Skip to content
cisonews.net

Substitute breach notice disclosures

cisonews.net logs 8 disclosed security incidents disclosed in substitute breach notices posted by the organization: 8 substitute breach notices, first disclosed between April 11, 2025 and October 8, 2026. The newest are Winona County, Minnesota (October 8, 2026), LHC Group, Inc. (September 4, 2026), Saint Pete MRI (July 22, 2026). Across the 7 entries that date discovery to the day, the median gap between discovery and the first disclosure is 152 days. 7 of the 8 state how many people were affected.

Breach notices an organization posted on its own website as a substitute notice, the route state laws allow when it cannot reach everyone by mail. Each entry is drafted from the posted notice.

How many substitute breach notices are in the log, by year?

8 entries, counted under the year of the first disclosure.

substitute breach notices in the log by year of first disclosure
YearEntries
20266
20252

Which substitute breach notices affected the most people?

7 of the 8 entries have a total in a regulator's breach report. The 7 largest:

Largest substitute breach notices by the total a regulator records
OrganizationPeople affected (total)Recorded by
The Hertz Corporation (Hertz, Dollar and Thrifty)1,222,756Indiana Attorney General
WestJet, an Alberta Partnership1,200,000Indiana Attorney General
Saint Pete MRI138,209HHS Office for Civil Rights
Winona County, Minnesota123,476Indiana Attorney General
Legal Services of Long Island, Inc.94,434Indiana Attorney General
Cedar Valley Services, Inc.79,152Indiana Attorney General
Colorado Health Network Inc.68,212HHS Office for Civil Rights

What information was exposed in substitute breach notices?

6 of the 8 entries list the categories of information their document says were involved. Share of those entries naming each type:

Information types named in substitute breach notices
Information namedEntriesShare
Addresses, phone numbers or email583%
People's names583%
Social Security numbers583%
Dates of birth467%
Financial account or payment card data350%
Government ID numbers (driver's license, passport, tax ID)350%
Insurance information350%
Medical or treatment information350%

How these figures are made: each is counted at build time from the entries listed below. Totals are the figure the organization reported to the regulator named, copied from the regulator's list and cited on the entry; a company's own filing may give a different number or none. Information types group the categories each entry copies from its document, so an entry counts once per type.

YearAll 3532026 2662025 342024 302023 202022 3
FormBreach notice 2508-K Item 1.05 568-K Item 8.01 29Substitute breach notice 88-K Item 7.01 5Other public record 3Class-action settlement 1State AG enforcement 1
SectorHealth care 110Financial services 62Consumer & retail 29Legal & professional services 27Technology 26Education 21Industrials & manufacturing 15Hospitality & entertainment 14Government & public sector 12Life sciences & medical devices 10Transportation & logistics 10Telecommunications 5Energy & utilities 4Real estate 4Nonprofit 2Consumer security services 1Media 1