Illuminate Education
The FTC finalized an order against Illuminate Education on June 5, 2026 (Docket C-4833), settling allegations that its weak security led to a breach of 10.1…
Unassigned
Companies
Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.
Results
Kraken (Payward, Inc.)
VERIFIED: the SEC's 2023 suit alleging Kraken ran an unregistered securities exchange was dismissed WITH PREJUDICE by joint stipulation in March 2025.
Unassigned
Labcorp
Labcorp had roughly 10.25 million patients exposed (10,251,784 per HIPAA Journal's settlement coverage) in the same AMCA billing-vendor breach as Quest - two…
Unassigned
LexisNexis Risk Solutions (RELX)
LexisNexis Risk Solutions was one of two data companies that bought driving-behavior data from General Motors' OnStar Smart Driver program, along with Verisk.
Unassigned
MOHELA
As millions of borrowers prepared to resume payments after the COVID-19 pause, MOHELA quietly updated its website terms to prohibit borrowers from sharing…
Unassigned
ModMed (Modernizing Medicine)
In November 2022 Modernizing Medicine (ModMed), the specialty EHR common in dermatology, ophthalmology and orthopedic practices, agreed to pay $45 million to…
Unassigned
MoneyLion (ML Plus / MoneyLion Technologies; Gen Digital subsidiary)
MoneyLion settled the CFPB's Military Lending Act suit in November 2025 for $1.75 million in restitution and no civil penalty, without admitting wrongdoing…
Unassigned
Mozilla Firefox
Firefox was among the 2.2 million browser users caught in the meeting-credential malware campaign alongside Chrome and Edge, which is worth recording…
Unassigned
MyChart (Epic Systems)
The Markup found in June 2022 that 33 of Newsweek's top 100 US hospitals were sending Facebook a packet of data whenever a patient clicked 'Schedule'…
Unassigned
MyHeritage
In June 2018 MyHeritage disclosed that the email addresses and hashed passwords of every user who signed up before October 26, 2017 - about 92 million…
Unassigned
Nationwide
Nationwide paid $5.5 million to 32 states and the District of Columbia over a 2012 breach that exposed Social Security numbers, driver's license numbers and…
Unassigned
NextGen Healthcare
Two separate problems. First, in July 2023 NextGen agreed to pay $31 million to settle False Claims Act allegations.
Unassigned
OkCupid (Match Group)
OkCupid was named in the SAME January 2026 breach as Hinge and Match (an alleged 10+ million records, an unverified claim)…
Unassigned
Oracle Health (formerly Cerner)
Oracle Health, the hospital records business Oracle bought when it acquired Cerner, had patient data stolen from old Cerner data-migration servers in early…
Unassigned
Owens & Minor
Medical supply distributor to healthcare providers, with a home healthcare arm (Apria) that DOES have a direct patient relationship…
Unassigned
PeopleConnect (Intelius / TruthFinder / Instant Checkmate)
In September 2023 the FTC filed a complaint and proposed stipulated order requiring TruthFinder and Instant Checkmate to pay a $5.8 million civil penalty.
Unassigned
PlayStation Network (Sony)
A class action (Caccuri v. Sony Interactive Entertainment, No. 21-cv-03361) alleged Sony unlawfully stopped third-party retailers from selling PlayStation…
Unassigned
Postmates (Uber)
Postmates is owned by Uber, not DoorDash (Uber completed its acquisition on Dec. 1, 2020) — so DoorDash's $16.75 million NY AG settlement over using customer…
Unassigned
Radaris
On Aug 26-27, 2026 a New Jersey Superior Court entered a default judgment against Radaris.com, Rehold.com and Trustoria.com under New Jersey's Daniel's Law…
Unassigned
Replika (Luka, Inc.)
Italy's data protection authority fined Replika's maker EUR 5 million in April 2025.
Unassigned
Ring (Amazon)
Ring's new 'Familiar Faces' feature (launched Dec 2025) uses AI facial recognition to build a database of up to 50 people per household…
Unassigned
Robinhood
The SEC found that Robinhood publicly downplayed how much it relied on selling your trades to market makers (payment for order flow)…
Unassigned
Roku
Roku sits between the TV screen and the advertiser, and two state attorneys general now say it treats children the same way it treats everyone else on that…
Unassigned
Seamless (Grubhub)
Seamless runs on Grubhub's infrastructure, meaning Grubhub's own $25 million FTC settlement over deceptive fees and subscription practices applies to the same…
Unassigned
SimpliSafe
A genuinely positive finding relative to competitors, and per the project guide's standard it is recorded as such…
Unassigned
Southwest Airlines
The US government actually FILED a lawsuit against Southwest for illegally operating 'chronically delayed' flights on two specific routes…
Unassigned
Spokeo
Spokeo is the company behind Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), the Supreme Court standing case.
