Largest data breaches affecting Texans in 2026: what the Texas attorney general's list shows

The Texas attorney general has posted 607 data breach reports so far in 2026. The largest is Conduent Business Services' revised report, which counts 12,784,367 Texans. 5 reports each count more than a million Texans: Conduent, DentaQuest (3,973,000), Texas Parks and Wildlife (3,087,721), Cerner (2,992,244) and DriveWealth (2,556,688). The median report counts 1,771 Texans.

Key facts, from the list as fetched again on November 13, 2026:

• 607 reports were posted between January 1 and November 10, 2026. The full list runs from Apr 1, 2025 to Nov 10, 2026 and holds 691 reports.
• Added together, the 2026 reports count 39,433,930 notices to Texans. One person can be counted in several reports, so this is a count of notices, not of people.
• 38 reports count 100,000 Texans or more. 228 count fewer than 1,000.
• Social Security numbers appear in 502 of the 607 reports (83%).
• Texas law requires a report to the attorney general when a breach affects 250 or more Texans.

What changed since November 6?

The list was fetched again on November 13, 2026. It had 17 reports posted after November 3: eight on November 6 and nine on November 10. The largest new one is from Premise Health Holding Corp, a health care provider based in Brentwood, Tennessee. It was posted on November 10 with 261,654 Texans, enough to enter the top 25 at 20th, so Frost Bank drops out.

New report	Posted	Texans affected
Premise Health Holding Corp	Nov 10, 2026	261,654
Amplifon (USA), Inc.	Nov 6, 2026	85,804
Jewish Community Center of Dallas, Inc.	Nov 10, 2026	21,909
Kalahari Management Co. LLC	Nov 10, 2026	13,319
Baker Tilly Advisory Group, LP	Nov 10, 2026	10,456
USA Waste-Management Resources, LLC	Nov 10, 2026	6,875
RevSpring, Inc.	Nov 6, 2026	6,252
Park Dental Partners, Inc.	Nov 6, 2026	2,481
Enara Health, Inc.	Nov 10, 2026	794
UFP Technologies Inc.	Nov 6, 2026	481

The table shows the five new reports of 10,000 Texans or more, plus every new report that matches an entry in this log. The other seven new reports count fewer than 1,000 Texans each.

The list also lost reports. It now holds 691 in all, against 692 on November 6. 84 of them were posted in 2025, against 101 then. One 2026 report posted by November 3 is no longer listed, so 590 remain from that period instead of 591. The attorney general's page does not say which reports were taken down or why. Every Texas count cited on this site's entries was checked against the November 13 list and is still there.

Which 2026 data breaches affected the most Texans?

These are the 25 reports posted in 2026 with the most Texans affected. Names, entity types and dates are copied from the list as Texas shows them. “Breach start” is the start date the report gives. Some reports concern breaches that began in 2024 or 2025 and were reported in 2026. Organizations with an entry in this log link to it.

Rank	Organization as Texas lists it	Entity type	Posted	Breach start	Texans affected
1	Conduent Business Services, LLC (revised submission)	Other	May 20, 2026	Oct 21, 2024	12,784,367
2	DentaQuest, LLC	Healthcare – Medical Provider	Jul 17, 2026	May 17, 2026	3,973,000
3	Texas Parks and Wildlife	Governmental Entity	Jun 26, 2026	Not listed	3,087,721
4	Cerner Corporation	Healthcare – Medical Provider	Oct 2, 2026	Jan 22, 2025	2,992,244
5	DriveWealth	Financial Services	Oct 2, 2026	Sep 4, 2026	2,556,688
6	CenterPoint Energy, Inc.	Business – Retail or Merchant	Oct 28, 2026	Aug 19, 2026	970,891
7	Carnival Corporation	Other	May 28, 2026	Apr 10, 2026	800,060
8	Frontline Education	Educational Institution	Oct 28, 2026	Aug 14, 2026	778,372
9	Texas Tech University Health Sciences Center	Healthcare – Medical Provider	Apr 27, 2026	Sep 17, 2024	738,506
10	Heights Finance Holdings Co.	Other	Aug 14, 2026	Mar 13, 2026	734,828
11	AssuranceAmerica Managing General Agency, LLC	Insurance Services	Jun 26, 2026	Mar 16, 2026	500,987
12	Episource, LLC	Other	Feb 11, 2026	Jan 27, 2025	351,562
13	TriZetto Provider Solutions	Other	Jun 2, 2026	Nov 19, 2024	312,562
14	iRhythm Technologies Inc.	Healthcare – Medical Provider	Oct 6, 2026	Jun 3, 2026	298,647
15	Medtronic Inc.	Business – Retail or Merchant	Jun 30, 2026	Apr 13, 2026	297,307
16	North Texas Behavioral Health Authority	Healthcare – Medical Provider	Mar 9, 2026	Oct 13, 2025	284,525
17	Unlimited Technology Systems, LLC	Other	Jul 23, 2026	Oct 5, 2025	277,364
18	Quantum Health, Inc.	Business – Retail or Merchant	Oct 28, 2026	May 29, 2026	273,111
19	CareCloud, Inc.	Healthcare – Medical Provider	Aug 18, 2026	Not listed	270,529
20	Premise Health Holding Corp	Healthcare – Medical Provider	Nov 10, 2026	Mar 26, 2026	261,654
21	Lone Star Community Health Center	Healthcare – Medical Provider	Aug 14, 2026	Dec 2, 2025	250,130
22	Baylor Genetics	Healthcare – Medical Provider	Aug 18, 2026	Not listed	248,430
23	Catalyst Physician Group	Healthcare – Medical Provider	Sep 15, 2026	Dec 2, 2025	242,121
24	Marathon Health	Healthcare – Medical Provider	Oct 30, 2026	Aug 24, 2026	234,534
25	Motility Software Solutions	Business – Retail or Merchant	Oct 23, 2026	Aug 11, 2025	194,755

