Healthy Paws
The class action against Healthy Paws makes an unusually crisp allegation: the policy contract says premiums increase only to reflect the changing cost of…
Unassigned
Companies
Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.
Results
HelloFresh
No US privacy action confirmed this pass; in the UK, the Information Commissioner's Office reportedly fined HelloFresh £140,000 in January 2024 for millions…
Unassigned
Henry Schein
Henry Schein is a healthcare products distributor serving dental and medical practices, and its consumer relevance is indirect but real…
Unassigned
Hims & Hers
The 2026 breach sits inside a broader telehealth incident pattern, and the specific sensitivity here is the product line…
Unassigned
Honda / HondaLink
The toggle to opt out of Honda's 'Driver Feedback' data-sharing program is reportedly buried TWO MENUS deep, past the safety-feature settings, inside the…
Unassigned
Hyatt
Same 2025 Otelier vendor breach as Hilton and Marriott - recorded as one connected finding rather than three, per this tracker's cross-reference standard.
Unassigned
IBM
IBM appears in this tracker in multiple roles simultaneously - as a breach victim, as a vendor whose software sits inside other companies' incidents, and as a…
Unassigned
ID.me
ID.me became the gatekeeper for IRS online accounts and many state unemployment systems during the pandemic, meaning people could not reach benefits without…
Unassigned
IHG (Holiday Inn/InterContinental)
The remarkably long-running class action against IHG is the row's substance, and duration is the finding…
Unassigned
Iberia (IAG)
Iberia notified customers in November 2025 of unauthorized access to a supplier's systems exposing names, email addresses and Iberia Club loyalty IDs, days…
Unassigned
IndiGo
No IndiGo customer-data breach confirmed this pass, but IndiGo disclosed on December 31, 2020 that some of its servers had been hacked earlier that month and…
Unassigned
Instacart
DC's Attorney General alleged (in a case Instacart settled) that Instacart labeled a mandatory charge an 'optional service fee' that customers reasonably…
Unassigned
Intel
Nothing consumer-facing confirmed this pass.
Unassigned
Intercontinental Exchange
Missed regulator action added: on May 22, 2024 the SEC announced that ICE agreed to pay a $10 million penalty to settle charges that it caused nine…
Unassigned
Interpublic
Advertising holding companies are the demand side of everything this tracker documents from the supply side.
Unassigned
JPMorgan Chase
In 2009, major banks (Chase included) REMOVED forced arbitration from their agreements as part of a multi-bank legal settlement…
Unassigned
Japan Airlines (JAL)
JAL was part of the 2021 SITA multi-airline breach that also reached Finnair, SAS, Singapore Airlines and Air India.
Unassigned
KLM
KLM was hit by the same 2025 breach as Air France - the two share systems and a customer data environment, so a single intrusion reaches both.
Unassigned
Keurig Dr Pepper
Connected brewers and subscription auto-delivery tie consumption patterns and household routine to an account.
Unassigned
Klover (Klover Holdings, Inc.)
Klover's business is built on users' data as much as on advances: its privacy policy says plainly 'We sell and share your Personal Information,' including…
Unassigned
Kraft Heinz
Packaged food sold through retailers, so consumer data arrives via promotions rather than purchases.
Unassigned
LA Fitness (Fitness International LLC)
No breach litigation or breach filing was verified this pass (no LA Fitness/Fitness International entry on the California AG breach list as of Oct. 16, 2026)…
Unassigned
LATAM Airlines
No source could be located for the 2020 breach (resurfacing in 2022) attributed to LATAM in an earlier draft, so it is not asserted here.
Unassigned
LG Electronics (Smart TVs)
LG was one of five TV makers Texas sued in December 2025 over automated content recognition, the software that identifies what is on the screen and reports it…
Unassigned
LKQ
One data incident found (supplier data, Oracle E-Business Suite exploitation, notified December 2025 - see data-sharing column)…
Unassigned
Las Vegas Sands
Sands sold its Las Vegas properties and now operates primarily in Macau and Singapore, so a US consumer's exposure is largely historical.
