Recent Data Breaches in the USA

Every US data breach, ransomware listing and regulator filing we track, updated daily. Confirmed filings lead; unverified leak-site claims are marked.

Sourced from US state Attorney General breach notifications, SEC Form 8-K disclosures, CISA advisories and ransomware leak sites. Incidents we cannot place in the USA stay on the global tracker rather than being assumed American.

Reported to a state regulator. These are the state Attorney General registries we ingest — a filing here means the company notified that state, not that it is based there. States not listed are ones we do not yet collect.

What was exposed. Taken from what the filing itself says was involved.

By sector. Partial — we can only tell a company’s sector when its name says so, which is true of about half of them, so these counts are a floor rather than a total.

Incidents a company or a regulator has put on the record — state Attorney General breach notifications and SEC Form 8-K disclosures. These are the ones with a named, accountable source.

Listings posted by extortion groups on their own leak sites. A listing is an allegation by the attacker and nothing more — it is not confirmation that a breach occurred, or that any particular data was taken.

Federal agencies, state government, cities and counties, school districts and public universities — tracked separately because the public has a different stake in them.

Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.