What this site does
When an organization reports a data breach, it often files a notice with several state attorneys general, and sometimes with the U.S. Department of Health and Human Services (HHS) or the U.S. Securities and Exchange Commission (SEC). Each agency publishes its own list in its own format.
We collect those official notices, merge filings about the same incident into one page, and show what each filing says: who reported the breach, when, how many people were affected and what types of information were involved. Every fact names and links its official source.
What else you will find here
- Company pages that list every breach an organization has reported in the filings we collect.
- Data breach settlements, with deadlines and wording copied from the official settlement website.
- Opt-out pages for the data brokers registered in California, with the official opt-out link from each registration.
- Practical guides on what to do after a breach (being written).
What we do not do
- We do not give opinions about whether an organization was at fault, and we do not guess how a breach happened.
- We do not publish anyone's personal information, and we never link to leaked data.
- We are not a law firm and do not give legal advice. We are not affiliated with any government agency, court or settlement administrator.
Read more in our methodology and editorial policy.