Largest data breaches affecting Indiana residents in 2026: what the attorney general's report shows

Indiana's attorney general lists 1,361 data breach notices sent in 2026, up to November 5. The largest is DriveWealth's, which counts 460,956 Indiana residents and 30,000,000 people in total. Five notices each count more than 100,000 Indiana residents: DriveWealth, Old National Bank (for the Marquis Software Solutions breach), AssuranceAmerica, Heights Finance and DentaQuest.

Key facts, from the attorney general's November 2026 year-to-date report, downloaded on November 14, 2026:

• The report has 1,381 rows. 1,361 give a notice date in 2026, between January and November 5. 14 give a 2025 notice date, and 6 give none.
• Added together, the 2026 notices count 2,181,246 Indiana residents. One person can be named in several notices, so this is a count of notices, not of people.
• Half of the 2026 notices count 7 Indiana residents or fewer. 305 count exactly one.
• 92 notices count 1,000 Indiana residents or more, 20 count 10,000 or more, and 5 count 100,000 or more.
• Each row gives both the Indiana residents and the total affected across all states. 16 of the 2026 notices give a total of a million people or more.

Which 2026 data breaches affected the most Indiana residents?

These are the 20 notices sent in 2026 with the most Indiana residents. Names and dates are copied from the report as Indiana prints them. The breach date is the one the report gives, so some rows concern breaches from 2025 that were reported in 2026. Organizations with an entry in this log link to it.

Rank	Organization as Indiana lists it	Notice sent	Breach occurred	Indiana residents	Total affected
1	DriveWealth	Sep 29, 2026	Sep 4, 2026	460,956	30,000,000
2	Old National Bank (see 2025 Report for Marquis Software Solutions)	Mar 16, 2026	Aug 14, 2025	296,283	672,075
3	AssuranceAmerica Managing General Agency LLC	Jul 10, 2026	Mar 16, 2026	237,141	6,998,886
4	Heights Finance Holdings Co	Aug 11, 2026	Mar 13, 2026	182,731	4,132,834
5	DentaQuest LLC	Jul 17, 2026	May 17, 2026	139,500	29,000,000
6	Medtronic Inc	Jun 29, 2026	Apr 13, 2026	90,889	3,834,294
7	Mercadien PC Certified Public Accountants	Feb 17, 2026	Sep 17, 2025	86,221	488,893
8	Carnival Corporation	May 27, 2026	Apr 10, 2026	85,084	5,995,277
9	Frontline Education	Oct 26, 2026	Aug 14, 2026	66,157	3,085,266
10	Bell American Group LLC	Aug 26, 2026	Apr 8, 2026	43,885	115,346
11	WindRose Health Network	Sep 16, 2026	Aug 3, 2026	31,572	33,158
12	Wilmer Cutler Pickering Hale & Dorr LLP	Jul 10, 2026	May 8, 2026	28,518	33,156
13	Unlimited Technology Systems LLC	Jul 21, 2026	Oct 5, 2025	28,384	3,836,316
14	Strategic Education Inc	May 29, 2026	Feb 23, 2026	21,864	1,513,518
15	Apple American Group LLC	Aug 18, 2026	Apr 8, 2026	20,215	282,573
16	Advantage Home Health Care	Aug 25, 2026	Jun 9, 2026	19,435	19,851
17	Paylogix LLC	Aug 14, 2026	Nov 13, 2025	15,027	Not listed
18	Navigate 360, LLC	Oct 23, 2026	Nov 21, 2025	14,716	828,537
19	Westminster Village Greenwood Inc	Mar 12, 2026	Feb 11, 2025	11,289	14,386
20	Revolve Group, Inc	Oct 29, 2026	Sep 11, 2026	10,534	1,515,073

The order changes a lot when it is sorted by total affected instead. DentaQuest's notice counts 139,500 Indiana residents but 29,000,000 people in all. Old National Bank's counts 296,283 Indiana residents out of 672,075, or 44% of its total. For WindRose Health Network, Advantage Home Health Care and Wilmer Cutler Pickering Hale & Dorr, Indiana residents are most of the total. Paylogix's row gives Indiana residents but leaves the total blank.

The Old National Bank row points readers to the 2025 report for Marquis Software Solutions, the vendor whose breach it concerns. This log files that breach under Marquis Software Solutions.

How many breach notices reach Indiana, and how big are they?

Most are small. Of the 1,361 notices sent in 2026, 767 count ten Indiana residents or fewer, and 305 count a single resident. Only 92 reach 1,000 residents. Indiana's law sets no minimum number of residents before a notice goes to the attorney general. Any disclosure to an Indiana resident under the law must also be made to the attorney general. That is why the list is long and its median is small.

