Monthly edition · August 2026

Published

Data breaches in August 2026

135 data breaches were reported in August 2026, from 203 notices filed with US regulators plus new entries on Have I Been Pwned. Official notices put the number of people affected at 11.2 million or more, and 19.3 million leaked accounts were added to Have I Been Pwned. It was a quieter month after July: people affected fell 52% and leaked accounts 78%, counting the same sources, and Carhartt is about two-thirds of this month's accounts.

By Argjent Sahiti

CTO

Reviewed by Shkumbin Hasani

Principal Engineer

Key takeaways

  • 135 breaches in August 2026, down 8% on July 2026 counting the same sources.
  • The largest was Heights Finance: 4.13 million people affected, per its notice to the Texas Attorney General.
  • Names leaked in 94% of the 62 breaches whose notices listed the data.
  • Half of the breaches reached a regulator 133 days or more after they began.
  • 47 health breaches went to HHS, affecting 4.13 million people.
Breaches
135
−8% vs July 2026−3% vs August 2025
People affected
11,175,323
−52% vs July 2026−2% vs August 2025
Official notices
Accounts leaked
19,323,733
−78% vs July 2026+835% vs August 2025
Have I Been Pwned
August 2026 in numbers
MetricAugust 2026vs July 2026vs August 2025
Breaches 135−8%−3%
People affected 11,175,323−52%−2%
Accounts leaked 19,323,733−78%+835%

135 data breaches were reported in August 2026, down 8% from July 2026

Changes use the same sources in both periods. People and accounts are never added together.

Source: Official breach notices and Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download This month in numbers
Embed this chart

What happened in August 2026

We counted 135 breaches in August 2026: 203 official notices to state attorneys general, HHS and the SEC, plus breaches added to Have I Been Pwned. One organization filing in several states counts once. The count is down 8% on July 2026 and down 3% on August 2025, comparing the same sources. So far in 2026 we've counted 1,132 breaches, with at least 130.1 million people affected.

August's 135 breaches are mid-range for the last 12 months, which ran from 101 to 157 a month. With no notice on the scale of July's Aesto, the people count dropped back; the largest this month, Heights Finance, reported 4.13 million. SEC 8-K Item 1.05 filings were also unusually few this month.

August was in line with the 12-month average

Breaches

People affected (official notices)

Breaches, people affected and accounts leaked per month
MonthBreachesPeople affectedAccounts leaked
September 2025 1156,097,2579,852,406
October 2025 10164,447,51332,527,739
November 2025 1244,019,1691,967,402,864
December 2025 14528,203,8105,593,947
January 2026 1297,872,485131,149,791
February 2026 14714,010,40361,381,576
March 2026 15016,301,6505,528,583
April 2026 1169,892,46641,790,763
May 2026 1579,332,23950,334,737
June 2026 15138,348,63718,383,353
July 2026 14723,145,27089,085,270
August 2026 13511,175,32319,323,733
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download The last 12 months
Embed this chart

The biggest breaches

Ranked by people affected, from official notices:

Heights Finance was the largest breach, with 4.1M people affected

Largest breaches by people affected
OrganizationPeople affectedReportedBreach dateSource
Heights Finance 4,132,83414 Aug 202613 Mar 2026Texas Attorney General
Baylor Genetics 2,810,87814 Aug 202611 Jun 2026U.S. Department of Health and Human Services
Allied Health MSO Holdco 447,30425 Aug 2026n/aTexas Attorney General
Together Women's Health 416,26225 Aug 20262 Dec 2025Texas Attorney General
Lennar Mortgage 348,41614 Aug 202626 May 2026Texas Attorney General
American Addiction Centers 327,7547 Aug 202612 May 2026U.S. Department of Health and Human Services
Premier Medical Group of the Hudson Valley 282,07521 Aug 2026n/aU.S. Department of Health and Human Services
Lone Star Community Health Center 257,10214 Aug 20262 Dec 2025Texas Attorney General
Village Practice Management 250,8214 Aug 20262 Dec 2025Texas Attorney General
Boston Healthcare for the Homeless Program 201,2607 Aug 202631 Oct 2025U.S. Department of Health and Human Services
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download Largest breaches by people affected
Embed this chart

Heights Finance says its breach began on March 13 and exposed names, addresses, dates of birth, Social Security numbers, ID numbers and financial account numbers. Baylor Genetics, in healthcare, reported a ransomware attack dating to June 11, and its notice adds medical and health insurance information to that list.

Ranked by leaked accounts, from Have I Been Pwned:

Carhartt exposed the most accounts: 12.9M

Largest leaks by accounts exposed
OrganizationAccounts exposedReportedBreach dateSource
Carhartt 12,933,41325 Aug 202613 Aug 2026Have I Been Pwned
Oz Hair and Beauty 1,988,33119 Aug 202615 Aug 2026Have I Been Pwned
RingCentral 1,596,49013 Aug 202627 Jul 2026Have I Been Pwned
SplitVPN 865,3361 Aug 202621 Jul 2026Have I Been Pwned
Brinks Home 732,1628 Aug 202613 Jul 2026Have I Been Pwned
Golf Canada 568,97222 Aug 202614 May 2026Have I Been Pwned
Inter-Con Security 276,1145 Aug 202618 Jun 2026Have I Been Pwned
Alcon 218,3959 Aug 20261 Aug 2026Have I Been Pwned
Fanlore 144,52019 Aug 20266 Aug 2026Have I Been Pwned
Source: Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download Largest leaks by accounts exposed
Embed this chart

People affected and leaked accounts are counted separately and never added together.

