Findings

1 The shared-vendor pattern

The tracker's single biggest structural finding

Across 903 companies, the dominant breach mechanism is not an attack on the company whose name is on your receipt.

2 Algorithmic claim denial in health insurance

The same purchased software tool was deployed across competing insurers to decide when elderly patients should stop receiving post-hospital rehabilitation.

3 Privacy as a purchasable enterprise feature

Across completely unrelated industries, the meaningful data protections are attached to the paid business tier, and the consumer tier is the one that funds the difference.

4 The notice address is not headquarters

Discovered while building the contact columns.

5 Social engineering beat every technical control

The largest breaches in this tracker required no zero-day, no malware, and no technical exploit.

6 Breach figures are provisional

The first number is nearly meaningless

Initial breach notifications routinely understate scope by orders of magnitude, but the consumer's decision about whether to freeze credit gets made on the first number.

7 Employees often dominate a consumer breach

Several of the largest 'customer' breaches in this tracker mainly exposed workers, dependants and beneficiaries - people with no ability to shop elsewhere.

8 The HIPAA perimeter is small

An enormous volume of health-grade data is held by entities that are not HIPAA covered entities, so the protection consumers assume applies simply does not.

9 Arbitration changed liability's shape

Arbitration clauses did not remove liability

Class action waivers worked, so plaintiffs' firms switched to mass arbitration: thousands of individual filings, each carrying a filing fee the company must pay.

10 Law follows geography, not conduct

Identical conduct produces completely different consumer outcomes depending on the defendant's category and the plaintiff's state.

11 Penalties track ability to pay

The size of a fine repeatedly reflects the company's financial position or the regulator's statutory authority rather than the scale of injury.

12 Empty rows measure the disclosure regime

Dozens of rows (roughly 86 at the last internal count; not re-counted in this pass) are explicitly marked 'unverified rather than clean.'

13 No published written channel

The paper trail is disappearing

A growing share of major companies publish NO privacy email and, in several cases, no privacy mailing address at all.

14 The shortest deadline in consumer law

Most arbitration clauses let you reject them — but only by written notice inside a short window that starts the day you open the account, not the day a problem arises.

15 The franchise gap

The brand's privacy policy does not describe the business that holds your data

In franchised industries the company publishing the privacy policy owns almost none of the locations.

16 The EHR layer

The company holding your chart is one you never signed with

Almost every US medical record now lives inside a vendor's EHR (Epic, Oracle Health/Cerner, athenahealth, eClinicalWorks, NextGen, MEDITECH and others) and moves between providers over exchange networks…