UnknownPayment card number, expiration date, internal verification code, cardholder name (in some instances)MalwareNo
RootsWeb Servers55,000Email, password, usernameAccidental exposureNo

December 2017

Company#BreachedInformation ExposedCauseProtective Services
Alteryx123 million American householdsAddress, phone number, consumer behavioral dataCloud leakNo

November 2017

Company#BreachedInformation ExposedCauseProtective Services
Imgur1.7 millionEmail address, passwordNetwork vulnerabilityNo
Uber57 millionName, email address, phone number, driver's license numbersHackYes (Drivers)
Valley Family Medicine8,450Name, addressEmployee errorNo

October 2017

Company#BreachedInformation ExposedCauseProtective Services
We Heart It8 millionEmail, username, encrypted passwordsHackNo
Catholic United Financial127,310Name, address, birth date, email address, insurance information, Social Security numberHackNo
Pizza HutUnknownPayment card dataHackNo
ShopRite (Ulster, NY)UnknownName, phone number, birth date, prescription information, zip code, driver's license numberHuman errorNo
Whole FoodsUnknownPayment card dataHackNo
Graton Resort and CasinoUnknownName, address, Social Security numberHuman errorYes

September 2017

Company#BreachedInformation ExposedCauseProtective Services
SonicUnknownPayment card dataHackNo
DeloitteUnknownUnknownEmail vulnerabilityNo
Equifax143 millionName, birth date, Social Security number, address, driver's license, credit card informationApplication vulnerabilityYes
Time Warner Cable4 millionUser names, account types, service information, MAC numbers, transaction numbersThird-party breachNo

August 2017

Company#BreachedInformation ExposedCauseProtective Services
Mid-Michigan Physicians106,000Name, birthdate, address, phone number, medical information, Social Security numberHackYes
Colorado Judicial Branch41,140Name, birthdate, Social Security numberUnauthorized AccessNo
The Galt House (Kentucky)UnknownPayment card informationMalwareNo
Anthem18,500 Anthem Medicare enrollesSocial Security number, Medicare informationThird-party breachYes

July 2017

Company#BreachedInformation ExposedCauseProtective Services
Virgin America3,230Login credentials, address, Social Security number, government ID information, health-related informationUnauthorized accessNo
Plastic Surgery Associates of South Dakota10,200Name, Social Security number, driver's license, state identification number, credit card information, medical information, address, date of birth, insurance informationRansomwareYes
Wells Fargo50,000Name, Social Security number, sensitive financial informationEmployee errorNo
Tewksbury Hospital1,100Name, address, birth date, phone number, gender, medical history, Social Security numberUnauthorized accessNo
Dow Jones2 millionUnknownCloud service errorNo
Verizon (Nice Systems)6 millionName, phone number, account PIN, home address, email address, Verizon account balancesMisconfigured serverNo
Avanti Markets1.6 millionPayment card data, email address, biometric authentication dataMalwareNo
Children and Youth Services (Pennsylvania)1,800Name, address, birth date, Social Security number, public health informationThird-party errorNo
White Blossom Care Center800Name, Social Security Number, birth date, health insurance information, medical informationEmployee errorYes

June 2017

Company#BreachedInformation ExposedCauseProtective Services
Atlantic Digestive Specialists94,195Name, birth date, address, telephone number, medical history, insurance information, Social Security numbersRansomwareYes
Aetna (Texas and Ohio)2,200Full name, health insurance information, payment history, medical historyUnknownNo
Southern Illinois Healthcare600Name, birth date, gender, address, medical insurance informationEmployee ErrorYes
Select Restaurants, Inc.UnknownPayment card dataHackNo
Washington State University1 millionName, Social Security number, medical informationPhysical theftYes
KMartUnknownPayment card dataMalwareNo
Victory Medical Center2,000Name, birth date, address, phone number, email address, medical account number, demographic informationData dumpNo
OneLogin (United States)UnknownUser, app, key informationUnauthorized accessNo

May 2017

Company#BreachedInformation ExposedCauseProtective Services
Chipotle2,250 locationsPayment card dataMalwareNo
AT&T (Dallas, TX)UnknownDriver's license numberHack/Stolen credentialsYes
Florida Department of Agriculture and Consumer Services16,190Name, weapon license number, Social Security numberHackYes
Brooks Brothers220 locationsName, payment card number, expiration date, verification codeMalwareNo
DocuSignUnknownEmail addressThird-party hackNo
Bronx Lebanon Hospital Center7,000Mental health and medical diagnoses, HIV status, sexual assault and domestic violence reports, name, address, addiction history, religious affiliationThird-party vulnerability/server misconfigurationNo
Yankee Car Wash & DetailingUnknownPayment card holder's name, card number, security codeThird-party breachYes
Gannett Co.18,000 employeesOffice 365 login credentials, emailBusiness email compromiseYes
Sabre Hospitality SolutionsUnknownPayment card dataHackNo
Harrisburg GastroenterologyUnknownName, demographic information, Social Security number, health insurance information, medical historyUnauthorized accessNo
City of Fitchburg1,800Social Security numberUnauthorized accessNo
Home Depot8,000Spreadsheet of customers' personal/transaction informationEmployee error/technical glitchNo

April 2017

Company#BreachedInformation ExposedCauseProtective Services
Med Center Health160,000Name, address, Social Security number, insurance information, procedure codesPhysical theft (Insider theft)Yes
Internal Revenue Service (IRS) Data Retrieval Tool (fafsa.gov)100,000FAFSA informationHackNo
GameStopUnknownPayment card dataUnknownNo
Westminster College (Fulton)UnknownW-2 formsBusiness email compromiseYes
InterContinental Hotels Group (IHG)1200 hotelsPayment card dataMalwareNo
Fashion Fantasy Game2,436,258Email addressSystem vulnerabilityUnknown
Schoolzilla1.3 millionSocial Security number, test scores, personal informationCloud storage vulnerabilityNo
Lifespan20,000Name, medical record number, address, medication prescriptionsPhysical theftNo
Iowa Veterans Home (IVH)2,969Name, address, phone number, medical information, Social Security numberPhishingNo
Behavioral Health Center (Bangor, Maine)4,000Social Security number, medical informationUnknownYes
AIDS Drug Assistance Program (California Public Health Department)94UnknownUnauthorized accessYes

