Major US data breaches: where to find official notices and what to do

When a big breach hits the news, the first question is usually the same: was I in it? The second is harder: where do I find a real answer that is not a rumor, a screenshot, or a message that came out of nowhere?

This page is a map. It does not rank breaches or quote a headline number. It shows you where official notices are published, how to read one, why the figures never seem to match, and what the FTC and state officials suggest you do afterward.

Pages about specific companies, including AT&T, Conduent, Fidelity and Krispy Kreme, are on the way. This page does not state facts about those incidents. It is about the tools you can use for any of them.

Why this page does not list "the biggest breaches"

Search for the biggest data breaches and you will find ranked lists with large numbers. Those lists look tidy, but they hide a problem. There is no single official ranking of US breaches, and no single office counts them all.

Each public source sees only a slice. A state attorney general sees the notices that reach that state's office. A federal health regulator sees reports from organizations covered by health privacy rules. A company sees its own records. Press coverage adds a fourth view, built on whatever the company or a researcher disclosed.

So this page does not copy a ranking. We only repeat numbers we read in a source that we opened ourselves. If you want a size for a specific incident, go to the notice itself, or to the page of the office that published it, and read the figure in context.

The official places where notices are published

Most people never see these lists, because companies send notices by mail or email and move on. The lists are public, though, and free to search.

California Attorney General

The California Attorney General runs a searchable database of data security breach notices. According to the office, it lists organizations that sent breach notices to California residents and that submitted a sample copy to the Attorney General.

Each row shows three things:

• the organization name
• the date or dates of the breach
• the reported date, which is when the notice was filed with the Attorney General's office

You can search by organization name and by a breach date range. You can sort by name or reported date. The page also offers a full CSV download.

The office states one limit clearly. A sample notice must be provided to the Attorney General when a breach notice is sent to more than 500 California residents. A smaller incident can be real and still not show up in the list.

The page also notes that the organization that sent the notice is not necessarily the one that experienced the breach. That detail matters. A company that mails the notice may be a vendor, a bank, or a service provider that held data for someone else.

To read a notice, click the organization's name to open its report page, then click the "Sample Notification" link. That sample is usually the best single document you can read about an incident, because it is the letter people actually received.

The office's reporting page cites California Civil Code sections 1798.29 and 1798.82 for the notification requirements. It also links to "Breach Help: Tips For Consumers" and to an online complaint form for residents.

Washington Attorney General

The Washington Attorney General publishes a table of data breach notices submitted to its office under Washington law. The office says the notices are published "for public education purposes."

The table has more columns than California's list. It shows:

• the date reported
• the organization name, linked to the full notice as a PDF
• the date of the breach
• the number of Washingtonians affected
• the information compromised

Some rows show "Unknown" for the breach date or the affected count. That is worth remembering. An unknown is not a sign that nothing happened. It means the figure was not given in the table.

The Information compromised column is useful for a quick scan. It tells you at a glance whether a notice involves names and email addresses or something more sensitive.

The office also keeps a data breach resource center for people affected by a breach, which offers a glossary of general definitions to help you understand common terms.

Other state attorneys general

Other states publish breach notices too, in different formats and with different rules about what must be filed. This page only describes the California and Washington lists, because those are the ones we read. If you live in another state, search for your state attorney general's name plus "data breach notices" and check what the page says it includes. Look for the same things: who must file, what the list shows, and whether it links to the full letter.

Because rules differ, a breach that affects residents of many states may show up in some lists and not others. That is normal, not a sign of a cover-up.

The HHS Office for Civil Rights breach portal

If a breach involves health information, there is a separate federal source. The US Department of Health and Human Services, Office for Civil Rights (OCR), runs a breach portal where people can file and view reports of breaches involving health information.

The portal covers two kinds of reports: HIPAA breaches of protected health information, and breaches of substance use disorder treatment records under 42 CFR Part 2. According to OCR, the portal's reports relate to a regulated entity, meaning a HIPAA covered entity, business associate, Part 2 program, or qualified service organization.

