Mutual of Omaha Insurance
The confirmed breach was at United of Omaha Life Insurance Company, a subsidiary - which is the row's practical lesson.
Unassigned
Companies
Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.
Results
NVR
NVR — Ryan Homes, NVHomes, Heartland Homes — has a heavily Mid-Atlantic footprint, making it the most locally relevant builder in this tracker, and operates…
Unassigned
Natural Cycles
Natural Cycles is sold as a contraceptive, not just a tracker, so the real consumer risk is pregnancy, not only privacy.
Unassigned
Navient
The June 2026 vendor breach was disclosed through an SEC filing, which is again how many of these surface - securities law compels disclosure on a timeline…
Unassigned
Nelnet
The 2022 breach was fully settled in 2026 - four years from incident to resolution, which is the number worth carrying rather than the settlement amount.
Unassigned
Netflix
Texas's May 2026 lawsuit alleges Netflix logged OVER 550 BILLION USER EVENTS PER DAY as early as 2015…
Unassigned
Newegg
A reported 2026 plaintiff-firm mass-arbitration solicitation (not a filed case; not independently retrieved) over website tracking technologies - the same…
Unassigned
News Corp. (WSJ, NY Post, HarperCollins)
Nothing recent confirmed this pass on consumer data, but News Corp has appeared in this tracker already as a PLAINTIFF - Dow Jones and NY Post sued Perplexity…
Unassigned
Nike (online store)
Nike had a January 2026 breach (data leaked by an extortion group; Nike attributes it to a third-party provider) plus a second separate finding, and the row…
Unassigned
NordVPN (Nord Security)
The 2026 breach claim is unverified and should stay that way in any published writeup until corroborated - an attacker's assertion is a lead, not a finding…
Unassigned
Northwestern Mutual
Northwestern Mutual's 2022 breach notification letter reportedly states that Massachusetts law PREVENTED the company from describing the nature of its own…
Unassigned
Omni Hotels & Resorts
Omni's 2016 point-of-sale malware incident is the kind of breach that best illustrates why hotels are a distinct risk category…
Unassigned
OppFi (OppLoans)
OppFi's model routes high-cost installment loans through state-chartered bank partners, which avoids state rate caps.
Unassigned
OptumRx (UnitedHealth)
OptumRx is the third defendant in the FTC insulin case, and its case was withdrawn from adjudication so the Commission could consider a proposed consent…
Unassigned
Orbitz (Expedia Group)
The 2018 Orbitz breach remains the useful precedent because of what it exposed: a legacy booking platform Expedia had acquired, still running, still holding…
Unassigned
Ovia Health (Labcorp)
Ovia is often provided free through an employer or health plan, and that is where the exposure sits.
Unassigned
PNC Bank
Buried alongside PNC's standard arbitration clause is something broader: a 'PUBLIC INJUNCTIVE RELIEF WAIVER.'
Unassigned
Paramount+
Paramount is the clearest illustration in this tracker that identical conduct produces opposite legal outcomes depending on which court hears it.
Unassigned
Parkmobile
The ParkMobile breach is fully settled and remains instructive because of who was exposed: a parking payment app operating in 500+ North American cities holds…
Unassigned
Particle Health
Particle Health sells API access to patient records pulled from the national exchange networks to digital-health companies, payers, health systems and…
Unassigned
Peloton
A proposed class action in California federal court (Jones v. Peloton Interactive, S.D. Cal., filed 2023; Peloton's motion to dismiss was denied July 5, 2024)…
Unassigned
PenFed Credit Union
PenFed's disclosures are notably better than most large banks in this tab — no third-party marketing sharing of mobile contact info, explicit exclusion of…
Unassigned
Pepco
Smart meters read a home every 15 minutes and, per the Seventh Circuit, that data reveals when the house is empty, when people sleep and eat, and which…
Unassigned
PepsiCo
Retail-mediated sales with limited direct consumer data, collected mainly through promotional codes, contests and branded apps.