March 2017

Company#BreachedInformation ExposedCauseProtective Services
Yahoo32 millionUser accountsUnauthorized access/account vulnerability (forged cookies)No
Georgia election system (Kennesaw State University)UnknownVoter recordsHackNo
VerifoneUnknownEmployee passwords, one customer support unitHackNo
Weekends Only (Online Shopping Only)8,000Payment card dataUnknownYes
U.S. Air Force4,000Name, address, military rank, Social Security number, phone number, contact info of spouseUnauthorized access (hard drive not password protected)No
Cincinnati Eye Institute500 employeesSocial Security numberThird-party breachYes
Wishbone2,487,000Email address, name, username, phone numberUnknownNo
UNC Health Care1,300Social Security number, medical historyAccidental exposureNo
American Job Link AllianceUnknown; 10 states (Alabama, Arkansas, Arizona, Delaware, Idaho, Illinois, Kansas, Maine, Oklahoma, Vermont)Name, date of birth, Social Security numberThird-party BreachUnknown
Apple300 millioniCloud accountHackNo
Urology AustinUnknownName, address, birth date, Social Security number, medical recordsRansomwareYes
Daytona State CollegeUnknownFinancial aid forms (Social Security number, name, address, birth date, driver's license info, salary info)UnknownYes
Krystle Property Management, Inc.UnknownProperty documents, property management software files, letters, Excel spreadsheets, name, address, phone number, Social Security numberRansomwareNo

February 2017

Company#BreachedInformation ExposedCauseProtective Services
InterContinental Hotels GroupUnknownPayment card data MalwareNo
Arby's355,000Payment card dataMalwareNo
PIP Printing CompanyUnknownHighly sensitive documentsSoftware vulnerabilityNo
Crow and Northern Cheyenne Tribes20,000Name, address, birth date, tribal enrollment informationStolen hardwareNo
American Senior Communities17,000 employeesW-2 formsBusiness Email CompromiseYes
Family Service (Rochester)UnknownName, address, birth date, Social Security number, driver's license number, insurance ID number, medication informationRansomwareYes
Lexington Medical Center (SC)UnknownName, Social Security number, W-2 formsUnauthorized accessYes
Louisiana Health Cooperative8,000Name, Social Security number, health insurance informationThird-party breachYes
Meridian Health Services1,200W-2 formsBusiness email compromiseNo
CloudPets800,000Voice recordingsHackNo

January 2017

Company#BreachedInformation ExposedCauseProtective Services
U.S. Army (Health Workers)Unknown; 11GB of dataSocial Security number, name, address, salaryNetwork vulnerabilityNo
Topps (Trading card company)UnknownName, email address, physical address, phone number, payment card dataHackNo
eSports Entertainment Association (Esea)1,503,707Username, email address, password, birth date, phone number, game console ID nameHackNo
Highmark Blue Cross Blue Shield of Delaware19,000Name, Social Security number, health insurance informationRansomwareYes
Sentara Healthcare5,454Name, medical record number, birth date, Social Security number, demographic information, medication informationThird-party breachYes
PopeyesUnknownPayment card dataMalwareNo
Copilot Support Services220,000Name, gender, birth date, address, phone number, health insurance information, Social Security numberUnauthorized accessYes
Tipton County Public Schools (employees)UnknownW-2 form informationEmployee errorNo
UGI Utilities (Pennsylvania)1,900UnknownPhishing emailNo
TransPerfectUnknownW-2 forms, payroll informationPhishing/Business Email CompromiseNo
Van's Honda (Wisconsin)UnknownName, Social Security number, address, phone numberThird-party breachNo
Marin SoftwareUnknownW-2 forms, name, Social Security number, address, email, salary, birth datePhishing/Business Email CompromiseNo
Scotty's Brewhouse4,000W-2 formsBusiness Email CompromiseYes
Lexington County (SC) School District Two1,300W-2 formsBusiness Email CompromiseNo

December 2016

Company#BreachedInformation ExposedCauseProtective Services
Google1 millionEmail address, authentication tokensMalwareNo
University of Wisconsin-Madison Law School1,213Name, Social Security numberHackNo
Daily Motion87.6 millionUser account information, encrypted passwordHackNo
Quest Diagnostics Inc.34,000Phone number, lab resultsUnauthorized accessNo
Frederick County Public Schools 1,000Name, Social Security number, date of birthData dumpNo
Yahoo1 billionName, phone number, birth date, encrypted passwords, security questionsHack/Unauthorized accessNo
Lynda.com55,000PasswordsUnauthorized accessNo
University of Nebraska LincolnUnknownName, grade level, student ID informationUnknownNo
Community Health Plan of Washington400,000Name, address, birth date, Social Security number, health-claims informationNetwork vulnerabilityYes
Columbia County School District (Georgia)UnknownName, Social Security number, birth date (employee data)HackNo
Bleacher ReportUnknownName, username, passwordUnauthorized accessNo
New Hampshire Department of Health and Human Services15,000Name, address, Social Security number, Medicaid identification numberUnauthorized access/Data Dump (social media)No
Medical Marijuana Online Portal (Nevada)12,000Birthdate, Social Security numberData dumpNo

November 2016

Company#BreachedInformation ExposedCauseProtective Services
The U.S. Office of the Comptroller of the CurrencyUnknownActivity and staff recordsInsider theftNo
The Red Cross Blood Service (Australia)550,000 donors; 1.3 million files exposedName, gender, email address, mailing address, phone number, birth dateSecurity flaw/Accidental exposureNo
Integrity Transitional Hospital29,514Lab test results, health insurance data, driver's license informationUnknownNo
Broward Health Medical CenterUnknownFull name, date of birth, address, phone number, Social Security number, insurance information, medical information, emergency contact/next of kin informationPhysical theftNo
Friend Finder Networks412 millionEmail address, password, date of visits, browser info, IP address, site membership statusHackNo
Michigan State University400,000Name, Social Security number, MSU identification numberUnauthorized accessYes
Madison Square Garden Company (Madison Square Garden, Radio City Music Hall, Beacon Theatre, The Chicago Theatre)UnknownPayment card dataUnknownNo
U.S. Navy134,386Name, Social Security numberThird-party compromiseYes

October 2016

Company#Breached Information ExposedCauseProtective Services
Central Ohio Urology Group300,000UnknownUnknownYes
Hutchinson Community FoundationUnknownPersonal and financial informationHack/RansomwareYes
Vera BradleyUnknownPayment card dataMalwareNo
Modern Business Solutions58 millionName, IP address, birth date, email address, vehicle data, occupationHack/Data DumpNo
Katy Independent School DistrictUnknownName, birth date, Social Security number, state ID number, email address, zip codeThird-Party Hack/Unauthorized AccessYes
Weebly43,430,316 Email address, username, IP address, passwordUnknownNo
Indian Banks3.2 millionPayment card dataHackNo
Habitat for Humanity of Michigan4,600 individual profiles; "hundreds of background and credit check profiles"Social Security number, other personally identifiable informationVulnerability/HackNo

