Was my data in a breach this month?

A company that loses personal information has to send letters to the people involved. Some states also want a copy, and a few publish what they receive:

Not listed doesn't mean nothing happened. Smaller breaches don't have to be filed, and your state may not publish a list. Your letter is the primary document.

A listing means the company told a regulator that a breach happened and notified the people involved. It doesn't say who. Only your own letter says your information was part of it. We say “filed a breach notice” or “listed”, never that a company “was hacked”, unless the regulator itself says so.

Same name isn't always the same company: every notice card shows the organization's state, so you can compare it with the sender address on your letter.

Maine's Attorney General took its public breach database offline on June 12, 2026 after hoax filings named companies that hadn't filed anything. When the list comes back, we'll add it.

Texas law tells the Attorney General to remove each listing within a year (Bus. & Com. Code 521.053(j), SB 768). Letters arrive late and people look things up long after, so we keep every Texas notice we have seen and mark the ones Texas has removed: “Removed from the Texas list on its 1-year schedule; kept here from our snapshot.”

Industry comes from the regulator's own category when it gives one (Texas, Washington, HHS). Otherwise it is guessed from the name (“bank”, “school district”, “clinic”…) or taken from the same organization's category on another list; those guesses are marked “category guessed from the name”. Notices we can't place go under Other.

Data types come from Washington's and Texas's own wording. California's list doesn't itemize them, and HHS lists health information only.

No email, phone number, Social Security number, name or address is ever asked for. The company name you type stays in this page: it isn't put in the address bar, sent to analytics, or saved. Analytics only get a yes/no for “found a notice”, the number of lists, and the filters you tap. The only thing saved on your device is which steps you ticked, and only if you tick one.

1. Freeze your credit at all three bureaus. Freeze your credit at all three bureaus. It's free, it lasts until you lift it, and it doesn't hurt your score. Online or by phone it takes effect within 1 business day; lifting takes about an hour. (FTC, 15 U.S.C. 1681c-1)
2. Get an IRS Identity Protection PIN. Get an IRS Identity Protection PIN so no one else can file a tax return with your SSN. (IRS)
3. Call your bank or card issuer. Call the number on the back of your card or your bank and ask whether you need a new number; watch statements. (General step)
4. Change the password. Change that password and anywhere you reused it; turn on 2-step sign-in. (General step)
5. Read your Explanation of Benefits. Read your insurer's Explanation of Benefits for care you didn't get. (General step)
6. Check your free credit reports. Check your credit reports from all three bureaus, free every week, at AnnualCreditReport.com. (FTC)
7. Or place a 1-year fraud alert. Or place a 1-year fraud alert: contact one bureau and it tells the other two. (FTC, 15 U.S.C. 1681c-1)
8. Read your letter. Read your letter: it says what was taken and any free monitoring offer and its deadline. Go to the company's site yourself and don't use links in texts. (General step)
9. If you see accounts you didn't open. If you see accounts you didn't open: report and get a recovery plan at IdentityTheft.gov. (IdentityTheft.gov)

Changing reused passwords? A list of the services you still pay for helps: Which subscriptions do you still pay for?

1. California Attorney General: data breach list (CSV export) · a sample notice sent to more than 500 California residents is filed with the AG · accessed Oct 25, 2026
2. Washington AG: data breach notifications + data.wa.gov dataset sb4j-ca4h · RCW 19.255.010(7): more than 500 Washington residents, within 30 days · accessed Oct 25, 2026
3. Texas AG: data security breach reports · Bus. & Com. Code 521.053(i)–(j), SB 768 (88R): 250 or more Texans, within 30 days; listings removed after a year · accessed Oct 25, 2026
4. HHS Office for Civil Rights: breach portal · HITECH Act 13402(e)(4): breaches of health information affecting 500 or more people · accessed Oct 25, 2026
5. Maine AG statement, Jun 12, 2026 · the public database stays offline after hoax filings · accessed Oct 25, 2026
6. RCW 19.255.010 · Washington's notice rule · accessed Oct 25, 2026
7. Texas SB 768 (88R) · Texas posting and one-year removal · accessed Oct 25, 2026
8. FTC: Credit Freezes and Fraud Alerts · freeze and fraud alert basics · accessed Oct 25, 2026
9. FTC: Free Credit Reports · free weekly reports · accessed Oct 25, 2026
10. 15 U.S.C. § 1681c-1 (fraud alerts and security freezes) · freeze within 1 business day, lift within 1 hour; 1-year alert · accessed Oct 25, 2026
11. Equifax credit freeze · phone (888) 298-0045 · accessed Oct 25, 2026
12. Experian credit freeze · phone 1-888-397-3742 · accessed Oct 25, 2026
13. TransUnion credit freeze · link only: its phone number isn't verified yet · accessed Oct 25, 2026
14. IRS: Get an Identity Protection PIN · IP PIN · accessed Oct 25, 2026
15. IdentityTheft.gov (FTC) · report and recovery plan (link only) · accessed Oct 25, 2026

• Oct 25, 2026: CA AG newest Oct 22, 2026 (5,377 notices) · TX AG newest Oct 23, 2026 (669 notices) · WA AG newest Oct 6, 2026 (1,675 notices) · HHS OCR newest Oct 1, 2026 (753 notices).
• Oct 25, 2026: launched with California, Washington, Texas and HHS. Maine offline.

Illustrations: AI-generated (Gemini), edited by plusbeauxjours.

Check whether the company filed a notice with a regulator: type its name above. Then go to the company's website yourself (not through links or numbers in the letter, a text or an email) and look for its notice. Real breach letters don't ask you for your Social Security number or a payment. This is general guidance, not an agency's rule.

Companies only have to file with a state when enough residents are affected: more than 500 Californians, more than 500 Washingtonians, or 250 or more Texans. HHS lists health-data breaches of 500 or more people. Many states don't publish a list at all, Maine's list has been offline since June 12, 2026, and a notice can take weeks to appear after the letters go out.

Not necessarily. A listing means the company told a regulator that a breach happened and sent letters to the people involved. Only your own letter says that your information was part of it.

Freeze your credit at Equifax, Experian and TransUnion; it's free. Then get an IRS Identity Protection PIN, and check your credit reports from all three bureaus, free every week, at AnnualCreditReport.com.

It's free to place and to lift, and it doesn't affect your credit score (FTC). It lasts until you lift it. Placed online or by phone it takes effect within 1 business day, and lifting it takes about an hour (15 U.S.C. 1681c-1).

A freeze blocks new credit checks on your file until you lift it, so it's the stronger step. A fraud alert asks lenders to verify your identity; it lasts one year, and you only contact one bureau because it must tell the other two (FTC).

California's list doesn't say what was taken; the sample letter does, so every line stays covered for a California-only notice. HHS lists breaches of health information without itemizing fields. Washington and Texas list the types of information involved.

No. We never ask for an email, a Social Security number or any other identifier. The search runs in your browser on public notices, and what you type is never put in the address bar, sent to analytics or saved.