TJX (TJ Maxx/Marshalls/HomeGoods)
Attackers broke into TJX in July 2005 by cracking the WEP encryption on the Wi-Fi at a Miami-area Marshalls, then moved to the central payment servers and sat…
Unassigned
Companies
Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.
Results
Target
Target's landmark 2013 breach — 41 million payment card accounts, contact information for 60 million-plus customers, entered through a THIRD-PARTY HVAC…
Unassigned
Threads (Meta)
Threads runs on the exact same underlying Meta infrastructure and data practices already documented for Facebook/Instagram elsewhere in this tracker…
Unassigned
USAA
In March 2022 USAA Federal Savings Bank paid $140 million - $80M to FinCEN and $60M to the OCC - for WILLFUL failure to maintain an adequate…
Unassigned
UnitedHealthcare
Two findings, either of which would carry this row alone.
Unassigned
VF
VF Corporation - The North Face, Vans, Timberland, Dickies - disclosed a major breach affecting a very large number of consumers, with reporting citing on the…
Unassigned
Visa
The merchant antitrust litigation began in 2005, grew to cover roughly 12 million merchants, and only reached a preliminarily approved settlement in June 2026…
Unassigned
Walgreens app
Walgreens announced in November 2022 settlement frameworks to resolve state, local and tribal opioid claims for up to approximately $4.8 billion…
Unassigned
X (Twitter)
Right now, by DEFAULT, X shares your public posts AND your private conversations with its own AI chatbot Grok with xAI, to train and improve Grok's models…
Unassigned
Yahoo Mail
Three billion accounts - every Yahoo account in existence - taken across breaches in 2013 and 2014, still the largest breach by record count in internet…
Unassigned
Zelle
Customers of Chase, Bank of America, and Wells Fargo lost more than $870 MILLION to Zelle fraud over the network's seven-year history, according to the CFPB's…
Unassigned
eClinicalWorks (incl. healow)
In May 2017 eClinicalWorks (eCW) and three of its founders agreed to pay $155 million.
Unassigned
ACE Cash Express (Populus Financial Group)
In 2014 the CFPB found that ACE Cash Express, one of the largest U.S. payday lenders, used illegal debt-collection tactics…
Unassigned
ADT
ADT — a company literally in the business of protecting people's homes — has disclosed THREE DATA BREACHES SINCE AUGUST 2024…
Unassigned
Aetna (CVS Health)
In July 2017 Aetna mailed about 12,000 members letters about filling prescriptions for HIV medication and PrEP - in envelopes whose transparent window was…
Unassigned
Air India (Tata Group)
Air India was part of the 2021 SITA breach, and its exposure is the most severe in that cluster: roughly 4.5 million passengers, with data including passport…
Unassigned
American Airlines
American Airlines is one of the four carriers named in the price-fixing conspiracy allegation.
Unassigned
Brigit (Bridge IT, Inc.; Upbound Group subsidiary)
Brigit agreed in November 2023 to pay $18 million in consumer refunds to settle FTC charges that it advertised 'instant' $250 advances most users never got…
Unassigned
CURO Group Holdings (now Attain Finance / Heights Finance; former Speedy Cash parent)
CURO went through a prepackaged Chapter 11 in 2024.
Unassigned
Carnival
Repeated incidents across seven years - a 2019 employee-email compromise, an August 2020 ransomware attack disclosed in an SEC 8-K, and the April 2026…
Unassigned
Cathay Pacific
Cathay is the most thoroughly documented airline breach in this tab, and the timeline is why: attackers had access from roughly October 2014, Cathay detected…
Unassigned
Cerebral
In March 2023 Cerebral reported to HHS that it had disclosed health information on 3,179,835 people to Google, Meta, TikTok and other ad platforms through…
Unassigned
Character.AI
Character.AI is the defendant in the first wave of wrongful-death and serious-harm suits brought by families of teenage users.
Unassigned
Cleo AI (Cleo AI, Inc.)