September 2016

Company#BreachedInformation ExposedCauseProtective Services
Kimpton Hotels and Restaurants62 locationsPayment card dataMalwareNo
The University of Alaska Anchorage (Mat-Su Campus)5,416Name, Social Security numberUnauthorized accessYes
The Hutton Hotel (Nashville, TN)UnknownPayment card dataMalwareNo
VolPtalkUnknownPasswordUnauthorized accessNo
ClixSense6.6 millionPassword, birth date, IP address, email address, account balance, payment historyUnauthorized access/hackNo
University Gastroenterology (Rhode Island)UnknownName, address, birth date, Social Security number, medical billing informationUnauthorized accessYes
Bluesnap324,000Name, email address, IP address, payment card data, phone number, address, transaction historyThird-party breach/Data dumpNo
Genghis Grill UnknownPayment card dataMalwareNo
Yahoo500 millionName, email address, phone number, birth date, password, security questionsUnknownNo

August 2016

Company#BreachedInformation ExposedCauseProtective Services
U.S. Democratic PartyUnknown20,000 sensitive emailsHackNo
Disney Playdom (Interactive Forums)355,000 Username, email address, passwordHackNo
Prosthetic and Orthotic Care Inc. (Missouri and Illinois)UnknownName, contact information, P&O ID number, billing information, Social Security number, birth date, insurance information, photos of proceduresHackYes
Kimpton Hotels and RestaurantsUnknownPayment card dataUnauthorized accessNo
Banner Health3.7 millionName, birth date, address, physician name, dates of service, clinical information, Social Security number, insurance informationHackYes
Oracle Corporation (Micros point-of-sale systems)330,000PasswordMalwareNo
Newkirk Products (Blue Cross, Blue Shield Kansas City)790,000Name, address, insurance informationUnknownYes
Jefferson Medical AssociatesUnknownName, birth date, Social Security number, address, phone number, prescription informationUnauthorized accessNo
Bon Secours650,000Name, Social Security number, insurance information, banking information, other medical informationUnauthorized access to the publicNo
Hyatt, Sheraton, Marriott, Westin Hotels (10 states and District of Columbia)20 locationsPayment card data HackNo
Social Blade (Main site and forum)286,095Email, IP address, passwordUnauthorized access via software vulnerabilityNo
The NSAUnknownExploit codesHackN/A
Eddie Bauer (U.S. and Canada)350 retailersPayment card dataMalwareYes
Epic Games Forum800,000Username, email address, birth dateHackNo
Ashley Madison36 millionUser account detailsUnauthorized access via security vulnerabilityNo
Kentucky Fish and WildlifeUnknownName, address, birth date, last 4 digits of Social Security number, email addressUnauthorized accessNo
Opera Sync service1.7 millionUsername, passwordUnauthorized accessNo
SCAN Health Plan (California-based)87,000Name, address, phone number, Social Security number, medical information, date of birthUnauthorized accessNo
Dropbox68 millionUsername, passwordHackNo

July 2016

Company#BreachedInformation ExposedCauseProtective Services
Muslim Match (international)150,000Username, password, email, IP address, private messages between users, profile informationHackNo
Planned Parenthood (Dubuque, Iowa)2,506Name, date of birth, address, insurance information, Social Security number, medical recordsUnauthorized accessNo
North Carolina State University38,000Name, address, university ID number, Social Security numberPhishingNo
DataDog (Amazon Web Services, Microsoft Windows Azure, Google Cloud Platform, Java)UnknownLogin credentialsUnauthorized accessNo
Omni Hotels UnknownPayment card dataMalwareNo
The Federal Deposit Insurance Corporation (FDIC)44,000 individuals

30,715 banks

1,200 sensitive documents
Kaiser Permanente (Northern California)1,100Medical recordsPhysical theftNo
Ubuntu2 millionUsername, email address, IP addressUnauthorized access via security flawNo
Beggars Group (Independent record label)UnknownPayment card dataHackNo
Cici's PizzaUnknownPayment card dataMalwareNo
Clash of Kings (mobile game)1.6 millionUsername, email address, IP address, Facebook data, passwordHackNo
Athens Orthopedic Clinic397,000Name, address, Social Security number, date of birth, telephone number, medical recordsUnauthorized access through third-party vendorNo

June 2016

Company#BreachedInformation ExposedCauseProtection Services Offered?
Myspace (nationwide)360 million
Email address, password
Tumblr (nationwide)65 millionEmail address, password
Cici’s PizzaUnknownPayment card dataThird-party breach
Milwaukee BucksUnknownEmployee W-2 dataPhishing scam: fake CEO email
Washington State Liquor and Cannabis BoardUnknownSocial Security number, driver's license number, financial information, tax information, attorney-client privileged informationHuman errorNo
JTB Corporation (Japan)7.93 millionName, address, email address, passport numberPhishing email/Human errorNo
Sutter County Superior Courthouse (California)UnknownSocial Security number, birthday, address, driver's license numberUnauthorized accessNo
VerticalScope (Canada)45 millionUsername, user ID, email address, encrypted password, IP addressHackNo
Vermont Department of Fish and Wildlife1.7 millionName, address, license informationUnauthorized accessNo
AcerUnknownName, address, payment card number, card expiration date, CVV security codeUnauthorized accessNo
SP+ Municipal Services (parking garages)UnknownPayment card dataMalwareNo
Mercy Medical Center (California)520Medical records, name, date of birth, Social Security number, phone number, addressInsider third-partyNo
Hard Rock Hotel & Casino (Las Vegas)UnknownPayment card dataMalwareNo
Noodles & Company (Minnesota/Wisconsin)UnknownPayment card dataMalwareNo
Massachusetts General Hospital (Dental practice)4,300Name, date of birth, Social Security number, medical recordsUnauthorized access/third-party breachNo
Pandora RadioUnknownPasswordIndirect hackNo

May 2016

Company#BreachedInformation ExposedCauseProtection Services Offered?
Kiddiecare (UK)794,000Name, address, phone number and email addressHuman error
Brunswick Corp. (nationwide)13,000Employees’ W-2 forms
Phishing scam: fake CEO emailYes
Poway Unified School District36,000Name, address, phone number, medical information, birth date, academic test results and occupation of parentsHuman errorNo

April 2016

Company#BreachedInformation ExposedCauseProtection Services Offered?
Minecraft Pocket Edition (nationwide)7 millionUsername, email address and “weakly” encrypted passwordsThird-party breach (Lifeboat)No
dōTERRA (nationwide)Unknown
Name, Social Security number, payment card information, date of birth, postal and email address, telephone number, and username and password
Third-party breach
BeautifulPeople.com (nationwide)1.1 millionName, password, dates of birth, email address, personal description, beauty rating, car ownership statuses, drinking habits, smoking habits, education levels, gender, location, home ownership status, income, IP address, job title, interests, physical attributes, sexual preferences and website activityHack
Voya Financial Advisors (nationwide)UnknownName, address, date of birth, last four digits of the Social Security number, [driver’s license, passport or other government issued photo ID number], telephone number, email address, employer, account numbers and balances for various financial accounts, and other financial information such as income and net worthUnauthorized access
Lucky Pet (nationwide)UnknownName, address and payment card informationThird-party vulnerabilityNo
Naughty America and Suite 703 (nationwide)3.2 millionEmails, usernames, encrypted passwords, IP addresses and locationsHackNo

