23andMe
When 23andMe went bankrupt in 2025, the genetic data of over 15 MILLION people — including people who have since DIED, whose DNA records remain active in the…
Unassigned
Companies
Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.
Results
Allstate
Allstate's subsidiary Arity paid app developers millions of dollars to bury a tracking SDK inside apps that had nothing to do with insurance - Life360…
Unassigned
Amazon
The FTC alleged Amazon used confusing checkout screens to sign millions of people up for Prime WITHOUT clear consent, then made it deliberately hard to cancel…
Unassigned
Amazon One
Amazon One is palm-recognition biometric payment, and palm vein geometry is permanent in a way no credential should be - you cannot reissue a hand.
Unassigned
Amazon Prime Video
Prime Video is bundled under the same Amazon Prime membership the FTC secured a $2.5 BILLION settlement over…
Unassigned
Anthropic (Claude)
On July 20, 2026 Judge Araceli Martinez-Olguin granted final approval to a $1.5 billion settlement - the largest copyright recovery in US history - over books…
Unassigned
British Airways
The 2018 breach is the most-studied GDPR case in aviation because of what the regulator found: attackers reached BA's systems and harvested payment card…
Unassigned
CVS Caremark
The FTC's allegation is that the rebate system was not a discount mechanism at all but a pricing engine running backwards…
Unassigned
Cardinal Health
Cardinal Health is the third of the big three distributors in the $21 billion opioid settlement, paid over 18 years with no admission of wrongdoing, plus a…
Unassigned
Cash App (Block, Inc.)
The CFPB ordered Cash App's parent company to pay UP TO $120 MILLION back to defrauded customers plus a separate $55 MILLION penalty, finding Cash App failed…
Unassigned
Cencora
Cencora reportedly paid $75 million in Bitcoin to the Dark Angels ransomware group in three March 2024 transactions…
Unassigned
Change Healthcare (Optum / UnitedHealth Group)
The largest health-data breach on record in the US.
Unassigned
Clearview AI
Clearview built its product by collecting images of people's faces from the public internet and selling search access to police and government agencies.
Unassigned
Coupang
Coupang, South Korea's dominant e-commerce and delivery platform, disclosed in late 2025 a large-scale breach…
Unassigned
Dell Technologies
Dell disclosed a breach exposing customer records at very large scale - reporting cited on the order of 49 million purchase records including names, physical…
Unassigned
Discover Financial Services
Discover misclassified about five million CONSUMER credit cards as commercial cards from 2007 to 2023 - seventeen years - which pushed those transactions into…
Unassigned
Dominion Energy Virginia
Dominion's parent has accumulated roughly $3.95 billion in penalties - a figure large enough that it reframes how to read every other row in this tab, because…
Unassigned
Elevance Health (Anthem)
Anthem's 2015 breach set records that stood for nearly a decade: 78.8 million people, and a resulting $16 million HIPAA settlement with HHS that was nearly…
Unassigned
Equifax
Equifax is the company behind the 2017 breach that exposed names and birth dates of about 147 million people and Social Security numbers of 145.5 million.
Unassigned
Express Scripts (Cigna)
Express Scripts was the first of the three big PBMs to settle, on February 4, 2026, on terms the FTC projects will cut patient out-of-pocket costs by up to $7…
Unassigned
Google Assistant
Google Assistant voiceprints are one of the two biometric claim sets in the $1.375 billion Texas settlement - Texas alleged Google captured voiceprints…
Unassigned
Google Chrome
Chrome's Incognito mode is one of the three claim sets Texas settled with Google for $1.375 billion - the state alleged the disclosures around it were…
Unassigned
Google Maps
Google Maps' location data is part of the same Google data ecosystem as the $1.375 billion Texas settlement…
Unassigned
Google Photos
Google Photos face grouping is the other biometric claim set in the $1.375 billion Texas settlement, and Google separately paid $100 million to settle an…
Unassigned
Grindr
Grindr is the clearest case in this tracker of an app whose mere use reveals sensitive data: Norway's data protection authority held that sharing Grindr…
Unassigned
HCA Healthcare
The 2023 HCA breach exposed data on roughly 11 million patients, and the mechanism is the part worth understanding…
Unassigned
Hinge (Match Group)
In January 2026, the same ShinyHunters group that hit Panera, Amtrak, and dozens of others (documented throughout this tracker) breached Hinge, Match, and…
Unassigned
Humana
Humana was sued in 2023 over the same nH Predict algorithm at issue in the UnitedHealth case - the naviHealth-built tool that estimates how long a Medicare…
Unassigned
Instructure (Canvas)
In late April and again on May 7, 2026, the ShinyHunters extortion group broke into Canvas, the learning platform used by over 41% of North American colleges…
Unassigned
Johnson & Johnson
The 2023 breach hit Johnson & Johnson's PATIENT ASSISTANCE programme - the mechanism through which people who cannot afford a drug apply for help paying for it.