OCR also says it investigates all breaches affecting 500 or more individuals. Breaches affecting fewer than 500 may be investigated depending on resources and enforcement priorities. After an investigation, OCR issues a closure letter, and in some cases it negotiates a written agreement and corrective action steps with the organization.

The portal does not replace the letter you receive from your provider or insurer. It is a way to check whether a health-related incident has been reported to the federal regulator, and to read how it was categorized.

The company's own notice

The company that was breached usually posts a notice on its own website and sends letters or emails. This is the version that tells you what the organization is offering, such as monitoring services and a phone line. It is often the least complete about what went wrong, so treat it as one source among several.

Always reach a company's notice by typing the company's known web address yourself, or by using a link on its real home page. Do not use a link from an unexpected message.

How to read a breach notice

Breach letters are written by lawyers and communications teams. They can feel designed to say a lot while telling you little. A few questions cut through that.

What happened, and when?

Look for the date of the breach and the date the organization found out. These can be far apart. The notice may say "between" two dates. California's list uses the same idea: it shows a date or dates of breach, and a separate reported date for when the notice reached the Attorney General.

A long gap does not tell you who was at fault. It does tell you that the information may have been exposed for a while before anyone knew.

What information was involved?

This is the most important line. The kind of data decides what you should do.

• A name and email address mostly raise your risk of phishing messages.
• A password raises your risk of someone logging in to your accounts, especially if you reuse it.
• A Social Security number, bank account number or card number calls for stronger steps.
• Health or insurance information can be used for medical identity theft and for convincing scams.

Washington's table has a column for the information compromised, which is a fast way to compare entries. In a letter, the information is often listed in a sentence near the middle. Read the whole sentence. Lists often end with "and other information."

Who sent the notice?

As California's page warns, the organization named may not be the one that was breached. If you do not recognize the sender, ask yourself whether you have ever shared data with a company that works with them. A bank, a pharmacy, a payroll provider and a school can all use outside vendors.

What is the organization offering?

Many notices offer credit monitoring or identity theft services for a limited time. The FTC says that if the organization offers free credit monitoring or identity theft insurance, you should enroll. Check three things before you do: how long the offer lasts, how you sign up, and whether you are asked for anything unusual.

An offer of monitoring is not an admission that your identity was used, and it is not a cure. Monitoring tells you about some changes. A credit freeze blocks new accounts. They do different jobs.

Does the notice tell you what to do next?

A good notice gives a phone number or a web address, a way to reach the organization, and clear next steps. A weak one only says that the organization takes privacy seriously. If a notice gives you a phone number, check it against the number on the company's real website before you call.

Why the numbers never match

You will see one figure in a news story, another on a state list, and a third in the company's letter. Several ordinary reasons explain this.

Different geography. California's list reflects notices to California residents. Washington's table shows the number of Washingtonians affected. A national total is a different figure, and a company may report it separately or not at all.

Different thresholds. California's list only includes notices that went to more than 500 California residents. The HHS portal's investigation rule uses 500 or more individuals. A smaller incident may sit in one source and not another.

Different definitions. One source may count people. Another may count records, accounts or devices. A single person can have several records.

Different dates. A company often reports an early estimate, then updates it. As Washington's table shows with "Unknown" entries, a count is sometimes not known at the time of filing.

Different filers. The organization that sends the notice may be a vendor, not the one with whom you have a relationship. The same incident can therefore appear under more than one name.

None of this means one source is lying. It means you are looking at the same event through different windows. When you compare, write down the source, the date you read it, and what the number counts. A figure without those three things is not worth much.

Is it real? How to recognize a fake notice

Breach news is a gift to scammers. They know people are worried and likely to click. The FTC describes the common pattern in its guidance on phishing.