March 2016

Company#BreachedInformation ExposedCauseProtection Services Offered?
Cox Communications (GA)40,000Employees’ names, email addresses, phone numbers and work-related data UnknownNo
LAZ Parking (nationwide)14,000Employees’ W-2 formsPhishing scam: fake CEO emailYes
Sprouts Farmers Market (nationwide)20,000Employees’ W-2 formsPhishing scam: fake CEO emailYes
Seagate Technology (CA)UnknownEmployees’ W-2 formsPhishing scam: fake CEO emailYes
Snapchat (CA)UnknownEmployee payroll informationPhishing scam: fake CEO emailYes
Rosen Hotels & Resorts (FL)UnknownName, card number, expiration date and internal verification codeMalwareNo
Barbara Ann Karmanos Cancer Center (MI)2000Name, hospital name, patient numbers, and physicianHuman errorNo
Turner Construction Company (nationwide)UnknownEmployees’ names, Social Security numbers, state in which wages or taxes are reported, and federal, state, local and Medicare earnings and tax withholding dataHuman errorYes
21st Century Oncology Holdings (nationwide)2.2 millionPatients’ names, Social Security numbers, physicians’ names, diagnosis and treatment information and insurance information.HackYes
1-800-Flowers.com (nationwide)7,000Name, address, email address, payment card number, expiration date and CVV codeHackNo
UC Berkley (CA)80,000The personal and financial information, including Social Security numbers, of students, alumni, current and former employees.HackYes
Ozaukee County (WI)190Employees’ and elected officials’ W2 and 1095 formsCracked passwordYes

February 2016

Company#BreachedInformation ExposedCauseProtection Services Offered?
TaxSlayer (nationwide)9,000Name, address, Social Security number, dependents’ Social Security numbers and other data contained on your 2014 tax returnUnauthorized accessYes
Gyft (nationwide)UnknownName, contact information, birth date, gift card numbers and potentially account credentialsUnauthorized accessNo
Apple Health (WA)91,000Date of birth, Social Security number, Apple Health client ID numbers and private health informationEmployee theftYes
Radiology Regional Center (FL)480,000Name, Social Security number, address, phone number, financial information and medical dataHuman errorYes
Uknowkids.com (nationwide)1,700Childrens’ text messages, images, names, dates of birth, GPS information and social media account credentials"Ethical" hackNo

January 2016

Company#BreachedInformation ExposedCauseProtection Services Offered?
Time Warner Cable (nationwide)320,000Email addresses, passwordsPhishing or third-party breachNo
Indiana University Health Arnett (IN)30,000Patient names, dates of birth, phone number, medical record numbers, dates of services, diagnoses and treating physicians’ names.
Human errorNo
TaxAct (nationwide)450Tax return informationUnknownYes
Northwest Territories Power Corporation (Canada)UnknownCustomer names, meter addresses and account balancesHuman errorNo
Centene Corporation (nationwide)1 million Medicare recipients Name, address, date of birth, Social Security number, member ID number, and health informationHuman errorYes
Wendy's (nationwide)UnknownPayment card dataUnknownNo

December 2015

Company#BreachedInformation ExposedCauseProtection Services Offered?
VTech (worldwide)5 millionParent’s name, email address, download history, password, mailing address; child’s name, gender, birthdate and uploaded pictures Unauthorized accessNo
Elephant Bar Restaurant (CA, CO AZ, MO, NM, FL)UnknownName, payment card account number, card expiration date, and verification codeMalwareNo
Middlesex Hospital (CT)900Name, address, date of birth, medical record number, medication, date of service and the date of diagnosisPhishingYes
JD Wetherspoon (United Kingdom)650,000Name, email address, birth date; 100 customer payment cardsHackNo
Optus (Australia)31,150Name, address, dates of birth, email, phone number, and history of debt collectionHuman errorNo
Swiss Cleaners (CT)UnknownName, card number, expiration date, and a verification codeMalwareNo
Unknown (nationwide)191 million votersNames, addresses, phone numbers, birth dates, gender, ethnicity, date you registered to vote, party affiliation, National Do Not Call List status, absentee voter status and some email addressesUnknownNo
Hyatt Hotels (nationwide)UnknownPayment card dataMalwareNo
LiveStream (worldwide)UnknownNames, email addresses, encrypted passwords, birth dates and phone numbersUnauthorized accessNo
SanrioTown (worldwide)3.3 millionNames, birth dates, genders, countries of origin, email addresses, hashed passwords and forgotten password questions and answersUnknownNo
HealthSouth Rehabilitation Hospital of Round Rock (TX)1359Names, addresses, birth dates, Social Security numbers, insurance IDs, phone numbers, diagnoses, referral IDs and medical record numbersTheftYes
Oregon Department of Veterans’ Affairs (OR)967DD214 forms — including names, Social Security numbers and birth datesUnknownYes

November 2015

Company#BreachedInformation ExposedCauseProtection Services Offered?
British Gas (United Kingdom)2,200Email addresses, passwordsHuman errorNo
TalkTalk (United Kingdom)28,000Names, email addresses, birth dates, phone numbers and limited payment card dataHackNo
Vodafone (United Kingdom)2,000Names, phone numbers and limited bank account dataHackNo
North Carolina Department of Health and Human Services (NC)1,615Name, address, Medicaid ID number, gender, race, ethnicity, provider name, provider ID number and insurance informationHuman errorNo
Muhlenberg Community Hospital (KY)UnknownName, address, phone numbers, birthdate, Social Security number, driver’s license/state identification number, medical and health plan informationMalwareYes
University of Cincinnati Health (OH)1000Names, birth dates, personal health information and some Social Security numbersHuman errorNo
Georgia Secretary of State Election Office (GA)6 millionVoter information, Social Security numbers, dates of birth and driver’s license numbersHuman errorNo
Starwood Hotels and Resorts (nationwide)UnknownName, payment card number, expiration date and security codeMalwareYes
Hilton Worldwide (nationwide)UnknownNames, payment card numbers, security codes and expiration datesMalwareYes

