Skip to content
cisonews.net

Guide

Largest data breaches of 2025 by people affected: what Indiana's attorney general recorded

Published 2026-11-12. Updated . By the cisonews.net Desk.

The largest data breach of 2025 in Indiana's attorney general records is Prosper Marketplace, with 13,076,476 people affected in total. TransUnion (4,461,511), University of Phoenix (3,489,274), Wolf Haldenstein Adler Freeman & Herz (3,445,537) and DISA Global Solutions (3,332,750) follow. Indiana's 2025 report lists 1,704 breach notices, and 14 of them report a million people or more.

Key facts, from the report as fetched on November 12, 2026:

  • 1,704 notices are listed, 1,635 of them with a total number of people affected.
  • 14 notices report 1,000,000 people or more, 67 report 100,000 to 999,999, and 292 report 10,000 to 99,999.
  • The median total is 1,755 people. Most breach notices are small.
  • The notices together cover 3,749,234 Indiana residents.
  • 1,630 of the notices were sent in 2025. 64 carry a 2024 notice date and eight have none.
  • The totals are what each organization reported to Indiana. One person can be counted in more than one notice.

Which 2025 data breaches affected the most people?

These are the 25 largest totals in Indiana's 2025 report. Names, dates and numbers are copied as the report lists them. The breach date is the date the report gives for when the breach occurred, and the notice date is when the organization notified Indiana residents. Organizations with an entry in this log link to it.

RankOrganization as Indiana lists itNotice sentBreach dateIndiana residentsPeople affected in total
1Prosper Marketplace IncDec 9, 2025Apr 29, 2025275,89413,076,476
2TransUnion LLCAug 26, 2025Jul 28, 202588,8984,461,511
3University of Phoenix IncDec 22, 2025Aug 13, 202556,5683,489,274
4Wolf Haldenstein Adler Freeman & Herz LLPJan 13, 2025Dec 12, 202325,4303,445,537
5DISA Global Solutions IncFeb 21, 2025Feb 9, 202461,7343,332,750
6Ahold Delhaize USA Services LLCJun 26, 2025Nov 5, 20243,5322,242,521
7Central Kentucky RadiologyJun 12, 2025Oct 16, 20248,1131,669,853
8Laboratory Services CooperativeApr 10, 2025Jul 28, 202447,1721,600,000
9SimonMed ImagingOct 10, 2025Jan 21, 20252111,275,669
10The Hertz Corporation obo Hertz Dollar and ThriftyApr 11, 2025Oct 27, 202412,3071,222,756
11WestJetSep 29, 2025Jun 13, 20258181,200,000
12Southeast Series of Lockton Companies LLCFeb 28, 2025Nov 20, 202425,7541,168,911
13Farmers Group Inc and their subsidiaries and affiliatesAug 22, 2025May 29, 20259,7931,071,172
14Community Health Center IncJan 30, 2025Oct 14, 20242511,060,936
15Columbia UniversityAug 7, 2025May 16, 20254,078868,969
16Texas Tech University Health Sciences Center El PasoJan 24, 2025Sep 17, 2024752868,133
17Motility Software SolutionsSep 29, 2025Aug 11, 20258,160766,000
18The Alcohol & Drug Testing ServicesJul 17, 2025Jul 4, 202435748,763
19McLaren Health CareJun 20, 2025Jul 17, 2024530743,131
20American First Finance LLCJul 29, 2025May 31, 202523,269689,000
21Healthcare Services Group IncAug 25, 2025Sep 27, 202417,490624,496
22700Credit LLCDec 22, 2025Oct 25, 202587,639583,652
23Texas Tech University Health Sciences CenterJan 24, 2025Sep 17, 2024252533,874
24Esse HealthJun 25, 2025Apr 21, 2025454521,167
25Pennsylvania State Education AssociationMar 17, 2025Jun 26, 202490517,487

The 25 rows add up to 47,782,038 people in the report's totals, but the same person can sit in more than one row, so the sum is not a count of people. Two rows belong to one incident: Texas Tech University Health Sciences Center and its El Paso campus reported separately, with the same breach and notice dates, and the Texas Tech entry covers both.

Several of the largest rows are breaches that happened in 2024 or earlier and reached Indiana in 2025. Wolf Haldenstein's row gives a breach date of December 12, 2023 and a notice date of January 13, 2025, more than a year later. DISA Global Solutions gives February 9, 2024 and a notice a year and twelve days after. The guide to notice delays explains why the gap can run so long.

How many data breaches were reported in 2025?

Indiana alone recorded 1,704 notices in its 2025 report. Most of them are small: 229 report fewer than 100 people and 574 report 1,000 to 9,999. Sixty-nine notices give no total, only a count of Indiana residents.