Unassigned
Kaiser Permanente
This was not a hack. Kaiser installed the tracking code itself - pixels and analytics tags from Google, Microsoft Bing, X, Adobe and Quantum Metric - and left…
Unassigned
Klarna / Afterpay / Affirm (Buy Now, Pay Later apps)
A 2025 LendingTree survey found 41% of Buy Now Pay Later users paid late at least once in the prior year, up from 34% the year before.
Unassigned
Life360
Arity reportedly paid app makers (Life360 among the apps named) millions of dollars in total to embed Allstate subsidiary Arity's tracking software inside its…
Unassigned
Marriott (Bonvoy)
Marriott's combined litigation — the 2018 breach, a separate 2020 breach, resort-fee deception, and biometric employee timekeeping violations…
Unassigned
McKesson
McKesson, Cardinal Health and AmerisourceBergen (now Cencora) agreed to pay up to $21 billion over 18 years to resolve opioid claims brought by states and…
Unassigned
MetLife
The instructive thing about MetLife is the range.
Unassigned
Meta (Facebook / Instagram / WhatsApp)
Meta has told hundreds of millions of WhatsApp users their messages are 'end-to-end encrypted' — meaning not even Meta can read them.
Unassigned
Mint (Intuit)
Mint shares Intuit's corporate family with TurboTax ($141M multistate attorneys-general settlement over 'free' filing deception) and Credit Karma…
Unassigned
MyFitnessPal
MyFitnessPal's cookie-consent banner offers you a button to browse 'without being tracked' — a 2025 lawsuit…
Unassigned
National Public Data (Jerico Pictures, Inc.)
National Public Data, a background-check data business run by Jerico Pictures, Inc. of Florida, confirmed in August 2024 that a hacker had obtained about 2.9…
Unassigned
Nest (Google)
Google DISABLES its Nest 'Familiar Faces' facial-recognition feature specifically in Illinois — the one state with a strong biometric consent law…
Unassigned
OpenAI (ChatGPT / Sora)
In May 2025 a federal magistrate ordered OpenAI to preserve every ChatGPT output log indefinitely - overriding both its own 30-day deletion policy and users'…
Unassigned
Peacock (NBCUniversal/Comcast)
Peacock's parent Comcast separately agreed to pay $117.5 MILLION to settle a 2023 data breach affecting 35.8 million Xfinity customers…
Unassigned
Penske Automotive
One of the six large dealership groups that disclosed the June 2024 CDK Global ransomware disruption to the SEC.
Unassigned
PowerSchool
The December 2024 PowerSchool breach is the largest student-data breach on record in this tracker…
Unassigned
Practice Fusion (Veradigm)
In January 2020 Practice Fusion, a free, ad-supported EHR used heavily by small practices, agreed to pay $145 million to resolve criminal and civil…
Unassigned
Qantas
Qantas was ordered by Australia's Federal Court to pay A$100 million in October 2024 for selling tickets on flights it had already decided to cancel.
Unassigned
Quest Diagnostics
The AMCA breach is the cleanest illustration in this tracker of harm arriving through an entity the patient never chose and never heard of.
Unassigned
Reddit's lawsuit against Perplexity and data-scraping firms (Oct. 2025) describes their scraping as 'industrial-scale' and unlawful, and its chief legal…
Unassigned
Salesforce
This is the most consequential single row in the tracker, because it is not one company's breach but the mechanism behind dozens of them.
Unassigned
Try fewer filters, or clear them all.