October 2015

Company#BreachedInformation ExposedCauseProtection Services Offered?
T-Mobile/ Experian (Nationwide)15 millionNames, addresses, birth dates, Social Security numbers, driver’s license numbers and passport numbersHackYes
Hilton Worldwide (Nationwide)UnknownPayment card dataMalwareYes
Scottrade (Nationwide)4.6 millionNames, addresses and possibly Social Security numbersHackNo
Patreon (Nationwide)2.3 millionUsernames, emails, encrypted passwords and addresses along with 14 GB of website code and other data.HackNo
CarePlus Health Plans (FL)1, 400Names, addresses, and CarePlus identification numbers.Human errorNo
Affinity Health Plan (nationwide)UnknownChild’s name, address and member identification numberHuman errorNo
Barrington Orthopedic Specialists (IL)1, 009Patient names, dates of birth and EMG results and reportsTheftNo
Blue Cross and Blue Shield of North Carolina (NC)2, 300 individuals Some individuals had their names, addresses, internal BCBSNC account numbers, group numbers, coverage dates and premium amounts exposed. Others had their type of health plan, health insurance marketplace identification number, payment amounts, telephone number and payment identification numbers exposed.Human errorNo
American Thrift Store (AL, GA, LA, MS, TN)UnknownCard numbers and expiration datesMalwareNo
Dow Jones (nationwide)3, 500Payment card and contact informationHackNo
Uber (nationwide)1,000High-quality photocopies of drivers’ licenses, W-9 tax forms, insurance certificate, commercial vehicle registration and other personally identifiable information.System glitchNo

September 2015

Company#BreachedInformation ExposedCauseProtection Services Offered?
Utah Food Bank (UT)10,385Donors’ names, addresses, email addresses, payment card numbers, CVC codes and expiration dates.Unauthorized accessYes
The Brunswick Hotel & Tavern (Nationwide)2,600Names and payment card informationMalwareYes
Heritage Foundation (Nationwide)UnknownDonor informationHackNo
ReverbNation (Nationwide)3.8 millionE-mail addresses and encrypted passwords; possibly names, addresses, phone numbers, and/or dates of birth Third party compromiseNo
Hawaii First Federal Credit Union (HI)UnknownNames, addresses, Social Security numbers and bank account numbers. Unauthorized accessYes
We End Violence (CA)80,000Usernames, passwords, email addresses, gender, race relationship status and other private detailsHackNo
Excellus BlueCross BlueShield (NY)10.5 millionNames, addresses, telephone numbers, Social Security numbers, financial account information and in some cases sensitive medical dataHackYes
Charlotte-Mecklenburg Schools (NC)7,000 job applicantsNames, addresses and Social Security numbersUnauthorized accessNo
Oakland Family Services (MI)16,000Names, addresses, telephone numbers, dates of birth, internal client ID numbers, health plan ID numbers, insurance numbers, dates of services, programs and types of services, and diagnoses. Social Security numbers were exposed for 173 clients.PhishingYes, for those with exposed SSNs.

August 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
IllinoisIllinois Department of Corrections1,000 employeesNames, ranks, salaries, job duties, and Social Security numbers.Unknown2015/08No
United KingdomCarphone Warehouse2.4 millionNames, addresses, dates of birth, unencrypted bank details and encrypted credit card dataHack2015/08No
Rhode Island University of Rhode Island3,000Email addresses and passwordsHack2015/08No
NationwideWeb.com93,000Names and addresses, and credit card information. (Card validation codes were not compromised.)Hack2015/08Yes
NationwideTotally Promotional14 clients in New Hampshire, undisclosed nationwideNames, mailing and email addresses, payment card data (number, expiration date, and verification code).Malware2015/08No
TexasKaty Independent School District11,658 current and former employeesNames, mailing addresses, dates of birth, and Social Security numbers.Third-party error2015/08Yes
ColoradoColorado's Office of Information Technology3,000 residentsNames, addresses, state identification numbers, Medicaid information, names of family members, employer information, income, limited tax data, and some Social Security numbers.Employee error2015/08Yes
NationwideGoMohu.com2,500Names, addresses, email addresses, phone numbers and payment card information (number, expiration data and CVV code).Malware2015/08Yes
ConnecticutUniversity of Connecticut School of Engineering200 research sponsors, 1,800 Lync users and unknown number of individualsExposure varies; leaked data could include login credentials, payment card information and Social Security numbersMalware2015/07Yes

July 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
NationwidePlanned ParenthoodUnknownEmails, salted passwords, employee informationHack2015/07No
New JerseyBreakwater BeachUnknownPhotocopied Social Security cards, driver’s licenses, birth certificates, passports, student IDs, tax forms, seasonal work agreements, minor consent forms and employment eligibility forms.Employee error2015/07No
NationwideAshley MadisonUnknownUsers’ names, addresses, payment card transactions and relationship fantasies; employees network account information, emails and documents; and the company’s bank account data and salary information. Hack2015/07No
CanadaWalmart Canada60,000Payment card informationThird Party Data Breach2015/07No
CaliforniaUCLA Health Systems4.5 million names, dates of birth, Social Security numbers, Medicare and health plan identification numbers and medical data of patientsHack2015/07Yes
NationwideCVS PhotoUnknownPayment card informationThird Party Data Breach2015/07No
NationwideArmy National GuardUnknownSocial Security Numbers, dates of birth, and home addressesEmployee error2015/07No
NationwideMedical Informatics Engineering3.9 millionName, address, phone number, birth date, Social Security number, and health insurance policy and coverage information.Hack2015/07Yes
GeorgiaDepartment of Human Services Division of Aging Services9,500Names and medical informationEmployee error2015/07No
NationwideHanesbrands900,000Name, phone number, address and the last four digits of payment cardsHack2015/07No
NationwideService Systems AssociatesNine zoosPayment card informationMalware2015/06No
NationwideThe Trump Hotel CollectionUnknownPayment card informationHack2015/06No
MarylandMeritus Medical Center1,029 patientsNames, dates of birth, ages, genders, medical record numbers, and treatments and/or diagnosis information, health insurance information and Social Security numbersEmployee theft2015/05No
MichiganFireKeepers Casino85,000Payment card informationHack2015/04Yes

June 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
AustraliaWoolworthOver $1 million worth of e-gift cardsNames, emails and e-gift codesEmail error
NationwideU.S. Federal Government Office of Personnel Management21.5 millionEmployee background checksHack2015/05Yes
NationwideFred's Inc.650 stores impactedPayment card informationMalware2015/06No
CaliforniaMissing Link Networks Inc.UnknownNames, dates of birth, payment card numbers and billing address.Malware2015/06No
CaliforniaUC Irvine Medical Center4,859Patient names, dates of birth, addresses, employment status, health plan information, diagnoses, medical tests and prescriptionsEmployee theft2015/06No
New YorkMontefiore Medical Center12,517Patient names, addresses, dates of birth, Social Security numbers, next of kin information and health insurance detailsEmployee theft2015/06Yes
PennsylvaniaHershey ParkUnknownPayment card informationUnauthorized access2015/05No
MinnesotaUniversity of Minnesota24 professorsUnknown Unknown 2015/06

