US state data breach notifications: tracker and statistics
Breach notification filings by state
| State | Filings (all time collected) | Count | 2026 YTD |
|---|---|---|---|
| Indiana | 10,399 | 2,886 | |
| Montana | 6,125 | 107 | |
| Maryland | 5,165 | 3,759 | |
| Massachusetts | 4,739 | 328 | |
| California | 2,812 | 2,714 | |
| Oregon | 1,460 | 51 | |
| Washington | 1,137 | 14 | |
| Maine | 797 | 224 | |
| Texas | 616 | 71 | |
| South Carolina | 577 | 19 | |
| Vermont | 293 | 63 | |
| Delaware | 207 | 35 | |
| Hawaii | 91 | 90 | |
| Rhode Island | 34 | 1 | |
| Wisconsin | 20 | 1 | |
| Nebraska | 9 | 9 | |
| Iowa | 8 | 8 | |
| North Dakota | 2 | 2 |
Filing counts reflect what each state publishes, not how many breaches occurred there: publication practices differ widely by state. States publish at different cadences and some (North Dakota, Iowa) have removed their public lists, so their counts are frozen historical snapshots.
Figures as of August 11, 2026, refreshed from daily collection.
What this tracker adds that no other source does
One place for all published states. Each state attorney general publishes (or does not publish) its own list, in its own format. The only other aggregation is paywalled, updated monthly, and covers fewer states. This page is free and refreshed from daily collection.
Cross-state deduplication (coming to this page). The same breach is often filed in several states. Because every filing is linked to an organization in our registry, we can report both raw filings and unique incidents, and show which breaches were filed in the most states.
Organization linkage. Every filing connects to the corporate ownership graph, which is how a filing against a subsidiary becomes visible exposure for its parent, and for the companies that depend on either. That layer lives in the platform.
Frequently asked questions
Which state has the most data breach notifications?
In our corpus, Indiana has published the most filings (10,399), followed by Montana (6,125) and Maryland (5,165). High counts primarily reflect broad publication practices, not necessarily more breaches.
Do all states publish data breach notifications?
No. All 50 states have breach notification laws, but only around 15 publish the notifications they receive. Some states that once published lists have removed them.
How often is this data updated?
Collection runs daily against every state portal that publishes filings. The page shows the date of its last data refresh at the top.
Can I get the underlying data?
The per-state aggregate table is downloadable as CSV on this page. Record-level data, organization linkage, and ownership context are part of the Arasy platform.
Are your vendors on these lists?
Overlay your supplier list and see which of your vendors, or their parents and subsidiaries, appear in breach filings. We are running a small number of pilot demos.
Request a pilot demo Estimate your breach cost