According to the FTC, phishing messages may claim suspicious logins, an account problem or a payment issue that does not exist. They may ask you to confirm personal or financial details, include an invoice you do not recognize, push you to click a link to pay, or promise a government refund. A familiar logo or company name does not prove a message is real. The FTC adds that legitimate companies will not email or text with a link to update your payment information.

Here is a plain checklist you can run on any breach message.

1. Did you expect it? If you have no account with the company and do not know the sender, the FTC says to treat the message as likely phishing, report it and delete it.
2. Does it push you to act fast through a link? Real notices can include a web address, but you can always get to the same place by typing the company's known address yourself.
3. Does it ask for details it should already have? A notice should tell you about your data, not ask you to hand more over.
4. Does it ask you to pay? Be suspicious of any message that demands money in connection with a breach.
5. Does the contact information match the real site? Use a phone number or website you already know is real, not the contact details in the message. That is the FTC's advice if you do have an account.

If you want a second opinion, look the organization up in the California or Washington list. If the incident is there, the linked notice shows what the real letter says. Compare it with the message you received. A mismatch is a red flag.

If you suspect a message is a scam, the FTC says you can forward phishing emails to reportphishing@apwg.org, forward phishing texts to SPAM (7726), and report the attempt at ReportFraud.ftc.gov. If you already responded, and your Social Security, credit card or bank account number may be exposed, the FTC points you to IdentityTheft.gov for steps based on what was lost. If you clicked a link or opened an attachment, it says to update your security software, run a scan and remove any threats it finds.

Settlements: how to find the real site

After some large breaches, class action lawsuits or government actions end in a settlement. A settlement may let affected people make a claim. Whether you qualify, what you can claim and by what date all depend on the specific settlement. Nobody can promise you a payment from a breach, and this page does not.

What you can do is find the real site. The best route is an official one: a notice that came with the case, a court page, or a page from an agency like the FTC.

The Equifax case shows what a legitimate trail looks like. The FTC's settlement page lists the official website, the official phone number for questions, and the email addresses that legitimate settlement emails come from. It also says the claim deadline in that case was January 22, 2024, so new claims are no longer being accepted, while the administrator was still reviewing and issuing benefits for identity theft and fraud claims. That page is a good model of what to look for in any settlement: a named administrator, a clear deadline, a stated process and a way to confirm eligibility.

The FTC has also warned that fake websites can imitate an official settlement site. In its alert on the Equifax breach, it said you will never have to pay to file a claim for those benefits, and that anyone who calls to urge you to file is almost certainly a scammer. The FTC directed people to its own page to start, so they would reach the legitimate site.

Use those two lessons for any settlement:

• Start from an official page, not from a link in an unexpected text or direct message.
• Do not pay a fee to file a claim.
• Be wary of anyone who phones you and pressures you to file.

Keep your own records. Save the notice, the date, and the official page address, so you can come back to it if you need to.

What to do after you learn your data was involved

You do not need to do everything at once. Work in order, starting with the steps that cost nothing and block the most.

Step 1: Take a breath and read the notice

The FTC's own advice begins with staying calm. Then read the notice for what kind of data was involved. Everything else depends on that.

Step 2: Secure the account

The FTC says to change the password for the company involved and for any account where you used a similar one. It suggests a password manager to create complex, unique passwords that you will not reuse. It also says to turn on multi-factor authentication, which requires something beyond a password to sign in, such as a code from an authentication app or a security key. The FTC says this helps secure your account even if your password is exposed.

The FTC also says to be cautious about breach notices even for old accounts, because hackers count on people reusing passwords.

Step 3: Go to IdentityTheft.gov/databreach

The FTC points to IdentityTheft.gov/databreach for specific steps based on what was exposed, such as a password, Social Security number or bank information. We could not read the full text of that page while preparing this article, so follow the FTC's pointer and read its current guidance there.

Step 4: Check your credit reports if a Social Security number was involved

If your Social Security number was exposed, the FTC says to order your free credit reports and check for accounts you do not recognize. The Washington Attorney General's page adds that you can request a free annual credit report from each of the major nationwide credit bureaus at annualcreditreport.com or by calling 1-877-322-8228.