May 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
NationwideHarbortouch Point-of-Sale Systems4,200 businesses
Customer payment card information
CaliforniaUC Berkeley260 students and individualsSocial Security and bank account numbersUnauthorized access2015/04Yes
Las VegasHard Rock Hotel & CasinoUnknownPayment card informationMalware2015/04No
NationwideSally Beauty Inc.UnknownPayment card informationUnknown2015/05No
MissouriSt. Louis Federal ReserveUnknownOnline banking credentialsDomain Name System Hijacking2015/05No
IllinoisChicago Public Schools4,000Names, addresses, medical information and student ID numbersHuman error2015/05No
NationwideAdult Friend Finder4 millionUsers’ dating information, email addresses, usernames, dates of birth and zip codes.Hack2015/05No
CaliforniaConsolidated Tribal Health ProjectUnknownNames, date of birth, addresses, financial information, health insurance information, medical information and Social Security numbers.Employee theft2015/05Yes
NationwideCareFirst Blue Cross Blue Shield1.1 millionNames, email addresses, birthdates, usernames and subscriber numbers.Hack2015/05Yes

April 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
NationwideBiggby CoffeeUnknownName, address, phone number, email address, employment historyHack2015/04No
NationwideSend GridUnknownUsernames, email addresses and passwordsHack2015/04No
Pennsylvania Intermedix750Name, date of birth, Social Security number, name of insurance company, balance owed on the patient’s account in 2012, and record identifier.Employee Theft2015/04Yes
Massachusetts Life Care Center of AttleboroUnknownNames, addresses, Social Security numbers, dates of birth, diagnoses, and other medical status, assessment information and possibly financial information.Human Error2015/03Yes
NationwideWhite Lodging Services CorporationUnknownPayment card information used at food and beverage retailersMalware2015/03No
NationwideHSBC685 in New Hampshire, unknown elsewhereCurrent and former mortgage customers’ names, Social Security numbers, account information, and phone numbersHuman Error2015/03Yes

March 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
Nationwide (concentrated in Washington, Oregon and Alaska)Permera Blue Cross 11 millionName, address, email address, telephone number, date of birth, Social Security number, member identification number, medical claims information and in some cases, bank account informationHack2015/03Yes
OregonAdvantage Dental150,000Names, Social Security numbers, birthdates, phone numbers and home addressesMalware2015/03Yes
United States and EuropeMandarin Oriental HotelsUnknownPayment card informationMalware2015/03No
NationwideHilton HonorsUnknownHilton Honors points, travel history, email address, physical address and the last four digits of payment cardVulnerability2015/03No
NationwideTwitchUnknownUsernames, names, birth dates, email addresses, phone numbers, address and limited credit card information (card type, truncated card number and expiration date).Hack2015/03No
NationwideNatural GrocersUnknownCustomer payment card information (but no PINs)Database attack2015/02No
NationwideUber50,000 driversNames and Drivers’ License numbersUnauthorized access2015/02Yes
NationwideSlackUnknownUsernames, email addresses, and Skype IDsHack2015/03No
United KingdomBritish AirwaysUnknownExecutive Account informationHack2015/03No
MinnesotaAssociated Dental500Addresses, birth dates, names, and Social Security numbers Theft2015/03

February 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
NationwideAnthem80 millionNames, birthdates, addresses, email addresses, health IDs, employment information, income data and Social Security numbers.Hack2015/02Yes

January 2015

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
NationwideChick-fil-AUnknownPayment card informationUnknown2014/12Yes
NationwideStarwood Hotels & ResortsUnknownStarwood Preferred Guest loyalty accountsReused login credentials2015/01No
MinneapolisMetropolitan State UniversityUnknownEmployees’ Social Security numbers and personal information of students, staff and faculty.Unknown2015/01No

December 2014

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
Illinois, Pennsylvania, WashingtonSP+Unknown, but 17 facilities were impactedDebit and credit card informationMalware2014/04/14 to 2014/11/10No
NationwideShutterfly (Treat, Tiny Print, and Wedding Paper Divas)UnknownEmail addresses and passwordsHack2014/11/18No
NationwideBebe Stores Inc.UnknownCredit and debit card informationMalware2014/11/18 to 2014/11/28Yes
CaliforniaSony Pictures30,000 Sony and Deloitte employeesEmployees: salaries, gender, race, possibly Social Security Numbers. Corporate: unreleased movies, company passwordsHack2014/12/04No
Florida, MarylandVisionworks75,000Partially encrypted health information and encrypted credit card informationHuman error2014/12/01No
MarylandPrince George's County Public Schools10,000Social Security numbers, dates of birth and employee identification numbersHuman error2014/12/04No
MissouriSt. Louis Parking CompanyUnknownCredit and debit card informationCyber attack2014/10/06 to 2014/10/31No
CaliforniaUniversity of California, Berkeley1,600Social Security numbers, credit card numbers and drivers’ licensesCompromised server2014/09/26Yes
NevadaSands CasinoUnknown, employees and guestsSocial Security numbers, bank account information and drivers’ licensesCyber attack2014/12/15Yes
Pennsylvania and New JerseyIndependence Blue Cross12,500Names, addresses, member identification numbers, healthcare plans and members’ group numbers. 8,800 Social Security numbers were also released.Employee error2014/10Yes, to those who had their SSN exposed.

November 2014

LocationCompany#BreachedInformation ExposedCauseDateProtection Services Offered?
ArizonaArizona State Retirement System44,000Names, Social Security numbersUnsecure storage2014/11/03Yes
Delaware, New JerseyCape May-Lewes Ferry60,000Payment card detailsmalware2014/11/06Yes
NationwideUSPS800,000 employees and 2.9 million customersEmployees: names, dates of birth, Social Security numbers, addresses, dates of employment and other information. Customers: names, home addresses, phone numbers and email addresses.Hack2014/11/10Yes, for employees and retirees.
NationwideStaples1.6 million payment cardsCardholder names, payment card numbers, expiration dates and card verification codesMalware2014/07/20 to 2014/09/16Yes
NationwideHome Depot (update)53 millionEmail addressesHack2014/11/11Yes

October 2014

LocationCompany#BreachedInformation ExposedCauseDate of Entry
NationwideMBIAUnknownUsernames, passwords, account numbers and balancesHack2014/10/07
NationwideJPMorgan76 million households, 7 million small business accountsNames, phone numbers, internal categories (auto, home), addresses and email addressesHack2014/10/04
UnknownKmartUnknownCredit and debit card numbersMalware2014/10/14
NationwideGoodwill (update)868,000Credit and debit card numbersMalware2014/09/17
NationwideTelecom305,000Social Security numbers, names, addresses, driver's license numbers and phone numbersUnsecure storage2014/10/28
NationwideYourTel America305,000Social Security numbers, names, addresses, driver's license numbers and phone numbersUnsecure storage2014/10/28