People affected in totalNotices
Fewer than 100229
100 to 999459
1,000 to 9,999574
10,000 to 99,999292
100,000 to 999,99967
1,000,000 or more14
No total given69
All notices1,704

Indiana's count is a floor for the country, not a census. The report lists the notices that reached Indiana, so a breach that no Indiana notice covers is not in it. The 2026 report is still running, and the 2026 ranking tracks it.

Why do some 2025 totals differ from what other states report?

Each organization reports its own number to each state, and the numbers do not always agree. Wisconsin's consumer protection agency, which posts a short entry for breaches reported to it or found to affect Wisconsin consumers, shows three cases where Indiana's row tells a different story.

OrganizationIndiana totalWisconsin's figureWhat explains it
700Credit583,6525.6 millionNot stated by either list
Conduent44,633 (one subsidiary); no total on the second row25+ millionIndiana has two Conduent rows, one with no total
TransUnion4,461,5114,461,511The two agree

Wisconsin lists 5.6 million people for 700Credit against Indiana's 583,652 for a breach with the same date, October 25, 2025. For Conduent, which runs back-office systems for state programs, Wisconsin lists "25+ million" people for the incident that ran from October 21, 2024 to January 13, 2025. Indiana has two Conduent rows with the same October 21, 2024 breach date: Conduent Business Services, with 5,892 Indiana residents and no total, and Conduent State & Local Solutions, with 44,633. TransUnion's figures match across the two states.

So a ranking built from one state's list is only as good as what each organization chose to report there. Where this log has another regulator's total for a breach, the entry shows both and says which is which.

Which of the 2025 breaches are in this log?

Twenty rows in Indiana's 2025 report match 19 breaches in this log: the organization and the breach date agree with the entry. Each entry gives the filed letter and the other regulators' records next to the Indiana row.

Log entryNotice sentIndiana residentsPeople affected in total
Prosper MarketplaceDec 9, 2025275,89413,076,476
University of PhoenixDec 22, 202556,5683,489,274
HertzApr 11, 202512,3071,222,756
WestJetSep 29, 20258181,200,000
Columbia UniversityAug 7, 20254,078868,969
Texas Tech University Health Sciences Center El PasoJan 24, 2025752868,133
Motility Software SolutionsSep 29, 20258,160766,000
700CreditDec 22, 202587,639583,652
Texas Tech University Health Sciences CenterJan 24, 2025252533,874
Louis Vuitton North AmericaAug 22, 20254172,000
Krispy KremeJun 16, 20254,810161,676
Healthcare InteractiveDec 2, 202529787,565
CoinbaseMay 30, 202528869,461
ConduentNov 19, 202514844,633
Rivers Casino PhiladelphiaDec 30, 202438,151
National Presto IndustriesApr 25, 202567,879
Saint Anthony HospitalSep 12, 202536,679
NucorJun 24, 2025322,461
FinastraFeb 12, 202592,350—
Sensata TechnologiesJun 5, 2025187—

Two of them, Finastra and Sensata Technologies, have Indiana rows with a count of Indiana residents but no total. Finastra reported 92,350 Indiana residents, the most of any row in this table.

What was the largest data breach of 2025?

By total people in Indiana's report, Prosper Marketplace, with 13,076,476 people and a notice dated December 9, 2025. Its row also has the largest Indiana count among the top rows, 275,894 residents. The Prosper entry has the breach window and what the company has said. Breaches that never reached an Indiana resident are not in the report, so other lists can rank the year differently.

How can I tell if I was affected by one of these breaches?

The letter is the only document addressed to you. If you got one, the name on it is the one to look up in Indiana's report or in this log, which usually holds the filed copy of the same letter. If the letter came from a company you never dealt with, it is often a vendor that held your data for a business you did deal with: the guide to letters from companies you never dealt with explains how to read one. The guide to credit monitoring offers covers what the letters offer and when the codes expire.

How this was counted

The counts come from Indiana's 2025 year-to-date report, downloaded on November 12, 2026 and read row by row: 51 pages and 1,704 rows. Each row was placed into its columns by the position of the text on the page, so a row with an empty cell keeps the cell empty. A row counts as having a total when its Total Affected cell is filled, and ranks are by that cell alone. Names are copied as the report spells them, including "obo" (on behalf of) and "dba". The notice-year count uses the Notific Sent column. A log entry is matched to a row only when the organization's name and the breach date agree with the entry. Wisconsin's figures come from its data breaches page as fetched the same day; it lists only some breaches each year.

Sources

  1. 2026-11-12 · AIndiana Attorney General, data breach year-to-date report (2025), published November 12, 2026
  2. 2026-11-12 · AWisconsin Department of Agriculture, Trade and Consumer Protection, data breaches list, published November 12, 2026

Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.