Largest data breaches of 2026 by people affected: what Indiana's attorney general recorded

Indiana's attorney general has recorded 1,381 data breach notices so far in its 2026 report, and 16 of them report a million or more people affected in total. The largest totals are DriveWealth (30,000,000), DentaQuest LLC (29,000,000), Grant County Public Hospital District #2, doing business as Quincy Valley Medical Center (9,540,683), AssuranceAmerica Managing General Agency (6,998,886) and Carnival Corporation (5,995,277).

Key facts, from the report as fetched on November 5, 2026:

• 1,381 notices are listed, 1,301 of them with a total number of people affected.
• 16 notices report 1,000,000 people or more, 68 report 100,000 to 999,999, and 243 report 10,000 to 99,999.
• The median total is 1,788 people: most breach notices are small.
• The 1,381 notices together cover 2,199,230 Indiana residents.
• The totals are what each organization reported to Indiana. One person can be counted in more than one notice.

Which 2026 data breaches affected the most people?

These are the 25 largest totals in Indiana's 2026 report. Names, dates and numbers are copied from the report as it lists them. The breach date is the date the report gives for when the breach occurred; the notice date is when the organization notified Indiana residents. Organizations with an entry in this log link to it.

Rank	Organization as Indiana lists it	Notice sent	Breach date	Indiana residents	People affected in total
1	DriveWealth	Sep 29, 2026	Sep 4, 2026	460,956	30,000,000
2	DentaQuest LLC	Jul 17, 2026	May 17, 2026	139,500	29,000,000
3	Grant Co Public Hospital District #2 dba Quincy Valley Med Ctr	Aug 5, 2026	Dec 2, 2025	13	9,540,683
4	AssuranceAmerica Managing General Agency LLC	Jul 10, 2026	Mar 16, 2026	237,141	6,998,886
5	Carnival Corporation	May 27, 2026	Apr 10, 2026	85,084	5,995,277
6	Marathon Health	Oct 29, 2026	Aug 24, 2026	2,811	5,687,724
7	Heights Finance Holdings Co	Aug 11, 2026	Mar 13, 2026	182,731	4,132,834
8	Unlimited Technology Systems LLC	Jul 21, 2026	Oct 5, 2025	28,384	3,836,316
9	Medtronic Inc	Jun 29, 2026	Apr 13, 2026	90,889	3,834,294
10	TriZetto Provider Solutions	Feb 6, 2026	Oct 2, 2025	7,155	3,433,965
11	Frontline Education	Oct 26, 2026	Aug 14, 2026	66,157	3,085,266
12	Xsolis Inc	Jun 5, 2026	Jan 20, 2026	2,920	2,523,302
13	Revolve Group, Inc	Oct 29, 2026	Sep 11, 2026	10,534	1,515,073
14	Strategic Education Inc	May 29, 2026	Feb 23, 2026	21,864	1,513,518
15	Kaplan North America LLC	Mar 17, 2026	Oct 30, 2025	6,238	1,403,060
16	Central Ohio Primary Care Physicians Inc	Oct 16, 2026	Aug 17, 2026	2,191	1,351,650
17	Navigate 360, LLC	Oct 23, 2026	Nov 21, 2025	14,716	828,537
18	Old National Bank (see 2025 Report for Marquis Software Solutions)	Mar 16, 2026	Aug 14, 2025	296,283	672,075
19	BAYADA Home Health Care Inc	Jul 17, 2026	Feb 18, 2026	780	550,164
20	IMA Diligence Services LLC	May 29, 2026	Dec 8, 2025	3,392	525,306
21	Mercadien PC Certified Public Accountants	Feb 17, 2026	Sep 17, 2025	86,221	488,893
22	Erie Family Health Centers	Jul 10, 2026	Dec 10, 2025	78	483,245
23	Saber Healthcare Inc	Sep 25, 2026	May 29, 2026	7,672	427,084
24	Gulshan Management Services Inc	Jan 5, 2026	Sep 17, 2025	6,011	377,082
25	Cornerstone Staffing Solutions Inc	Sep 11, 2026	Nov 6, 2025	257	357,444

Twenty-five rows cover 118,561,678 of the people counted in the report's totals, but the same person can sit in more than one row, so the rows cannot be added into a count of people.

How many data breach notices report more than a million people?

Sixteen. Most notices are far smaller: 174 report fewer than 100 people, 366 report 100 to 999, and 434 report 1,000 to 9,999. Eighty notices give no total, only a count of Indiana residents.

People affected in total	Notices
Fewer than 100	174
100 to 999	366
1,000 to 9,999	434
10,000 to 99,999	243
100,000 to 999,999	68
1,000,000 or more	16
No total given	80

The report covers notices sent in 2026, plus 14 rows whose notice date falls in 2025 and 6 with no notice date. The newest notice dates are in November 2026.

Why do some of the largest totals look so different from the letters?

Three things explain most gaps between a breach letter and the totals in this table.