September 2014

LocationCompany#BreachedInformation ExposedCauseDate
North CarolinaCounty of HertfordUnknownSocial Security numbers of delinquent tax payersEmployee error2005 - 2013
NationwideSignature Systems108 customers Payment card detailsmalware07/2014 - 09/2014
CaliforniaViator1.4 millionPayment card details, email addresses, passwords and Viator "nicknames"Hack9/02/2014
TexasBexar County Sheriff’s Office100Employee informationUnknown Vulnerability9/20/2014
AlabamaAmerican Family Care2,500Work-related injuries, physicals, immunizations, drug screens and possibly Social Security numbers.Stolen laptop8/15/2014
GeorgiaCox Communications52Names, addresses, email addresses, Secret Questions/Answers, PINs, (in some cases) the last four digits of Social Security numbers or driver’s licenses. Hack09/16/2014

August 2014

LocationCompany#BreachedInformation ExposedCauseDate
GlobalMailPoet Potentially 1.7 million usersAny information stored within a compromised user's website. Access to these users' sites enable hackers to upload files to the web server and disseminate phishing scams and malware. Vulnerability/bug in the plugin. 07/2014
FloridaTotalBank72,000 customers Names, addresses, account numbers, and account balances, as well as personal identification numbers, which could be Social Security numbers, driver's license numbers, passport numbers, and alien registration numbers.Unauthorized system access.07/2014
North CarolinaDuke University Health SystemUnknownNames, medical record numbers, physician names, and Duke University hospital locations visited (in some cases).Theft07/2014
CaliforniaStubHubOver 1,600 users Users' accounts hacked to fraudulently purchase $1 million in tickets Russian and American hackers breached StubHub accounts.03/2013
NationalCVS Caremark350 customersNames and full lists of medications.Programming error07/2014
NationalJimmy John'sUnknown from 43 statesPossibly credit/debit card informationPayment system hack Unknown
NationalBackcounty GearUnknownNames, addresses, purchase information, and credit and debit card numbers.Malware04/2014 - 07/2014
WashingtonSeattle University
UnknownNames, bank routing numbers and checking account numbers. Incorrect permission setting.02/2014
CaliforniaBartell Hotels40,000-45,000Names and credit card numbersHack02/2014 - 05/2014
CaliforniaCalifornia State University6,036Names, addresses, birthdates and Social Security numbersHack08/2013
TexasHermann Health Systems10,604Names, addresses, medical record numbers, birthdates, health insurance information, and Social Security numbers (in some cases).Employee theft12/2007 - 07/2014
CaliforniaAltaMed Health Services2,995Names, addresses, birthdates, email addresses, telephone numbers, Social Security numbers, provider information and insurance informationEmployee theft06/2014
NationalGoodwill IndustriesUnknown, customers from 21 statesCredit/debit card informationA payment system hack dating back to mid-201302/2013 - 08/2014
NationalDairy QueenUnknownPossibly credit/debit card informationMalwareUnknown
NationalThe Home DepotUnknown, all U.S. and Canada stores breached.Credit/debit card information, zip codesMalware04/2014 - 08/2014
NationalUPSUnknown, 51 storesCredit/debit card informationMalware01/2014 - 08/2014
NationalVarious websites1.2 billion usersLogin credentials from 420,000 websites.Hack08/2014

July 2014

LocationCompany#BreachedInformation ExposedCauseDates
CaliforniaBlueShield of California18,000 customersNames, Social Security numbers, business addresses, business telephone numbers, medical groups and practice areas.Employee error03/2013 - 04/2014
TexasThe Houstonian HotelUnknown/10,000 customers notifiedCredit/debit card informationThe U.S. Secret Service notified the hotel that a “malicious software attack” had compromised their payment processing systems beginning in December 2013.12/2014 - 07/2014
PennsylvaniaPenn State College of Medicine1,176 alumniSocial Security numbersSchool network computer infected with malware had been communicating with an outside computer.08/2013 - 04/2014
New Jersey Jersey City Medical Center1,400Medical and health insurance informationHuman error2014/07

June 2014

LocationCompany#BreachedInformation ExposedCauseDate
New YorkNRAD Medical Associates97,000 Social Security numbers and health insurance information A former employee accessed a patient database without authorization. (Currently, the data does not appear to have been sold or further transmitted.)

Actions: NRAD is notifying those impacted and is adding security measures to billing and patient databases.
CaliforniaButler UniversityAbout 163,000 employees and studentsNames, dates of birth, Social Security numbers and bank account information.Hackers might have gained unauthorized access to the Butler University computer network. (This information was revealed during an investigation related to the arrest of a suspect in possession of a flash drive containing personal information of Butler University’s faculty, staff, students and alumni.)2013/11/- 2014/05
Massachusetts and VermontMulti-State Billing ServicesNearly 3,500 studentsMedicaid identification numbers and Social Security numbers. A password-protected laptop containing students’ unencrypted personally identifiable information was stolen from the vehicle of a Multi-State Billing Services employee.2014/06
CaliforniaStanford Federal Credit UnionAbout 18,000 Names, addresses, member numbers, tax identification numbers, loan offers and credit information.A Stanford Federal Credit Union employee inadvertently included the personally identifiable information in an email sent to a member. 2014/04
CaliforniaAT&TUnknownSocial Security numbers and call records were stolen.A third-party vendor gained unauthorized access to AT&T customer data that could be used to “unlock” older cell phones. 2014/04
IllinoisP.F. Chang China Bistro7 million customersCredit and debit card numbers were stolen.A lawsuit was filed in June. The complaint states, “P.F. Chang’s security failures enabled hackers to steal financial data from within PlF. Chang’s systems…” 2013/20 - 2014/06
Montana Montana Health Department1.3 million citizensSocial Security numbers, bank account information, names, addresses, dates of birth and medical recordsA hacker gained illegal access to a computer server housing the compromised data.
2013/07 - 2014/05
New YorkBuffalo Heart Group600Names, date of birth, phone number, addresses, appointment schedule, and billing information.Third-party theft2014/06
New York New York City Health and Hospitals Corporation90,000Names, birth dates, addresses, phone number, medical information, health insurance information, treatment date, services provided and Social Security numbers.Employee theft2014/06
New HampshireUtility Recovery GroupUnknownNames, birth dates, addresses, phone number, medical information, health insurance information and Social Security numbers.Employee theft2014/06

