September 2026: 10 disclosed incidents logged, up from 2 in August

The cisonews.net log recorded 10 disclosed incidents in September 2026, up from 2 in August 2026, with a median of 76 days from detection to disclosure.

This piece is computed from entries on this site. Every figure in it traces to the table of entries for the month, and each description comes from the filing or notice behind an entry. The log holds 111 entries in total. This analysis covers the 10 for September 2026.

What the month's entries look like

The 10 entries came from three kinds of filing. California breach notices account for 5, Washington breach notices for 3, and SEC Form 8-K filings under Item 1.05 for 2. Financial services and health care have 3 entries each. The other four sectors in the table have 1 each.

Group	Category	Entries
Form	California breach notice	5
Form	Washington breach notice	3
Form	SEC Form 8-K, Item 1.05	2
Sector	Financial services	3
Sector	Health care	3
Sector	Government & public sector	1
Sector	Consumer & retail	1
Sector	Education	1
Sector	Technology	1

State breach notices make up 8 of the 10 entries. The log records what each filing says, so the mix of forms partly reflects where notices are posted publicly.

Time from detection to disclosure

7 of the 10 entries carry a detection date. The other 3 do not, because the filing does not give one in a form the log can record. For the 7 with a date, the median gap between detection and disclosure is 76 days. The shortest gap is 4 days and the longest is 276 days. One entry has a gap under 8 days, and 4 have gaps over 30 days.

The dates in the individual entries show the spread. The American Family Connect Insurance Company entry records detection on 2026-08-31 and disclosure on 2026-09-30. The Nishiyamato Academy entry records detection on 2026-03-27 and disclosure on 2026-09-30. The notice from Nishiyamato states when the organization learned of the access.

How filings describe what happened

The filings differ in how much they say about the method. The American Family Connect notice describes an issue in its quoting process. The notice also says what the third party did. On internal systems, the notice states a limit.

The Poppins Payroll notice names a software vendor. The notice also says what the company did after it determined the access.

The Astrana Health filing is one of the 2 Form 8-K entries. It describes calls to employees. The filing also gives its materiality date. The log records disclosure on 2026-09-23 and no detection date for this entry.

Filings that give activity windows

Several notices state a window for the unauthorized activity. The window and the date of notice can be far apart.

The City of McMinnville notice gives a window for the access and copying. The notice also says when the city determined that information relating to the recipient was affected. The log records disclosure on 2026-09-29.

The DriveWealth notice gives a short window. It says the compromise was contained within that window and that no further activity has been seen. The notice also explains how the recipient's data reached the company. The log records no detection date for this entry and a disclosure date of 2026-09-30.

The Nishiyamato notice gives its own window and uses hedged wording about the files.

Amendments and follow-up

Of the 10 September entries, 1 is an amended filing. The entries cited above, from American Family Connect, DriveWealth, Nishiyamato Academy, City of McMinnville, Poppins Payroll and Astrana Health, each carry the status "No follow-up" in the log: no later notice or filing has been recorded for them. The log updates when a company files again, so these statuses can change.

The count for the month is a count of entries, not of incidents in the world. It covers what the filings and notices disclosed and what the log has recorded. The August figure of 2 and the September figure of 10 are comparable only on that basis.