What leaked

Of the 62 breaches where the notice or Have I Been Pwned listed the data involved:

Names leaked in 94% of breaches

Share of the 62 breaches where the data types are known

What data leaked
Data typeShare of breachesBreaches
Names 94%58
Social Security numbers 76%47
Physical addresses 61%38
Driver's licenses and government IDs 55%34
Dates of birth 53%33
Financial account or card numbers 50%31
Medical information 40%25
Health insurance information 29%18
Email addresses 15%9
Phone numbers 9.7%6
Geographic locations 4.8%3
Purchases 3.2%2
Source: Official breach notices and Have I Been Pwned (CC BY 4.0). Reuse with credit (CC BY 4.0).
PNG: download What data leaked
Embed this chart

Social Security numbers were in 47 of the 62 breaches and financial account or card numbers in 31. The first lets someone open new credit in your name; the second can be used on accounts you already have.

144,520 of the leaked accounts (1%) came with passwords, all of them from Fanlore.

Sectors and causes

Healthcare had the most breaches: 65

29 breaches had no sector.

Breaches by sector
SectorBreachesPeople affected
Healthcare 655,803,380
Retail 12423,059
Other 104,220,297
Finance 8577,727
Education 577,403
Manufacturing 371,528
Government 21,929
Professional services 1n/a
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download Breaches by sector
Embed this chart

Notices gave a cause for 66 breaches:

Hacking or IT incident was the most common cause, behind 58% of breaches

Share of the 66 breaches with a reported cause

  1. Hacking or IT incident 58%
  2. Unauthorized access 23%
  3. Ransomware 20%
What caused the breaches
CauseShare of breachesBreaches
Hacking or IT incident 58%38
Unauthorized access 23%15
Ransomware 20%13
Source: Official breach notices. Reuse with credit (CC BY 4.0).
PNG: download What caused the breaches
Embed this chart

Healthcare filed nearly half of the breaches, though Heights Finance puts the Other group second for people affected; hacking still led the causes, with ransomware named in 13 breaches.

Health breaches have their own register: 47 breaches of 500 or more people reached the HHS Office for Civil Rights in August 2026, affecting 4,130,283 people. The largest was Baylor Genetics (2,810,878 people).

Time to notify

For the 88 breaches where we know both dates, the median time from the start of the breach to the first public notice was 133 days. A quarter took 265 days or more.

For half of these breaches, that's more than four months of exposure before anyone got a letter.

17 organizations reported more than one separate breach in the last 12 months, including 360training.com, DentaQuest, Eyemart Express.

What it means for you

If you got a breach letter or used one of the services above, change that password. Do the same for any account that shares it, and turn on two-step verification. Expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with each of the three bureaus (Equifax, Experian, TransUnion) is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.

Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.

When a notice lists both your Social Security number and a bank or card number, freeze your credit. Then ask your bank to watch the account named in the letter.

More from this edition

Time to notify
133 days
Median from breach to public notice; 75% within 265 days. 88 breaches with both dates.
Repeat breaches
17
Organizations with 2 or more breaches in the last 12 months, such as 360training.com and DentaQuest.
Passwords exposed
0.8%
Of leaked accounts on Have I Been Pwned (144,520 accounts).
Health breaches
47
Reported to HHS (500+ people each), 4,130,283 people affected. Largest: Baylor Genetics (2,810,878).

Looking for a specific breach? Every data breach in 2026 is listed by name, biggest first, on the full list, updated daily.

Questions

How many data breaches were there in August 2026?

We counted 135 breaches from 203 official notices and Have I Been Pwned, affecting at least 11.2 million people.

What was the biggest data breach in August 2026?

Heights Finance, with 4,132,834 people affected according to its notice to the Texas Attorney General. The largest by leaked accounts was Carhartt, with 12,933,413 accounts in Have I Been Pwned.

What data leaked most often?

Names: 94% of the 62 breaches with known data types. Social Security numbers followed at 76%.

How long do companies take to report a data breach?

In August 2026 the median was 133 days from the start of the breach to the first public notice, across the 88 breaches with both dates.

Can I get my data removed from a breach?

No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.

Author

Argjent Sahiti

CTO

Leads engineering at Serus, building the systems that find and remove exposure at scale.

Reviewed by

Shkumbin Hasani

About the data

Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in August 2026 (CSV).

How we count

A breach is one incident at one organization; a notice is one filing with a regulator, and one breach can have several. Notices come from the California, Washington and Texas attorneys general, the Oregon Department of Justice, the HHS Office for Civil Rights and SEC 8-K Item 1.05 filings; leaked accounts come from Have I Been Pwned (CC BY 4.0). A breach counts in the month it was first reported. States only count their own residents and HHS only lists health breaches of 500 or more people, so totals are a floor. Late filings can change these numbers; changes are logged on this page. Full rules: methodology.

This edition was compiled on October 18, 2026 from the official notices available then; late filings can still change it.

The full methodology (version 1.1)

Sources (7)
Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.