Largest data breaches affecting Washington residents in 2026: what the attorney general's list shows

Washington's attorney general lists 201 data breach notices reported between January 2 and November 9, 2026. The largest is DriveWealth's, at 358,104 Washingtonians, followed by Navia Benefit Solutions (319,208) and iRhythm Technologies (220,745). Six notices count more than 100,000 Washington residents each. The median notice counts 1,977.

Key facts, from the list as read on November 13, 2026:

• 201 notices carry a 2026 report date. In the same span of 2025 (January 1 to November 9), the list holds 190.
• Added together, the 193 notices of 2026 that give a number count 2,679,821 notices to Washingtonians. Eight more give the count as unknown. One person can be counted in several notices, so this is a count of notices, not of people.
• Social Security numbers appear in 148 of the 201 notices (74%), medical information in 94 (47%) and passport numbers in 50 (25%).
• Washington law requires a business to notify the attorney general when a single breach requires notice to more than 500 Washington residents, no more than 30 days after the breach was discovered.

Which 2026 data breaches affected the most Washington residents?

These are the 20 notices reported in 2026 with the most Washingtonians affected. Names and dates are copied from the list as Washington shows them; the date of breach is the one the notice gives, which is often months before the report. Organizations with an entry in this log link to it.

Rank	Organization as Washington lists it	Reported	Date of breach	Washingtonians affected
1	DriveWealth, LLC	Oct 13, 2026	Sep 4, 2026	358,104
2	Navia Benefit Solutions, Inc. (City of Bellevue)	Mar 18, 2026	Dec 22, 2025	319,208
3	iRhythm Technologies Inc.	Oct 6, 2026	Jun 3, 2026	220,745
4	Heritage Bank	Apr 23, 2026	Feb 5, 2026	168,505
5	DentaQuest, LLC	Jul 16, 2026	May 17, 2026	153,300
6	Bolt Solutions Inc. (“bolt”)	Feb 26, 2026	Not listed	140,249
7	TriZetto Provider Solutions	Feb 6, 2026	Nov 19, 2024	76,562
8	Medtronic Inc.	Jun 29, 2026	Apr 13, 2026	64,035
9	Healthcare Interactive, Inc. (HealthNow Administrative Services)	Jan 7, 2026	Jun 17, 2025	61,225
10	Carnival Corporation	May 27, 2026	Apr 10, 2026	54,960
11	Premise Health Holding Corp	Nov 6, 2026	Mar 26, 2026	49,444
12	Caesars Entertainment, Inc.	May 19, 2026	Feb 23, 2026	44,023
13	Frontline Education	Oct 27, 2026	Aug 14, 2026	40,494
14	SoFi Technologies, Inc.	Jan 26, 2026	Dec 29, 2025	38,049
15	Aesto, LLC (Grant County Public Hospital District #2)	Aug 4, 2026	Dec 2, 2025	37,253
16	Mt. Spokane Pediatrics	Apr 30, 2026	Jan 1, 2026	29,410
17	Paylogix, LLC	Aug 14, 2026	Nov 13, 2025	28,449
18	Baylor Genetics	Aug 14, 2026	Jun 11, 2026	27,243
19	Xsolis, Inc. (Alexian Brothers Health System, Banner Health, Hendrick Medical Center dba Hendrick Health, Infirmary Health, Legacy Health, Mayo Clinic, Rochester Regional Health, UW Medicine, Virginia Hospital Center)	Jun 19, 2026	Jan 20, 2026	26,203
20	Figure Technology Solutions, Inc. (Figure Lending Corp, Figure Lending LLC, Figure Markets Credit LLC, Figure Payments Corporation)	Feb 23, 2026	Jan 28, 2026	26,128

Two of the names are vendors that filed for client organizations, and Washington lists the clients in brackets: Navia Benefit Solutions filed for the City of Bellevue, and Aesto filed separate notices for health providers, including Grant County Public Hospital District #2 and Everside Health. The Aesto entry follows those filings. Everside's own notice (21,308) and CareCloud's (20,706) were 19th and 20th on November 7; the two newcomers below pushed them out of the top 20.

What changed since November 7?

The list read on November 7 ended at a notice reported on October 13. Since then Washington has added 11 notices reported from October 23 to November 9. Two of them enter the top 20: Premise Health Holding Corp at 11th, with 49,444 Washingtonians, and Frontline Education at 13th, with 40,494.

Organization as Washington lists it	Reported	Date of breach	Washingtonians affected
Premise Health Holding Corp	Nov 6, 2026	Mar 26, 2026	49,444
Frontline Education	Oct 27, 2026	Aug 14, 2026	40,494
Revolve Group, Inc. (Revolve.com, FWRD.com)	Oct 29, 2026	Sep 11, 2026	24,859
Telecare Health	Nov 9, 2026	Jan 25, 2026	19,922
Quantum Health, Inc.	Oct 27, 2026	May 29, 2026	15,321
Amplifon (USA), Inc.	Nov 5, 2026	Jan 18, 2026	8,491
Navigate360, LLC	Oct 23, 2026	Nov 21, 2026	7,887
Del Monte Foods Corporation II Inc.	Oct 29, 2026	Feb 7, 2026	4,821
Hippo Analytics Inc.	Oct 29, 2026	Jan 30, 2025	4,053
Hands On Children’s Museum	Nov 5, 2026	Oct 6, 2026	1,001
DreamHost, LLC	Nov 4, 2026	Oct 15, 2026	871

Navigate360's breach date is copied as Washington lists it, November 21, 2026, which is after its report date; the Navigate360 entry gives the dates from the company's own notice.