Cleo AI agreed in March 2025 to pay $17 million in refunds to settle FTC charges that its chatbot app advertised hundreds of dollars in cash advances that…
Unassigned
Coinbase
Before you can even START arbitration or file a small-claims case against Coinbase, you must FIRST complete a mandatory internal 'Formal Complaint Process'…
Unassigned
Criteo
France's data protection authority (CNIL) fined Criteo €40 million in June 2023 (deliberation SAN-2023-009) for, among other things, failing to ensure that…
Unassigned
Dave
The July 2020 Dave breach came through Waydev, a third-party analytics vendor - the same vendor-chain structure documented in the AMCA, SITA and Salesloft…
Unassigned
Delta Air Lines
A May 2026 lawsuit alleges Delta's own platform values a CASH REFUND at TWICE the value of an e-credit…
Unassigned
Delta Dental
Delta Dental settled with New York's Department of Financial Services for $2.25 million in April 2026 over a breach that reached it through MOVEit - a single…
Unassigned
Discord
By 2026 Discord faced state lawsuits from New Jersey (filed April 2025), Nevada, Texas and others alleging its private servers and direct messages remain…
Unassigned
Disney+ / Hulu (Disney)
California's Attorney General secured a $2.75 MILLION penalty against Disney (Feb 2026) specifically for FAILING TO HONOR customers' own opt-out requests…
Unassigned
DoorDash
New York's AG found DoorDash was using customer TIPS to SUBSIDIZE delivery workers' base pay instead of paying tips on top of guaranteed wages…
Unassigned
Edmodo
The FTC and DOJ sued Edmodo in May 2023 for collecting children's names, emails, birth dates, phone numbers and persistent identifiers and using them for…
Unassigned
Enova International (CashNetUSA, NetCredit)
Enova is a repeat CFPB offender. A 2019 consent order found it debited consumers' bank accounts without authorization and failed to honor loan extensions it…
Unassigned
Epic Systems (corporate EHR)
Epic is the software company behind the medical records at a very large share of US hospitals, and through its Cosmos research database it pools de-identified…
Unassigned
Epsilon (Publicis)
In January 2021 Epsilon Data Management entered a deferred prosecution agreement with DOJ and agreed to pay $150 million.
Unassigned
Experian
The CFPB is still suing Experian, filed January 2025 in C.D. Cal. No. 8:25-cv-00024, over how it handles credit-report disputes.
Unassigned
Fidelity National Financial
Confirmed: FNF, among the largest US title insurance underwriters, disclosed a November 2023 cybersecurity incident that disrupted title and closing…
Unassigned
FloatMe (FloatMe Corp.)
FloatMe and its two co-founders agreed in January 2024 to pay $3 million to settle FTC charges that it lured users with 'free money' promises, touted an…
Unassigned
Flock Safety
Flock's cameras record the license plates of every passing driver for police, HOA and other customers.
Unassigned
Food Lion (Ahold Delhaize)
Same November 2024 Ahold Delhaize breach as Giant Food - one parent company, one incident, 2.2 million people, recorded as a single connected finding rather…
Unassigned
G6 Hospitality (Motel 6 / Studio 6)
Motel 6 properties handed guest registry lists to immigration enforcement without a warrant or subpoena — in some cases as a daily routine…
Unassigned
GEICO
New York's Department of Financial Services notified GEICO of an industry-wide cyberattack campaign to obtain driver's license numbers - and GEICO suffered a…
Unassigned
GM (myChevrolet / myGMC / myBuick / myCadillac)
GM sold ordinary customers' driving behavior — hard braking, speeding, late-night driving — to LexisNexis and Verisk, who fed it straight into INSURANCE RISK…
Unassigned
Giant Food (Ahold Delhaize)
This is the most directly regional finding in the tracker: Ahold Delhaize USA - parent of Giant Food, Food Lion, Hannaford and Stop & Shop - confirmed a…
Unassigned
GoodRx / BetterHelp / Premom (health app category)
BetterHelp asks new users to answer intake questions about anxiety, depression, medication history, and emotional struggles…
Unassigned
Gravy Analytics / Unacast (incl. Venntel)
The FTC finalized an order on Jan 14, 2025 (5-0 vote) barring Gravy Analytics and its subsidiary Venntel from selling, disclosing or using sensitive location…
Unassigned
Green Dot
In July 2024 the Federal Reserve Board fined Green Dot $44 million for numerous unfair and deceptive practices - including an inadequately disclosed…
Unassigned
Greenway Health
In February 2019 Greenway Health agreed to pay $57.25 million to settle False Claims Act allegations over its Prime Suite EHR.
Unassigned
Hisense
Hisense is the only TV maker in the Texas ACR cases under a court order.
Unassigned
Try fewer filters, or clear them all.