Was It Breached Secria

The 2026 data breach list, month by month

Fifteen breaches with letters or notices in 2026, each with the record its count comes from. Select a month.1,2

A month is when the first notice we read was filed or posted. Checked 4 November 2026 against the sources.

Every breach on this site from 2026

People are counted as the named record counts them. A listing reports a notice the company filed; it isn't a finding that the company was at fault.

CompanyFirst noticePeopleRecord
Under Armour21 Jan 202672,742,892Email addresses, not people.Have I Been Pwned3
Conduent8 Oct 2025California filings ran to 27 April 2026.162,224,658HHS2
TriZetto Provider Solutions6 Feb 20263,433,965HHS2
Navia Benefit Solutions18 Mar 20262,151,330HHS2
Eurail27 Mar 20261,988Washingtonians only; no total in a record we can read.Washington AG4
Canvas (Instructure)May 2026Activity detected 29 April, the company says.5No count publishedInstructure5
Carnival27 May 20265,995,277Indiana AG6
Medtronic29 Jun 20263,834,294Indiana AG6
DentaQuest16 Jul 202615,000,000HHS2
Unlimited Technology Systems21 Jul 20263,803,750HHS2
CareCloud24 Jul 20263,756,469HHS2
Aesto31 Jul 20269,540,683HHS2
AdaptHealth14 Aug 20264,115,802HHS2
Baylor Genetics14 Aug 20262,810,878HHS2
Citizens BankAs named in its California filing.19 Oct 2026No total in a record we can readCalifornia AG1

Dates are the first filing or post we read: HHS submission for health breaches, otherwise California's list, Washington's list, Indiana's report or the company's own page.1,2 Notices from late 2025 are on their own pages, such as Prosper and Aflac.

The year so far, in the order letters arrived

From the same records as the table.

  1. January

    Under Armour addresses reach Have I Been Pwned.3

  2. March

    Navia and Eurail file in California.1

  3. May

    Canvas goes into maintenance mode; Carnival files in California.5,1

  4. July

    Four health reports, from DentaQuest to Aesto.2

  5. October

    Citizens Bank files in California.1

Questions people ask

What was the biggest data breach of 2026?

Of reports first filed in 2026 on this list, DentaQuest's 15,000,000 people is the largest count of people.2 Under Armour's 72,742,892 is larger, but it counts email addresses, not people.3 Conduent's 62,224,658 was first reported in October 2025.2

Why isn't a breach I heard about on this list?

We add a breach only once we can read the company's own notice and a government record. Health breaches have their own list of every 2026 report to HHS.

Was my email in a 2026 data breach?

This site isn't an email lookup. Have I Been Pwned checks an address against the breaches it holds, Under Armour's among them.3

What should I do if I'm in one of these?

Each page has the letter and the steps. The checklist covers every data type, and the credit freeze guide covers Social Security numbers.

Sources 6
  1. Search data security breaches, California Department of Justice, Office of the Attorney General. Searched by company name. Read 4 November 2026.
  2. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV. Read 4 November 2026.
  3. Under Armour breach entry (added 21 January 2026), Have I Been Pwned. Read 4 November 2026.
  4. Data Breach Notifications, Washington State Office of the Attorney General. Read 4 November 2026.
  5. Security Incident Update and FAQs (latest update 29 September 2026), Instructure. Read 4 November 2026.
  6. Data breach year-to-date report, November 2026, Office of the Indiana Attorney General. Read 4 November 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check