October 2026: 43 California breach notices logged, up from 10 in September

The log added 43 entries in October 2026, all of them California breach notices, compared with 10 entries in September 2026.

This piece is computed from entries on this site. Every figure in it traces to the table of entries for the month, and no number comes from outside that table. Descriptions of individual incidents are attributed to the filings and notices themselves, and quoted passages are marked as such.

What the month's log contains

October 2026 has 43 entries. The log now holds 132 entries in total. Each of the 43 October entries has the same form: a California breach notice. No entry this month came from another kind of filing, so this month's data says nothing about how other disclosure routes behaved.

Of the 43 entries, 34 carry a detection date. That is the date the filing or notice itself gives for when the organisation found or was told of the incident. The timing figures below use only those 34 entries. None of the 43 entries is marked as amended, and the log shows no follow-up notice for any of the six examples discussed here.

Entries by sector

The table lists the sector counts for the month as the log records them.

Sector	Entries
Legal & professional services	10
Education	7
Health care	6
Financial services	6
Consumer & retail	4
Industrials & manufacturing	2
Government & public sector	2
Technology	2
Hospitality & entertainment	2
Real estate	1
Transportation & logistics	1

The sector label is the log's own classification of the filer. It is not a statement from the filing about the filer's business, although some filings describe themselves. The Photon Health notice, for instance, says the company is "a technology company that provides software used by healthcare providers to manage prescriptions and other aspects of patient care" . The log files that entry under Technology.

Time from detection to disclosure

Among the 34 entries with a detection date, the median gap between detection and disclosure is 75.5 days. The shortest gap is 19 days and the longest is 746 days. No entry has a gap under 8 days. In 31 of the 34 entries the gap is over 30 days.

The dates in the filings help show what sits behind those figures. The Bangkok Bank notice was disclosed on 2026-10-29. The log records a detection date of 2026-08-12, and the notice says the Branch learned of the matter then: "the Branch was informed on August 12, 2026 that your personal information may have been included in the incident" .

The Del Monte Foods notice was also disclosed on 2026-10-29, and the log records a detection date of 2026-02-09. The notice describes two separate points in time. The first is the event: The second is a later finding about personal information, which the notice says came "on or about August 20, 2026" .

The log's detection date and the date a filer learned that personal information was involved can therefore differ within a single filing. The gap figures above use the detection date as recorded.

Social engineering notices from law firms

Legal & professional services has 10 entries this month, and two of the examples describe social engineering. The Troutman Pepper Locke notice, disclosed on 2026-10-28, says that "a Troutman employee was targeted by a social engineering attack and interacted with communications that appeared legitimate but were not" . On scope, the notice states:

The Baker & McKenzie notice, disclosed on 2026-10-27, uses similar terms for a different event. The notice says "a threat actor socially engineered two of our users and obtained a limited number of files" . It also says the firm concluded that "our remediation efforts were successful, and that the incident has been contained" . The log has no detection date for this entry, so it is not part of the timing figures above.

Notices that name a vendor or third-party platform

Several October notices place the incident at a vendor or a third-party tool rather than at the filer's own network. The Bangkok Bank notice describes an audit vendor: "Mercadien discovered a data security incident that may have affected your personal information" .

The Directed Trust Company notice, disclosed on 2026-10-27, points to its e-signature platform. It says the company "became aware of suspicious activity involving our electronic signature platform, Dropbox Sign" .

The Photon Health notice, disclosed on 2026-10-28, names a software flaw. It says "an unauthorized third party exploited a previously unknown security flaw (sometimes called a 'zero-day' vulnerability) in Metabase, a third-party application that we use on a self-hosted basis for business intelligence, product metrics, and customer dashboards" . The notice gives the window as "between August 9, 2026 and August 10, 2026" .

The wording differs from notice to notice, and each one describes its own incident in its own terms. This piece does not draw a conclusion about causes from them.

What this month's data cannot show

The jump from 10 entries in September to 43 in October is a change in what the log recorded. The table does not say whether more incidents happened or whether more notices reached the log, and this piece does not claim either. Every entry this month comes from one filing route, so the sector counts and gap figures describe California breach notices only.

The timing figures depend on the detection dates the filers chose to give. Each of the 34 dated entries counts the same way regardless of what the date refers to, as the Del Monte notice shows. The count of entries with no detection date is also a feature of how the filings were written, not a finding about the filers.

Each entry linked above carries the full notice and a link to the source document, so the passages quoted here can be read in context.