The list also holds 190 notices with report dates up to October 13, against 182 counted on November 7. At least part of the difference comes from the list's pages: read newest first, they repeat some notices that share a report date and leave others out. This read found Paylogix (28,449) and AdaptHealth (9,214), both reported on August 14, 2026, only in the oldest-first order. So the figures here combine the list read three ways (newest first, oldest first and by name), with exact repeats counted once.

How many breach notices reach Washington, and how big are they?

Most notices are small. Of the 193 2026 notices with a number, 42 count 10,000 Washingtonians or more and 6 count 100,000 or more. Half count fewer than 1,977. That is close to 2025, when the median for the whole year was 1,841.

Measure	2026 (to Nov 9)	2025, Jan 1 to Nov 9	2025, full year
Notices on the list	201	190	225
Notices with a number	193	188	222
Washingtonians counted (sum of notices)	2,679,821	4,629,036	5,406,515
Median per notice	1,977	2,054.5	1,841
Notices of 100,000 or more	6	8	11

The 2026 sum is lower than 2025's although the number of notices is similar: by the same date in 2025 the list held 8 notices of 100,000 or more, against 6 in 2026. The list's newest report date when read was November 9, 2026, so notices filed since then are not yet in these figures.

Month reported	2026	2025
January	14	15
February	20	12
March	18	25
April	21	23
May	27	16
June	19	22
July	23	27
August	23	19
September	22	18
October	9	12
November	5 (to Nov 9)	16

What personal information was exposed in Washington breaches?

Washington records, for every notice, the types of information involved, from a fixed list. Across the 201 notices of 2026 (the "Other" type is left out):

Information type, as Washington lists it	Notices	Share
Name	190	95%
Full Date of Birth	153	76%
Social Security Number	148	74%
Medical Information	94	47%
Driver's License or Washington ID Card Number	89	44%
Financial & Banking Information	84	42%
Health Insurance Policy or ID Number	72	36%
Passport Number	50	25%
Protected Health Information owned or licensed by a HIPAA covered entity	23	11%
Email Address and Password/Security Question Answers	17	8%
Username and Password/Security Question Answers	16	8%
Military ID Number	11	5%
Student ID Number	11	5%
Biometric Data	6	3%
Unique Private Key (e.g. used to authenticate or sign an electronic record)	2	1%

The notice itself must give these types to the attorney general, along with the number of Washington consumers affected and the time frame of exposure.

How long after a breach do notices reach the list?

For the 192 notices of 2026 that give a date of breach, the median gap between that date and the report date is 135.5 days. 74 were reported 180 days or more after the breach date, and 24 a year or more after it.

That gap is not a measure of compliance. Washington's 30-day clock for the attorney general runs from when the breach was discovered, and the list gives the date of the breach, not the date of discovery. For how long companies take from discovery to the letter, see how long companies take to notify after a breach.

The statute also sets the deadline for letters to residents: as fast as possible, without unreasonable delay, and no more than 30 calendar days after discovery, unless law enforcement asks for a delay or the delay is needed to find the scope of the breach and restore the system.

How is Washington's list different from other states' lists?

Washington counts its own residents, and only for breaches that reach more than 500 of them, so smaller breaches do not appear. Texas sets its line at 250 Texans. The same breach therefore shows up with very different numbers: DriveWealth counts 358,104 Washingtonians here and 2,556,688 Texans on the Texas list. The state breach-law guide compares the four state lists that count residents, and the Massachusetts guide ranks that state's notices.

How this was counted

The figures come from the Washington attorney general's data breach notifications list, read on November 13, 2026, page by page in three orders: newest first, oldest first and by organization name. A notice counts once however many times it appears. A notice counts as 2026 when its report date falls in 2026. Ranks use the number of Washingtonians affected alone; the 8 notices that give the count as unknown are left out of sums, medians and ranks but counted as notices. Information types are counted once per notice. Percentages are this site's arithmetic, rounded to whole numbers.

What is the largest data breach in Washington in 2026?

By the attorney general's list, DriveWealth's: reported October 13, 2026, for a breach dated September 4, 2026, with 358,104 Washingtonians affected. Navia Benefit Solutions (319,208, filed with the City of Bellevue named) and iRhythm Technologies (220,745) follow. The largest notice reported since then is Premise Health's, with 49,444.

Does Washington publish a list of data breaches?

Yes. The attorney general's office posts the breach notices it receives on a public list, with the date reported, the organization, the date of breach, the number of Washingtonians affected and the types of information compromised.

How many Washington residents have been affected by data breaches in 2026?

The 2026 notices with a number add up to 2,679,821 notices to Washingtonians as of the November 9 report date, the newest on the list when it was read on November 13. Because one person can get letters from several breaches, the number of different people is lower and is not published.

When does a company have to tell Washington's attorney general about a breach?

When a single breach requires notice to more than 500 Washington residents, the business must notify the attorney general no more than 30 days after the breach was discovered, under RCW 19.255.010. The notice gives the number of Washingtonians affected, the types of information, the time frame, the steps taken to contain the breach and a sample of the letter sent to residents.