First, many letters give no total. The California copies behind most of this log's breach pages usually name the data involved but not the number of people. This log's breach pages now give the Indiana total where the report has one; the breach notification law entry explains why California copies so often lack a count.

Second, the Indiana total is what the organization reported, and it may change. DriveWealth's row records 30,000,000 people in total and 460,956 Indiana residents. Washington's list records 358,104 Washington residents for DriveWealth, LLC, for the same September 4, 2026 breach date. The DriveWealth entry gives both figures and what the company's own filing says.

Third, one breach at a vendor can appear under the names of its clients. Indiana lists Grant County Public Hospital District #2 (Quincy Valley Medical Center) with a breach date of December 2, 2025 and 9,540,683 people in total. Washington's list records a filing by Aesto, LLC for the same hospital district with the same December 2, 2025 breach date. Mercadien PC Certified Public Accountants and Bangkok Bank's New York branch carry the same September 17, 2025 breach date in Indiana's report, and the Bangkok Bank entry explains that the bank's data was in Mercadien's files.

Which of these breaches are in this log?

35 organizations in Indiana's 2026 report have an entry in this log that cites their Indiana row. The Marathon Health, Frontline Education and Revolve Group notices are the largest.

Log entry	Indiana residents	People affected in total
DriveWealth	460,956	30,000,000
Marathon Health	2,811	5,687,724
Frontline Education	66,157	3,085,266
Revolve Group, Inc	10,534	1,515,073
Central Ohio Primary Care Physicians Inc	2,191	1,351,650
Navigate 360, LLC	14,716	828,537
Mercadien PC Certified Public Accountants	86,221	488,893
Poppins Payroll Company	2,258	246,937
Sheppard, Mullin, Richter & Hampton LLP	124	204,001
Quatrro Business Support Services Inc	1,320	188,719
Opportune LLP	363	128,106
City of McMinnville	43	122,864
Hibbett Retail Inc	3,187	109,732
Tradier Brokerage, Inc	1,116	98,844
JM Bullion Inc	1,647	78,451
Troutman Pepper Locke LLP	658	63,358
STS Aviation Group	922	54,027
Midvale Indemnity and American Family Connect Insurance Company	477	52,798
MLD Mortgage Inc dba The Money Store	433	45,561
Amgen Inc	935	39,594
Del Monte Foods Corporation II Inc	187	27,092
Baker & McKenzie LLP	53	25,837
Magna Hospitality Group	35	25,623
American Board of Preventive Medicine	142	23,692
Lincoln Property Company Commercial LLC	91	19,300
Toyo Tire Holdings of Americas Inc	74	17,707
Deposition Solutions LLC dba Lexitas	15	14,361
Apollo Management Holdings LP	4	7,506
Baanx U.S. Corp	112	6,594
Sarasota US Topco Inc dba Sarku Japan	98	6,424
Nishiyamato Academy	1	5,507
City of Foster City	3	5,135
NCH Corporation	466	5,031
Aldrich Services LLP	4	3,202
Bangkok Bank PCL - New York	1	460

Each entry gives the Indiana row as its supporting passage, along with the filed letter and any other regulator record. The October 2026 analysis adds up the October notices that carry a total.

Which states publish how many people a breach affected?

Indiana and Washington both publish a running list, but they count different things.

• Indiana lists, for each notice, the number of Indiana residents and the total number of people affected that the organization reported. That makes it one of the few public places to find a nationwide figure for a breach that the letter itself leaves out.
• Washington lists the number of Washington residents affected, the date reported, the breach date and the kinds of information compromised, with a link to the notice. It does not give a nationwide total. Quantum Health's Washington filing is an example: it says the company mailed notice letters to 5,909 Washington residents on August 14, 2026.

A state's resident count and a nationwide total should never be compared as if they were the same unit. When this log quotes either one, it says which.

How can I tell if I was affected by one of these breaches?

The letter is the only document addressed to you. If you got one, the organization's name on it is the name to look up in Indiana's report or in this log, which usually has the filed copy of the same letter. If the letter came from a company you never dealt with, it is often a vendor that held your data for a business you did deal with; the guide to letters from companies you never dealt with walks through how to read them. A total in a state report tells you how big the breach was, not whether you were in it.

How long does it take for a breach to reach these lists?

It varies widely. In Indiana's report the gap between the breach date and the notice date runs from days to more than a year for some rows: Monroe University's row gives a breach date of December 9, 2024 and a notice date of January 2, 2026. The guide to how long companies take to notify measures the same gap for the California filings in this log.

How this was counted

The counts come from Indiana's 2026 year-to-date report, downloaded on November 5, 2026 and read row by row: 1,381 numbered rows, none missing. A row counts as having a total when its Total Affected cell is filled. Ranks are by that cell alone. Names are copied as the report spells them, including abbreviations such as Med Ctr and dba. Washington figures come from the attorney general's list as fetched the same day. Neither list is checked against the organizations' own filings here; the linked log entries do that for the organizations they cover. The report is updated through the year, so later versions may add rows or change totals.