Unassigned
Starbucks
A Los Angeles County jury awarded a delivery driver $50 MILLION (March 2025) after a venti hot tea that, his lawyers said, a barista failed to secure fell…
Unassigned
TAP Air Portugal
The Ragnar Locker ransomware crew took data tied to more than 5 million unique email addresses from a state-owned flag carrier in 2022 and published it when…
Unassigned
Teladoc Health (incl. BetterHelp)
A federal judge denied Teladoc's motion to dismiss in June 2025, and the legal reasoning is more significant than the case itself…
Unassigned
TransUnion
In July 2025 attackers got into a third-party application used by TransUnion's own U.S. consumer-support operation.
Unassigned
Travelers Insurance
Travelers was breached through the auto-insurance quoting calculator its independent agents use - a portal that did not have multi-factor authentication…
Unassigned
United Airlines
United's marketing around 'sustainable aviation fuel' was challenged as GREENWASHING in a class action…
Unassigned
Veradigm (formerly Allscripts; incl. Practice Fusion)
Veradigm, the company formerly called Allscripts, owns the Practice Fusion records system, which in January 2020 agreed to pay $145 million to resolve federal…
Unassigned
Vivint Smart Home (NRG Energy)
Vivint's 2021 FTC settlement was $20 million - the largest monetary judgment to date in an FTC Fair Credit Reporting Act case - and the conduct is unusually…
Unassigned
Vizio
Vizio is the original smart-TV spying case.
Unassigned
Volkswagen (Car-Net)
VW/Audi exposed 3.3 MILLION customers' names, addresses, emails, and vehicle purchase details (2019-2021)…
Unassigned
World (Worldcoin / Tools for Humanity)
World (formerly Worldcoin), co-founded by OpenAI CEO Sam Altman, scans people's irises with its 'Orb' to issue a 'proof of personhood' ID, historically paying…
Unassigned
Wyze
Wyze sells cheap indoor cameras, and twice in five months its systems showed customers other people's homes.
Unassigned
Xbox (Microsoft)
Microsoft's $20 million COPPA fine for collecting children's data on Xbox Live without parental consent worked out to roughly 0.04% of Microsoft's $56.2…
Unassigned
YouTube (Google/Alphabet)
Same quiet-settlement pattern as TikTok and Snapchat (this same tab): Google reached a CONFIDENTIAL settlement with a Florida teenager who alleged depression…
Unassigned
Zoom
Zoom agreed to pay $85 MILLION to settle class claims that it shared certain user information with third parties (reportedly including Facebook and Google)…
Unassigned
7-Eleven
7-Eleven disclosed an April 2026 breach of systems holding franchisee/franchise-applicant documents, claimed by the ShinyHunters extortion group - the…
Unassigned
AMC Theatres
The July 2025 Kansas ruling is a useful precedent in the opposite direction from most findings in this tracker…
Unassigned
AOL Mail
AOL and Yahoo share a corporate history and, for a period under Verizon, a parent - which means AOL Mail users inherited the consequences of decisions made…
Unassigned
AT&T
AT&T's own mandatory arbitration clause was successfully used IN COURT to BLOCK a class-action lawsuit (Scott v. AT&T) that accused the company of unlawfully…
Unassigned
AT&T Internet / AT&T Fiber
AT&T was one of six ISPs studied by the FTC, and its affiliated ad-tech arm - Appnexus, rebranded Xandr - received its own compulsory order…
Unassigned
Abbott Laboratories
Abbott's July 2026 double breach is the most recent significant finding on this tab, and one of the two incidents is attributed to ShinyHunters - the group…
Unassigned
Accenture
Global consulting and IT services. Accenture builds and operates the systems that hold other companies' customer records, which places it in the same…
Unassigned
Acxiom (IPG / Omnicom)
Acxiom is one of the largest US marketing-data brokers and consumers almost never deal with it directly.
Unassigned
Try fewer filters, or clear them all.