Monthly edition · September 2026
Published
Data breaches in September 2026
146 data breaches were reported in September 2026, from 214 notices filed with US regulators plus new entries on Have I Been Pwned. Official notices put the number of people affected at 48.9 million or more, and 35.7 million leaked accounts were added to Have I Been Pwned. Most of that people count comes from a single notice: DriveWealth reported 30 million people affected.
CTO
Reviewed by Shkumbin Hasani
Principal Engineer
Key takeaways
- 146 breaches in September 2026, up 8% on August 2026 counting the same sources.
- The largest was DriveWealth: 30 million people affected, per its notice to the Texas Attorney General.
- Names leaked in 95% of the 78 breaches whose notices listed the data.
- Half of the breaches reached a regulator 150 days or more after they began.
- 41 health breaches went to HHS, affecting 1.17 million people.
- Breaches
- 146
- +8% vs August 2026−8% vs September 2025
- People affected
- 48,891,580
- +338% vs August 2026−80% vs September 2025
- Official notices
- Accounts leaked
- 35,723,266
- +85% vs August 2026+263% vs September 2025
- Have I Been Pwned
| Metric | September 2026 | vs August 2026 | vs September 2025 |
|---|---|---|---|
| Breaches | 146 | +8% | −8% |
| People affected | 48,891,580 | +338% | −80% |
| Accounts leaked | 35,723,266 | +85% | +263% |
146 data breaches were reported in September 2026, up 8% from August 2026
Changes use the same sources in both periods. People and accounts are never added together.
What happened in September 2026
We counted 146 breaches in September 2026: 214 official notices to state attorneys general, HHS and the SEC, plus breaches added to Have I Been Pwned. One organization filing in several states counts once. The count is up 8% on August 2026 and down 8% on September 2025, comparing the same sources. So far in 2026 we've counted 1,278 breaches, with at least 179 million people affected.
At 146, September sits in the middle of the last 12 months, which ranged from 101 to 157 breaches a month. People affected rose 338% on August counting the same sources, the second highest count in that stretch after October 2025, and DriveWealth alone is more than half of it.
September was 7% above the 12-month average
Breaches
People affected (official notices)
| Month | Breaches | People affected | Accounts leaked |
|---|---|---|---|
| October 2025 | 101 | 64,447,513 | 32,527,739 |
| November 2025 | 124 | 4,019,169 | 1,967,402,864 |
| December 2025 | 145 | 28,203,810 | 5,593,947 |
| January 2026 | 129 | 7,872,485 | 131,149,791 |
| February 2026 | 147 | 14,010,403 | 61,381,576 |
| March 2026 | 150 | 16,301,650 | 5,528,583 |
| April 2026 | 116 | 9,892,466 | 41,790,763 |
| May 2026 | 157 | 9,332,239 | 50,334,737 |
| June 2026 | 151 | 38,348,637 | 18,383,353 |
| July 2026 | 147 | 23,145,270 | 89,085,270 |
| August 2026 | 135 | 11,175,323 | 19,323,733 |
| September 2026 | 146 | 48,891,580 | 35,723,266 |
The biggest breaches
Ranked by people affected, from official notices:
DriveWealth was the largest breach, with 30M people affected
| Organization | People affected | Reported | Breach date | Source |
|---|---|---|---|---|
| DriveWealth | 30,000,000 | 30 Sept 2026 | 4 Sept 2026 | Texas Attorney General |
| IDScan.net | 13,000,000 | 18 Sept 2026 | 1 Apr 2026 | Texas Attorney General |
| Call-on-Doc | 648,535 | 17 Sept 2026 | 22 Dec 2025 | Texas Attorney General |
| Saber Healthcare | 427,084 | 29 Sept 2026 | 29 May 2026 | Texas Attorney General |
| District of Columbia, Department of Health Care Finance | 399,086 | 3 Sept 2026 | n/a | U.S. Department of Health and Human Services |
| Cornerstone Staffing Solutions | 366,122 | 11 Sept 2026 | 6 Nov 2025 | Texas Attorney General |
| MedImpact Healthcare Systems | 327,082 | 25 Sept 2026 | 18 Oct 2025 | Texas Attorney General |
| Ridgeway Pharmacy | 258,920 | 21 Sept 2026 | 7 Jun 2026 | Texas Attorney General |
| Catalyst Physician | 248,144 | 11 Sept 2026 | 2 Dec 2025 | Texas Attorney General |
| Poppins Payroll | 246,937 | 29 Sept 2026 | 3 Sept 2026 | Texas Attorney General |
DriveWealth, a finance company, says its breach began on September 4. It exposed names and Social Security numbers, along with financial account numbers. IDScan.net's breach started on April 1 and took names, dates of birth and driver's license or other ID numbers, which is what someone needs to pass an identity check as you.