Step 5: Consider a credit freeze or a fraud alert

The FTC describes the options this way. A credit freeze is free and lasts until you lift it. You contact all three bureaus: Equifax, Experian and TransUnion. With a freeze in place, no one can open new credit in your name, including you, until you lift it.

An initial fraud alert lasts one year and can be renewed. You contact one bureau, which must notify the other two. The FTC says fraud alerts make lenders verify your identity before they grant new credit in your name, and that an alert does not prevent businesses from seeing your credit report. The FTC also describes an extended fraud alert, which lasts seven years and requires that you have completed an FTC identity theft report at IdentityTheft.gov or filed a police report.

Which one fits depends on your situation. This is general information, not personal financial advice. The FTC page and the bureaus' own sites have the current process.

Step 6: Use the free protection, if you want it

If the organization offers free credit monitoring or identity theft insurance, the FTC says to enroll. Read the terms first and use the sign-up address in the real notice.

Step 7: Watch for misuse

Watch your financial accounts, billing statements and credit reports for suspicious activity, as the Washington Attorney General advises. If someone is using your information, the FTC says IdentityTheft.gov can help you report it and explains how to recover.

Step 8: Expect follow-up scams

After a breach, expect messages that mention it. Some will be real follow-ups from the company. Others will be fake. Apply the checklist above every time.

Common mistakes

Clicking the link in the notice. Even a real notice can be copied. Go to the company by typing its known address.

Treating "no evidence of misuse" as an all-clear. A notice may say the organization has no evidence that data was misused. That describes what the organization has seen so far. It does not tell you what will happen next.

Changing only one password. The FTC advises changing the password for any account where you used a similar one. Reuse is how a breach at one company turns into a problem at another.

Skipping multi-factor authentication. The FTC says it helps secure an account even if the password is exposed.

Paying to claim a settlement. The FTC says you will never have to pay to file a claim in the Equifax case, and the same rule of thumb is a safe test for any claim that asks for money up front.

Relying on one list. A state list can miss a smaller incident, and a federal portal only covers certain kinds of data. If you cannot find an incident in one place, try another before concluding anything.

Giving up after one search. A notice may not appear on a public list right away. Check again later.

Who to report to

• Identity theft or misuse of your information: IdentityTheft.gov, run by the FTC. It is where the FTC says to report misuse of your information and get help recovering.
• Phishing and scam messages: ReportFraud.ftc.gov. Forward phishing emails to reportphishing@apwg.org and phishing texts to SPAM (7726).
• A complaint about how a company handled a breach in California: the California Attorney General has an online complaint form.
• Local police: Washington's Attorney General lists a report to your local police department as one option if you suspect identity theft after a breach.
• Health information breaches: HHS Office for Civil Rights, through its breach portal.

Where a free scan fits

Official lists tell you about breaches that were reported. They do not tell you which breaches include your own email address. A free scan can check your email against known breach data from Have I Been Pwned and LeakCheck, with any passwords shown masked, and can look at what appears about you on people-search sites and the public web. It takes a few minutes and needs no sign-up. It cannot tell you that you are safe, and an empty result proves nothing. It is one more way to see where your information may have ended up, so you can pick the right next step from the list above.

A short routine you can reuse

When the next big breach hits the news, you do not need to read ten articles. Try this:

1. Search the California Attorney General's list and the Washington Attorney General's table for the organization's name.
2. Open the notice and find the date, the information involved and what is offered.
3. If the information includes a health detail, check the HHS portal too.
4. Change the password for that company and any similar one, and turn on multi-factor authentication.
5. If a Social Security number was involved, get your free credit reports and think about a freeze.
6. Treat every message about the breach as unproven until you confirm it through a source you reached yourself.

That routine takes less time than reading the headlines, and it rests on documents that the people who were affected actually received.