April 2014

LocationCompany#BreachedInformation ExposedCause of BreachDate
CaliforniaKaiser Permanente5,100 Involved patients participating in specific research studies and may have compromised their names, birth dates, medical record numbers, lab results associated with research, addresses and additional medical research dataInfected with malicious software10/2011 - 02/2014
New YorkThe Rochester Housing Authority180Names and Social Security numbersEmployee errorUnknown
IowaIowa State University18,949Student ID numbersHack04/2014
IowaIowa State University29,780Social Security numbersHack04/2014
NationalLaCieUnknownCustomers’ names, addresses, email addresses, and payment card numbers and card expiration dates. LaCie website user names and passwords could also have been accessedHack03/2013 - 03/2014
TexasEveryChild, Inc2,934Patients’ birthdates, Social Security numbers, Medicaid numbers, photos and other health informationStolen computers02/2014
TennesseeUniversity Urology, Knoxville,Tenn1,144Patient names and addressesEmployee theft2013-2014
CaliforniaVeterans of Foreign Wars55,000Names, addresses, and Social Security numbersHackUnknown
NationalBigMoneyJobs.com36,800Full names, home addresses, phone numbers, email addresses, website registration information, and plaintext passwordsHack04/2014
VirginiaDeltek Inc.80,000Payment card informationHack03/2014
NationalBoxee TV158,128Names, e-mail addresses, message histories, and partially protected login credentials Hack03/2014
CaliforniaSutherland Healthcare Solutions 338,700Patients' first and last names, Social Security numbers and certain medical and billing information. Birth dates, addresses and medical diagnoses may also have been includedStolen computers08/2012 - 11/2013
MichiganMDCH2,595Names and addresses, and for some individuals, dates of birth. Of those, 1,539 records also included either a Social Security number or a Medicaid identification number.Stolen Laptop and drive01/2014
CaliforniaPalomar Health5,000 Patients' names, dates of birth, diagnoses, insurance carriers and other treatment-related information. It also included 36 patients' Medicare identification numbers,Stolen Laptop and drive03/2014
TexasSpecs8,900 Employee names, addresses,
phone numbers and
Social Security numbers
Hack10/2012 - 04/2014
TexasSpecs 550,000Bank routing
numbers card
security codes
and other
payment card
and check
Hack10/2012 - 04/2014

March 2014

LocationCompany#BreachedInformation ExposedCause of BreachDate
MassachusettsBoston Medical Center15,000Patients’ names, addresses, and medical information, including what drugs they were taking, but did not include Social Security numbers or financial informationVendor error03/2014
PennsylvaniaUPMC322Names, home addresses, Social Security numbers, wage information, birth dates and bank account and routing numbers
Property theft05/2014
NationalStatista50,000Email addresses and passwordsHack12/2013 - 03/2014
NationalSmuckers Online StoreUnknownCustomer name, address, email address, phone, credit or debit card number, expiration date, and verification code.Hack12/2012 - 01/2014
PennsylvaniaSands, Bethlehem CasinoUnknownCredit card information or bank account information, as well as Social Security numbers, driver’s license numbers, and other confidential information used to initiate a line of credit, for tax reporting purposes or for gaming. HackUnknown
PennsylvaniaSands CasinoUnknownCredit card information or bank account information, as well as Social Security Numbers, driver's license numbers and other confidential information used to initiate a line of credit for tax reporting purposes or for gamingHackUnknown
NationalSally Beauty25,000Payment card dataHack02/2013 - 03/2014
North DakotaNorth Dakota University300,000Names and Social Security numbersHack02/2013
NationalComixologyUnkownUsernames, emails and encrypted passwordsHackUnknown
ColoradoValley View Hospital5,400Names, addresses, and in some cases credit card numbers, bank account numbers, Social Security numbers and phone numbersHack09/2013 - 01/2014
MarylandService Coordination Inc9,700Social Security numbers and medical informationHack10/2013
MarylandJohns Hopkins University1,307Names, email addresses and phone numbers Hack03/2014
IllinoisAssisted Living Concepts43,600 Names, address, birth dates, Social Security numbers and pay information of current and former employeesHack12/2013 - 01/2014
OhioHealthsource of Ohio8,800Patients' dates of birth, Social Security numbers, credit card numbers and some healthcare informationHack11/2013 - 12/2013
New YorkSyracuse Retired Police Officers Association300Names, addresses and Social Security numbers Employee error03/2014
VirginiaRichmond Fire Department400Names, Social Security numbersEmployee errorUnknown
NationalIRS20,000Names, Social Security numbers and addresses of employees

Employee error03/2014
New YorkNYC MTA15,000Social Security numbers, dates of birth, earnings information and other data.Employee error03/2014
MichiganCity of Detroit1,700Names, birth dates and Social Security Numbers for the current and former employees

Employee errorUnknown
CaliforniaLA County Public County Health168,500Patients’ names, medical and billing information and Social Security numbersComputer theft02/2014
CaliforniaUniversity of California, San Francisco10,000Names, dates of birth, mailing addresses, medical record numbers, health insurance ID numbers, and driver's license numbers

Computer theft01/2014
IndianaIndiana University146,000Names, addresses and Social Security numbers of students and recent graduates who attended the university on any campus from 2011 to 2014 was unsecured for more than 11 months An authentication point was not working correctly; data were accessed by Web crawlers, software that is used to improve Web searches.02/2014

February 2014

LocationCompany# BreachedInformation ExposedCause of BreachDate
IndianaIndiana University146,000Student names, Social Security numbers and addresses Employee Error02/2014
ArizonaArizona Pension System52,000Names, e-mail addresses, Social Security numbers and addresses of membersEmployee Theft10/2011
MarylandUniversity of Maryland309,079 Names, Social Security numbers, date of birth, and University identification numbersHacker02/2014
NationalForbes1,056,986 Unique emails addresses and accounts, educational accounts (.EDU)Forbes.com based emails including administrators accountsHacker (SEA)02/2014
NationalKickstarterUnknownUser names, email addresses, mailing addresses, phone numbers and encrypted passwordsHacker02/2014
NationalWhite LodgingUnknown: 14 different hotels involved Names printed on customers’ credit or debit cards, credit or debit card numbers, the security code and card expiration datesHacker03/2013 - 12/2013
TexasSt. Joseph Health System405,000Patient names, birth dates, Social Security numbers, possibly addresses. Medical information for patients was accessible, as well as bank information for current and former employees.Hacker12/2013
NationalYahoo MailUnknownUsernames and passwords Hacker01/2014
TexasMidland Independent School District14,000Birthdates, Social Security numbers of all current students from seventh grade through high school seniors, along with graduates dating to the class of 2008Stolen Laptop and Hard Drive
CaliforniaEaster Seals3,026Date of birth, health care provider information, patient identification number, health care billing information and therapy notes

Stolen Laptop02/2014

January 2014

LocationCompany# BreachedInformation ExposedCause of BreachDate
CaliforniaSnapchat4.6 Million usersUser Names and Phone NumbersHackers12/2013
MinnesotaTargetAdditional 70 MillionNames, Mailing addresses, Phone Numbers or email addressesHackers11/2013 - 12/2013
TexasNeiman Marcus1.1 MillionCredit and Debit CardsHackers07/2013 - 10/2013
VirginiaRiverside Healthcare919Patient RecordsInsider Theft09/2011 - 10/2013
WashingtonNORCOM6,000Patient Records
Fulltime and Volunteer
Firefighter personnel Data
GeorgiaPPMH6,700SSN’s DOB Diagnosis InfoPC Theft11/2013
New MexicoNMOHC12,354Names DOB Medical and Insurance informationLaptop Theft11/2013
South CarolinaDEW4,658SSN DOBInsider Theft12/2013