The list counts people in Texas, so it ranks breaches differently from a nationwide list. Conduent's revised report counts 12,784,367 Texans. The company's own figure for everyone affected is in the Conduent entry. Three Texas public bodies make the top 25: Texas Parks and Wildlife, Texas Tech University Health Sciences Center and North Texas Behavioral Health Authority. Largest data breaches of 2026 by people affected ranks the same year by nationwide totals, from Indiana's report.

How many breach reports reach Texas, and how big are they?

Most are small. Of the 607 reports posted in 2026, 464 count between 250 and 9,999 Texans.

Texans affected	Reports in 2026
1,000,000 or more	5
100,000 to 999,999	33
10,000 to 99,999	87
1,000 to 9,999	254
250 to 999	210
Fewer than 250	18

The 250 line explains the shape. Organizations must report to the attorney general once a breach reaches 250 Texans, so the list holds few smaller reports. The 18 reports under 250 were either filed voluntarily or counted only the letters sent by the filing date. The attorney general's form asks for the number of Texans who have been sent a notice as of the day the report is filed. A count can be low because letters were still going out.

What personal information was exposed in Texas breaches?

Names appear in almost every report, and Social Security numbers in 83%. Each report can tick several categories.

Information type (as the list names it)	Reports	Share of 2026 reports
name	561	92%
Social Security number	502	83%
medical information	317	52%
address	316	52%
driver's license number	312	51%
date of birth	304	50%
financial account or card number	280	46%
health insurance information	259	43%
other government ID number	215	35%

Medical and health insurance information show up in 317 and 259 reports. Health care providers are the second-largest group of reporting organizations, after retail and merchant businesses.

Entity type (as the list names it)	Reports in 2026
Business – Retail or Merchant	164
Healthcare – Medical Provider	134
Other	131
Financial Services	71
Insurance Services	38
Educational Institution	38
Governmental Entity	21
Nonprofit Organization	10

How were Texans told about the breach?

By letter, mostly. 529 of the 607 reports list U.S. Mail as a notice method. Some list more than one.

Method of notice	Reports
U.S. Mail	529
Posted at company website or special website	138
Email	63
Notice by publication in print media	62
Broadcast on Texas-wide Media	23

33 reports answer “No” to whether notice had been provided to consumers when the report was filed. Texas gives organizations 60 days from determining a breach occurred to notify the people affected, and 30 days to report to the attorney general. A report can therefore reach the list before the letters do.

How is the Texas list different from other states' lists?

Texas publishes a resident count, not a nationwide total. Its public list shows, for each report, the organization's name and address, the information types involved, the number of Texans affected, whether and how consumers were notified, and the date the attorney general posted it. Indiana's report, used in the national ranking, gives both a state count and the total the organization reported. Massachusetts' report lists every report, however small, with its own residents only. Washington's list gives a state count and the breach date. Data breach notification laws by state compares the deadlines and attorney-general thresholds that decide which breaches reach each list.

Where an entry in this log matches a Texas report by name and breach dates, the entry's fact table now carries the Texas count. Frontline Education's entry is one example: 778,372 Texans.

How can I tell whether a breach affected me in Texas?

The letter is the best evidence. A company that reports to Texas must also notify the people affected, by mail, email, a website posting or statewide media. The list tells you which organizations reported and what kinds of data were involved. It does not list individuals. Why you got a breach letter from a company you never dealt with explains the vendor and contractor cases. Credit monitoring offers in breach notice letters compares what the letters offer.

How this was counted

The figures come from the Texas attorney general's data security breach report list, fetched on November 6, 2026 and again on November 13, 2026. The page loads its table from the attorney general's own database; this count reads the same records (691 reports on November 13, every one marked “Published at AG website”). A report counts as 2026 when the attorney general posted it in 2026. Ranks are by the “Number of Texans Affected” field alone. Information types, entity types and notice methods are counted per report, as the list records them. Organization names are copied as Texas spells them, including “(revised submission)” on Conduent's. Shares are rounded to the nearest whole percent.

What is the largest data breach in Texas in 2026?

By Texans affected, Conduent Business Services' revised report is largest, at 12,784,367 Texans. It was posted on May 20, 2026. Among reports whose breach start date falls in 2026, DentaQuest's counts the most Texans, 3,973,000.

Does Texas publish a list of data breaches?

Yes. The attorney general posts a listing of the breach reports it receives. It shows each organization, the number of Texans affected, the information involved and how people were notified.

How many Texans have been affected by data breaches in 2026?

The 2026 reports add up to 39,433,930 notices to Texans. People affected by more than one breach are counted more than once, so the number of different people is lower and is not published.

How long does a company have to report a data breach in Texas?

Thirty days from determining the breach occurred to report it to the attorney general, when 250 or more Texans are affected. Sixty days to notify the people affected.