Ranked by leaked accounts, from Have I Been Pwned:
LimeLeads exposed the most accounts: 17.8M
| Organization | Accounts exposed | Reported | Breach date | Source |
|---|---|---|---|---|
| LimeLeads | 17,838,396 | 22 Sept 2026 | 1 Aug 2019 | Have I Been Pwned |
| Manchester Airports Group | 8,849,657 | 2 Sept 2026 | 27 Aug 2026 | Have I Been Pwned |
| Chess.com (2026) | 4,653,212 | 13 Sept 2026 | 3 Aug 2026 | Have I Been Pwned |
| Burger King Russia | 3,155,792 | 21 Sept 2026 | 25 Aug 2024 | Have I Been Pwned |
| Questel | 1,226,209 | 1 Sept 2026 | 1 Aug 2026 | Have I Been Pwned |
People affected and leaked accounts are counted separately and never added together.
What leaked
Of the 78 breaches where the notice or Have I Been Pwned listed the data involved:
Names leaked in 95% of breaches
Share of the 78 breaches where the data types are known
| Data type | Share of breaches | Breaches |
|---|---|---|
| Names | 95% | 74 |
| Social Security numbers | 77% | 60 |
| Dates of birth | 55% | 43 |
| Medical information | 50% | 39 |
| Physical addresses | 50% | 39 |
| Driver's licenses and government IDs | 45% | 35 |
| Financial account or card numbers | 42% | 33 |
| Health insurance information | 38% | 30 |
| Email addresses | 6.4% | 5 |
| Geographic locations | 5.1% | 4 |
| Phone numbers | 5.1% | 4 |
| Employers | 2.6% | 2 |
Names show up almost everywhere and do little damage alone. Social Security numbers, in 77% of these breaches, are the real problem: paired with a date of birth they're enough to open credit in your name, and a leaked medical record can feed insurance fraud you only find on a bill.
None of the accounts added to Have I Been Pwned this month came with passwords.
Sectors and causes
Healthcare had the most breaches: 62
32 breaches had no sector.
| Sector | Breaches | People affected |
|---|---|---|
| Healthcare | 62 | 2,928,069 |
| Finance | 16 | 31,073,693 |
| Retail | 13 | 13,367,442 |
| Other | 11 | 836,108 |
| Government | 4 | 124,148 |
| Professional services | 4 | 555,719 |
| Education | 2 | 5,511 |
| Nonprofit | 2 | 890 |
Notices gave a cause for 51 breaches:
Hacking or IT incident was the most common cause, behind 75% of breaches
Share of the 51 breaches with a reported cause
- Hacking or IT incident 75%
- Unauthorized access 22%
- Ransomware 3.9%
| Cause | Share of breaches | Breaches |
|---|---|---|
| Hacking or IT incident | 75% | 38 |
| Unauthorized access | 22% | 11 |
| Ransomware | 3.9% | 2 |
Healthcare filed the most breaches. Finance had the most people affected, almost all of them from DriveWealth.
Health breaches have their own register: 41 breaches of 500 or more people reached the HHS Office for Civil Rights in September 2026, affecting 1,173,094 people. The largest was District of Columbia, Department of Health Care Finance (399,086 people).
Time to notify
For the 101 breaches where we know both dates, the median time from the start of the breach to the first public notice was 150 days. A quarter took 309 days or more.
For half of these breaches, your details had been out for around five months by the time a letter arrived.
18 organizations reported more than one separate breach in the last 12 months, including 360training.com, BestCare Treatment Services, DentaQuest.
What it means for you
If you got a breach letter or used one of the services above, change that password. Do the same for any account that shares it, and turn on two-step verification. Expect phishing that quotes the leaked details. Where a Social Security number leaked, a credit freeze with each of the three bureaus (Equifax, Experian, TransUnion) is free and stops new credit in your name. Our guide to what to do after a data breach has the steps.
