Largest data breaches affecting Massachusetts residents in 2026: what the state's breach report shows

Massachusetts' Office of Consumer Affairs and Business Regulation had logged 1,923 data breach reports in 2026 by November 3, covering 3,851,048 Massachusetts residents. The largest is DentaQuest's, at 1,905,700 residents, about half of the year's total. Most reports are tiny: the median report counts 6 residents.

Key facts, from the report as fetched on November 6, 2026:

• 1,923 reports dated January 1 to November 3, 2026, against 1,862 reports by the same date in 2025.
• The 2026 reports count 3,851,048 residents, already more than the 3,190,380 in all of 2025's 2,196 reports. One person can appear in several reports, so these are counts of notices, not of different people.
• Four reports count more than 100,000 residents each. Together they hold 2,698,274 residents, 70% of the year's total.
• 1,120 reports, 58% of the list, count fewer than 10 residents.
• Social Security numbers are marked as breached in 1,446 reports (75%).

Which 2026 data breaches affected the most Massachusetts residents?

These are the 25 reports with the most residents affected. Names and organization types are copied as the report gives them. The reported date is the date the report reached the office, and the report number is the state's own. Where this log has an entry for the same incident, the name links to it.

Rank	Organization as Massachusetts lists it	Organization type	Reported	Report no.	Residents affected
1	DentaQuest LLC	Insurance Company	Jul 16, 2026	2026-1155	1,905,700
2	DriveWealth	Financial Services Company	Oct 2, 2026	2026-1706	317,303
3	Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA	Health Care	Jul 16, 2026	2026-1151	290,357
4	Boston Healthcare for the Homeless Program	Health Care	Aug 8, 2026	2026-1319	184,914
5	CareCloud, Inc.	Health Care	Jul 25, 2026	2026-1225	72,102
6	Conduent Business Services, LLC	Insurance Company	Feb 2, 2026	2026-150	72,066
7	Medtronic Inc.	Health Care	Jun 29, 2026	2026-1058	63,717
8	Baylor Genetics	Health Care	Aug 14, 2026	2026-1366	56,636
9	TriZetto Provider Solutions	Health Care	Feb 11, 2026	2026-202	48,857
10	City of Peabody, MA	Local Government	Feb 9, 2026	2026-193	48,492
11	Revolve Group, Inc.	Retail	Oct 29, 2026	2026-1895	46,813
12	Carnival Corporation	Hospitality Industry	May 28, 2026	2026-857	46,241
13	Xsolis, Inc	State Government	Jun 30, 2026	2026-1064	40,172
14	Navia Benefit Solutions, Inc.	Other	Mar 18, 2026	2026-417	37,498
15	Quantum Health, Inc.	Health Care	Jul 30, 2026	2026-1250	33,912
16	Marathon Health	Health Care	Oct 30, 2026	2026-1901	29,075
17	North Atlantic States Carpenters Benefit Funds	Financial Services Company	Feb 11, 2026	2026-205	28,349
18	AAA Driver Training School, Inc.	Other	Mar 5, 2026	2026-329	25,247
19	PeoplesBank	Financial Services Company	Sep 30, 2026	2026-1677	23,731
20	Orthopaedic Specialists of Massachusetts	Health Care	Jun 12, 2026	2026-973	20,147
21	Frontline Education	Educational	Oct 27, 2026	2026-1860	16,550
22	Apple American Group LLC and Apple American Group II, LLC	Hospitality Industry	Aug 18, 2026	2026-1383	16,241
23	Middlesex Sheriff's Office	State Government	Jan 30, 2026	2026-141	15,322
24	AssetMark, Inc.	Financial Services Company	Jun 12, 2026	2026-962	15,085
25	Pittsfield Public Schools	Educational	May 11, 2026	2026-746	15,000

DentaQuest's report counts 1,905,700 residents, more than the next 24 reports together. It marks Social Security numbers and medical records as breached. That one report is why the insurance company type holds 2,004,711 of the year's residents, more than half.

How many breach reports reach Massachusetts, and how big are they?

Most are very small. Massachusetts law has no minimum size for a report to the state, and the list shows it: more than half the reports count fewer than 10 residents.