Unassigned
Liberty Mutual
The Everest ransomware group claimed in May 2026 to have taken more than 108 gigabytes of data from Liberty Mutual - a volume that, if accurate, is less a…
Unassigned
Life Time Fitness
Life Time agreed in 2015 to pay up to $15 million to settle a class action over unsolicited marketing texts, and the reason gyms keep landing here is…
Unassigned
Lincoln National
Lincoln National was caught in a massive cross-industry breach through a shared third-party vendor, which is the pattern that dominates the second half of…
Unassigned
LinkedIn (Microsoft)
The 'BrowserGate' report (April 2026, published by Fairlinked e.V., an association of commercial LinkedIn users) alleged that every time you load LinkedIn on…
Unassigned
Lithia Motors
Lithia disclosed the CDK Global outage to the SEC in June 2024 - one of six large dealership groups that did.
Unassigned
Live Nation Entertainment
Same company already documented extensively in the Ticketmaster rows.
Unassigned
LiveRamp
LiveRamp builds identity profiles that link a person's offline identifiers…
Unassigned
Lowe's
A reported 2026 plaintiffs'-firm mass arbitration investigation (an attorney inquiry, not filed claims; not verified in this review) suggests Lowes.com may…
Unassigned
Lufthansa
Lufthansa holds a seat on the board of ARC, the airline-owned clearinghouse that sold US travelers' domestic flight records - names, itineraries, financial…
Unassigned
Lyft
Industry researchers describe Lyft's arbitration clause as something a rider may 'unknowingly waive [their rights]...
Unassigned
MGM Resorts International
Two separate major breaches, now settled - and the 2023 incident is the most instructive social-engineering case in this tracker after the Salesforce campaign…
Unassigned
Macy's
Macy's has no confirmed 2024 data breach; its 2024 disclosure was that a single employee had concealed about $151 million of delivery expenses from late 2021…
Unassigned
Marriott International
Marriott's headline finding is recorded on the Marriott (Bonvoy) row in Consumer Apps and is not repeated here.
Unassigned
Marsh & McLennan
Marsh brokers insurance and Mercer administers employee benefits, so the group handles health plan enrolment, retirement participation and claims analytics…
Unassigned
Match Group (Tinder / Hinge / Match.com / OkCupid / PlentyOfFish)
Hinge markets itself as 'Designed to be Deleted' — but a 2024 lawsuit alleges the algorithm deliberately hides the profiles it already knows you'd like MOST…
Unassigned
Max (HBO Max, Warner Bros. Discovery)
Max sits inside the same broader video-privacy litigation wave (Video Privacy Protection Act tracking-pixel cases) already confirmed against other streaming…
Unassigned
McDonald's
Workers have alleged in wage claims that McDonald's franchisees underpaid hourly staff through off-the-clock prep time and missed breaks…
Unassigned
Mercari
To sell or buy on Mercari, attorneys allege you may be required to upload BOTH a selfie AND a photo of your government-issued ID…
Unassigned
Microsoft (Outlook/365)
A business-customer lawsuit filed in 2020 (Russo v. Microsoft; dismissed with leave to amend in June 2021; docket terminated November 2022) alleged Microsoft…
Unassigned
Microsoft Teams
Microsoft's own Incident Response team documented attackers using Teams itself as the delivery mechanism - impersonating IT help desk staff in chat and voice…
Unassigned
Mistral AI (Le Chat)
The most striking thing about Mistral is how ordinary its terms look next to the rest of this tab - and that is the finding.
Unassigned
Molson Coors Beverage
Three-tier alcohol distribution with minimal direct consumer data.
Unassigned
Mondelez
Mondelez was a major casualty of NotPetya, and its insurance litigation against Zurich over an act-of-war exclusion reshaped how cyber coverage is written…
Unassigned
Monster Beverage
Retail-mediated energy drinks. Monster's consumer-protection history concerns marketing to minors and caffeine content disclosure, which drew government…
Unassigned
Try fewer filters, or clear them all.