Leaked data can't be pulled back once it's out. Serus monitors breach databases and the dark web for your email and personal details and alerts you when they show up, so you can act early.
If a notice says your Social Security number leaked, freeze your credit first: it's free and it blocks new accounts outright, which a password change can't do.
More from this edition
- Time to notify
- 150 days
- Median from breach to public notice; 75% within 309 days. 101 breaches with both dates.
- Repeat breaches
- 18
- Organizations with 2 or more breaches in the last 12 months, such as 360training.com and BestCare Treatment Services.
- Passwords exposed
- 0%
- Of leaked accounts on Have I Been Pwned (0 accounts).
- Health breaches
- 41
- Reported to HHS (500+ people each), 1,173,094 people affected. Largest: District of Columbia, Department of Health Care Finance (399,086).
Among people who ran a Serus scan
- Exposures on a first free scan
- 25 (median)
- Average 32. 81% had 10 or more; 39% had a critical exposure.
- Relisted after removal
- 49%
- Relisted within 90 days, 8.6 relistings on average (removals 2026-04 to 2026-06).
Among people who ran a Serus scan. First scans: each person's first free scan that month. Relistings: people whose data broker removals were confirmed in 2026-04..2026-06, and how many saw a removed listing come back within 90 days. Figures are shown only when 1,000 or more people are behind them. How we count
Looking for a specific breach? Every data breach in 2026 is listed by name, biggest first, on the full list, updated daily.
Questions
How many data breaches were there in September 2026?
We counted 146 breaches from 214 official notices and Have I Been Pwned, affecting at least 48.9 million people.
What was the biggest data breach in September 2026?
DriveWealth, with 30,000,000 people affected according to its notice to the Texas Attorney General. The largest by leaked accounts was LimeLeads, with 17,838,396 accounts in Have I Been Pwned.
What data leaked most often?
Names: 95% of the 78 breaches with known data types. Social Security numbers followed at 77%.
How long do companies take to report a data breach?
In September 2026 the median was 150 days from the start of the breach to the first public notice, across the 101 breaches with both dates.
Can I get my data removed from a breach?
No. Once data leaks it can be copied anywhere, so nobody can recall it. What you can do is change the affected passwords, freeze your credit if your Social Security number leaked, and watch for misuse. Serus monitors breach databases and the dark web and alerts you when your details appear.
Author
Argjent SahitiCTO
Leads engineering at Serus, building the systems that find and remove exposure at scale.
Reviewed by
Shkumbin HasaniAbout the data
Free to reuse with credit and a link to this page (CC BY 4.0). Leaked accounts and data types from Have I Been Pwned (CC BY 4.0). Download every breach counted in September 2026 (CSV).
How we count
A breach is one incident at one organization; a notice is one filing with a regulator, and one breach can have several. Notices come from the California, Washington and Texas attorneys general, the Oregon Department of Justice, the HHS Office for Civil Rights and SEC 8-K Item 1.05 filings; leaked accounts come from Have I Been Pwned (CC BY 4.0). A breach counts in the month it was first reported. States only count their own residents and HHS only lists health breaches of 500 or more people, so totals are a floor. Late filings can change these numbers; changes are logged on this page. Full rules: methodology.
This edition was compiled on October 18, 2026 from the official notices available then; late filings can still change it.
Revisions (1, latest 18 Oct 2026)
- : Counting rule updated (methodology 1.1): separate incidents at the same organization are no longer combined, and late filings for the same breach are, so the totals changed slightly.
Sources (7)
- Have I Been Pwned (CC BY 4.0): 5 records, retrieved 18 Oct 2026
- California Attorney General: 55 records, retrieved 18 Oct 2026
- Washington Attorney General: 10 records, retrieved 18 Oct 2026
- U.S. Department of Health and Human Services (Public domain (U.S. government work)): 43 records, retrieved 18 Oct 2026
- Texas Attorney General: 79 records, retrieved 18 Oct 2026
- U.S. Securities and Exchange Commission (Public domain (U.S. government work)): 3 records, retrieved 18 Oct 2026
- Oregon Department of Justice: 24 records, retrieved 18 Oct 2026
Check if you're exposed in a breach with Serus
Find your leaks. Get alerted to new ones.