Unassigned
Perplexity AI
Perplexity is the rare case where the customer isn't the one whose data is at issue - the company is, as of this pass, facing suits from Dow Jones and the New…
Unassigned
Persona
Persona runs selfie-and-ID checks and facial age estimation for consumer apps, so people meet it mid-signup without choosing it.
Unassigned
Philip Morris
Age-verified direct marketing collects identity documents and builds detailed consumer databases under the tobacco Master Settlement Agreement's marketing…
Unassigned
PimEyes
PimEyes lets anyone who pays upload a face and find where that face appears online, which makes it a ready tool for stalking.
Unassigned
Planet Fitness
The dark-web leak claim is unverified and should stay marked that way - an attacker's leak-site post is a lead, not a finding.
Unassigned
PointClickCare
PointClickCare is the dominant records system in US nursing homes.
Unassigned
Possible Finance (Possible Financial Inc.)
Possible Finance is a licensed online payday lender, not just an app: its own California fee table shows a $100 loan costing $17.64 - a 460% APR if repaid on…
Unassigned
Progressive
The honest finding here is a gap rather than a scandal: no confirmed regulatory action, settlement or breach specific to Progressive surfaced this pass, and…
Unassigned
Proton VPN
Same parent as Proton Mail, and the Proton Mail row in the Email Providers tab documents the case that matters…
Unassigned
Prudential Financial
According to the settlement website, files accessed in the February 2024 breach may have contained the full identity-theft package - names, dates of birth…
Unassigned
Pulte
Homebuilder operating Pulte Mortgage as an affiliated lender, with the same one-group financial dossier structure as D.R. Horton and Lennar.
Unassigned
QVC / QVC Group (incl. HSN)
The (now closed-to-new-clients) Labaton arbitration campaign concerns the Video Privacy Protection Act - a 1988 statute passed after a newspaper obtained a…
Unassigned
Red Roof Inn
The economy motel segment carries a category of legal exposure that has nothing to do with data and everything to do with what operators knew…
Unassigned
Rite Aid
A May 2023 breach affecting up to 24,400 customers and a confirmed June 2024 ransomware breach affecting about 2.2 million customers exposed personal…
Unassigned
Ro (Roman Health Ventures Inc.)
Ro's own privacy policy (effective Oct 14, 2026) lists 'Advertising partners' as recipients of health information.
Unassigned
Roblox
Roblox now faces roughly 180 federal lawsuits consolidated into a single multidistrict litigation…
Unassigned
Rover (Blackstone)
The April 2026 class action is worth reading alongside what a pet-sitting platform actually knows…
Unassigned
Royal Caribbean Cruises
The February 2021 breach was disclosed through a state attorney general filing (California, June 2021), which is again the mechanism by which most of these…
Unassigned
Ryanair
Ryanair's facial-recognition verification requirement is the finding: passengers who book through third-party travel agents have been pushed to submit a…
Unassigned
SAS (Scandinavian Airlines)
SAS was swept up in the same 2021 SITA vendor breach as Finnair, Singapore Airlines, Japan Airlines and Air India - one intrusion at one aviation IT provider…
Unassigned
Samsung (Smart TVs / SmartThings)
Texas sued Samsung in December 2025 alleging its smart TVs used automated content recognition (ACR) to capture what was on screen and send viewing data back…
Unassigned
Sephora (LVMH)
Sephora's Virtual Artist try-on drew a BIPA suit on the same theory as Ulta's GLAM Lab - facial geometry captured to render a cosmetic preview.
Unassigned
Shein
Shein and Temu — two companies facing strikingly similar customer-data and counterfeiting concerns…
Unassigned
Signal
An earlier draft of this row described an active class action against Signal; no record of any such case could be found, so none is asserted here.
Unassigned
Singapore Airlines
Singapore Airlines was caught in the 2021 SITA vendor breach alongside Finnair, SAS, Japan Airlines and Air India - frequent-flyer data for KrisFlyer members…
Unassigned
Sirius XM
Sirius XM's most persistent consumer finding is not privacy but subscription mechanics - it has faced sustained regulatory and litigation attention over…
Unassigned
Try fewer filters, or clear them all.