Residents affected	Reports in 2026
1,000,000 or more	1
100,000 to 999,999	3
10,000 to 99,999	26
1,000 to 9,999	75
100 to 999	193
10 to 99	505
1 to 9	1,120

The office logs reports at a steady pace, from 148 in January to 226 in October:

Month (2026)	Reports
January	148
February	161
March	185
April	181
May	206
June	188
July	201
August	200
September	214
October	226
November 1 to 3	13

What personal information was exposed in Massachusetts breaches?

Each row in the report marks five kinds of information as breached or not. Counted across the 1,923 reports of 2026:

Information marked as breached	Reports	Share
Social Security number	1,446	75.2%
Financial account number	711	37.0%
Driver's license number	628	32.7%
Medical records	395	20.5%
Credit or debit card number	370	19.2%
None of the five	59	3.1%

A report can mark several kinds, so the shares add up to more than 100%.

Which kinds of organizations report the most breaches?

By number of reports, the largest groups are those typed Other (409), financial services companies (290), health care (267), and banks and credit unions (203). Commercial firms follow with 122, then manufacturing with 103. By residents affected, the order is different: insurance companies (2,004,711, mostly DentaQuest), health care (875,173) and financial services companies (449,470).

What does Massachusetts law require after a data breach?

An organization that owns or licenses a resident's personal information must give notice "as soon as practicable and without unreasonable delay" once it knows or has reason to know of a breach. The notice goes to the attorney general, to the director of consumer affairs and business regulation, and to the resident. The report to the state must include the number of Massachusetts residents affected at the time of notification and the type of personal information compromised. Those two fields are the ones this page counts.

When a breach includes Social Security numbers, the organization must offer each affected resident credit monitoring at no cost for at least 18 months. A consumer reporting agency must offer at least 42 months. The offer cannot be made conditional on the resident giving up the right to sue.

How is the Massachusetts list different from other states' lists?

Massachusetts counts every report, however small, and gives only its own residents. Texas's list holds reports of 250 or more Texans. Indiana's report, used in the national ranking, gives both a state count and the total the organization reported. Massachusetts also marks the information types for each report, which lets this page count them. Washington's 2026 notices get the same treatment in the Washington guide, ranked by the residents each one counts.

Where an entry in this log matches a Massachusetts report, its fact table carries the count: DriveWealth shows 317,303 residents, and CareCloud 72,102. How the states' notice rules differ is set out in the state breach notification laws guide.

How this was counted

The figures come from the 2026 Data Breach Notification Report, fetched on November 6, 2026. It runs from reports dated January 1 to November 3, 2026. All 1,923 rows were read, and the residents column adds up to 3,851,048, the total printed at the top of the report. The 2025 comparison uses the 2025 report the same way: 2,196 rows with a count (two rows are blank and one is marked as a duplicate), adding up to the printed 3,190,380. The 1,862 figure counts the 2025 reports dated January 1 to November 3. Ranks are by the residents-affected column. The information shares count the rows that mark each kind as breached. The report gives the date it received each report, not the date of the breach, so some 2026 reports concern breaches from earlier years.

What is the largest data breach in Massachusetts in 2026?

By residents affected, DentaQuest's report is the largest, at 1,905,700 residents, logged on July 16, 2026. The next largest are DriveWealth (317,303), Lifespan Physician Group of Massachusetts, doing business as Brown Health Medical Group-MA (290,357), and Boston Healthcare for the Homeless Program (184,914).

Does Massachusetts publish a list of data breaches?

Yes. The Office of Consumer Affairs and Business Regulation publishes a yearly Data Breach Notification Report. It lists every report with the organization's name and type, the date received, the number of residents affected and the kinds of information breached.

How many Massachusetts residents have been affected by data breaches in 2026?

The 2026 reports count 3,851,048 residents as of November 3, 2026. People affected by more than one breach are counted more than once, so the number of different people is lower and is not published.

How long does a company have to report a data breach in Massachusetts?

The law sets no fixed number of days. It requires notice as soon as practicable and without unreasonable delay to the attorney general, the consumer affairs office and the residents affected.

Do companies have to offer credit monitoring after a breach in Massachusetts?

Yes, when Social Security numbers are involved: at least 18 months at no cost, or 42 months when the company is a consumer reporting agency.