The state-by-state guide compares Indiana's list with the lists of the other states that publish counts. The Texas, Washington and Massachusetts rankings show many of the same breaches from those states' side.

Indiana residents in the notice	2026 notices
1	305
2 to 10	462
11 to 999	502
1,000 to 9,999	72
10,000 to 99,999	15
100,000 or more	5

How does 2026 compare with 2025?

At the same pace so far. The 2025 report has 1,704 rows, and 1,630 of them give a 2025 notice date. That is about 136 notices a month. In 2026, January to October holds 1,358 notices, also about 136 a month. The 2025 notices add up to more Indiana residents: 3,700,853 for the 1,630 notices dated 2025, against 2,181,246 for 2026 so far. One breach explains the difference: PowerSchool's notice alone counts 2,103,269 Indiana residents, more than the whole gap. No 2026 notice comes close to that. The 2025 ranking of the largest breaches nationwide is in the 2025 guide.

Month notice sent (2026)	Notices
January	102
February	129
March	146
April	115
May	144
June	142
July	135
August	157
September	148
October	140
November (to Nov 5)	3

How long after a breach do Indiana notices go out?

The report gives two dates for each notice: when the breach occurred and when the notice was sent. For the 1,359 notices from 2026 with two readable dates, the median gap between them is 133 days. Of the other two, one gives no breach date and one gives a breach year of 3036, a typing error in the report, so both are left out. For the 92 notices that count 1,000 Indiana residents or more, the median is 134 days.

Days from breach to notice	2026 notices
30 or fewer	112
31 to 90	372
91 to 180	386
181 to 365	368
More than a year	121

These gaps do not show whether a notice was late. Indiana's deadline runs from when the breach was discovered, not from when it occurred: notice must go out without unreasonable delay, and no more than 45 days after the breach is discovered. The law also allows delay to restore the system, to find the scope of the breach, or at the request of law enforcement. The report does not give discovery dates. The notice-delay guide shows how far apart the occurred, discovered and notified dates can be in the letters themselves.

Who has to report a data breach to the Indiana attorney general?

The data base owner, the organization that owns or licenses the computerized data that holds the personal information. After discovering a breach, it must tell each Indiana resident whose unencrypted personal information was, or may have been, acquired by an unauthorized person when the breach could result in identity theft or fraud. It must make the same disclosure to the attorney general. A company that holds the data for someone else must tell the data base owner, which then notifies. This is why names you have never dealt with appear on the list. A payroll firm, a benefits administrator or a software vendor can be the one whose systems were breached (why you got a letter from a company you never dealt with).

When a disclosure goes to more than 1,000 consumers, the owner must also inform the consumer reporting agencies.

How can I tell whether a breach affected me in Indiana?

The letter is the best evidence. The report lists organizations and counts, not people, so a name on the list only tells you that the organization reported a breach. Search the report for the organization that wrote to you, then compare its dates with the letter. Several entries in this log quote what the letter offered, such as credit monitoring and the deadline to enroll (what the monitoring offers in breach letters mean).

How this was counted

The figures come from the Indiana attorney general's 2026 year-to-date breach report (the November edition), downloaded on November 14, 2026. Its last notice is dated November 5, 2026. The 2025 figures come from the 2025 report, downloaded the same day. Both PDFs were read row by row by column position. Every 2026 row has a row number, and the count runs from 1 to 1,381 with none missing. A notice counts as 2026 when its notice-sent date falls in 2026. Ranks use the Indiana-affected column alone. Totals are the total-affected column, copied as printed and left out where it is blank (80 of the 1,381 rows). Names are copied as Indiana prints them, including its abbreviations. A link to an entry in this log means the entry cites the same row with the same number of Indiana residents.

What is the largest data breach in Indiana in 2026?

By Indiana residents affected, DriveWealth's: 460,956 Indiana residents, in a notice sent on September 29, 2026 for a breach on September 4, 2026. By total affected, DriveWealth's is also the largest at 30,000,000, ahead of DentaQuest's 29,000,000.

Does Indiana publish a list of data breaches?

Yes. The attorney general's Security Breaches page links a list of security breaches in Indiana for each year from 2014 to 2026. Each year is one PDF, with the organization, the date the notice was sent, the date of the breach, the Indiana residents affected and the total affected.

How many Indiana residents have been affected by data breaches in 2026?

The 2026 notices add up to 2,181,246 Indiana residents. People affected by more than one breach are counted more than once, so the number of different people is lower and is not published.

How long does a company have to report a data breach in Indiana?

No more than 45 days from discovering the breach. The notice must go without unreasonable delay, and the same disclosure goes to the attorney general. The law counts a delay as reasonable when it is needed to restore the system or to work out the scope of the breach, or when the attorney general or law enforcement asks for it. Once that reason ends, notice must follow as soon as possible.