1,788 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.
1,788
Total Actions
16
Jurisdictions
$51.8B+
Total Fines Tracked
Issaqueena Pediatric Dentistry PA (Healthcare Provider, SC) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
The California Privacy Protection Agency (CalPrivacy) announced the appointment of Sabrina Boyson Ross as its first Chief Privacy Auditor and the formation of a new Audits Division. The division will conduct regulatory examinations of businesses to determine compliance with the California Consumer Privacy Act, and its findings may lead to enforcement referrals.
New Jersey Acting Attorney General Jennifer Davenport, alongside 42 states and territories, filed a multistate complaint against Novartis AG and its subsidiaries Sandoz AG and Sandoz Group AG alleging a conspiracy to fix prices, allocate markets, and rig bids for 31 generic drugs, inflating costs for consumers and public healthcare programs. The complaint also alleges Novartis fraudulently spun off Sandoz to shield itself from liability for prior antitrust violations. This action builds on evidence from three previous multistate generic drug price-fixing complaints.
Pafford Medical Services (Healthcare Provider, AR) reported a HIPAA breach affecting 1,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Mindoula Health, Inc. (Business Associate, MD) reported a HIPAA breach affecting 626 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
BAYADA Home Health Care, Inc. (Healthcare Provider, NJ) reported a HIPAA breach affecting 9,526 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Health and Hospital Corporation of Marion County (Healthcare Provider, IN) reported a HIPAA breach affecting 792 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Email, Laptop.
Senator Josh Becker introduced SB 923, the Expanding Privacy Rights Act, sponsored by CalPrivacy. The bill would expand the CCPA right to delete to include personal information obtained from third-party sources, and require businesses to provide multiple methods (e.g., webform) for submitting privacy requests.
Lincoln National Corporation d/b/a/ Lincoln Financial (Health Plan, IN) reported a HIPAA breach affecting 998 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Paper/Films.
The Connecticut Attorney General and Consumer Counsel secured a settlement requiring Charter Communications to adhere to consumer protection commitments as it acquires Cox Communications. The agreement, pending PURA approval, includes pricing transparency, service reliability improvements, a $3 million digital access investment, and compliance with the Connecticut Data Privacy Act. It also maintains a Connecticut workforce and office, and prevents cost pass-through to customers.
The Connecticut Attorney General and Consumer Counsel announced a settlement with Charter Communications regarding its proposed acquisition of Cox Communications. The settlement includes consumer protections such as billing transparency, service reliability improvements, a $3 million digital access investment, and other commitments. It is pending approval by the Public Utilities Regulatory Authority.
WindRose Health Network (Healthcare Provider, IN) reported a HIPAA breach affecting 691 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
California Attorney General Rob Bonta announced an investigative sweep targeting businesses that use surveillance pricing, which involves setting individualized prices based on consumer data. The Department of Justice is sending information request letters to companies in the retail, grocery, and hotel sectors to assess compliance with the CCPA's purpose limitation principle. This action seeks to ensure that consumers are not charged different prices without proper disclosure and that businesses adhere to privacy laws.
The California Privacy Protection Agency (CalPrivacy) announced the launch of the Delete Request and Opt-out Platform (DROP) during Data Privacy Week. DROP allows Californians to submit a single request to delete their personal information from over 500 registered data brokers, as required by the Delete Act. The platform is free and has already seen over 176,000 sign-ups since January 1, 2026.
A bipartisan coalition of 35 state attorneys general led by New York Attorney General Letitia James sent a demand letter to xAI on January 26, 2026, requiring the company to address its Grok chatbot’s creation and sharing of nonconsensual intimate images, including child sexual abuse material. The AGs demand that xAI implement safeguards to prevent Grok from generating such content, delete existing harmful content, suspend offending users, and give X users control over whether their content can be edited by Grok. No monetary penalty has been imposed as this is a pre-enforcement demand for action.
New Jersey Acting Attorney General Jennifer Davenport and the Division of Consumer Affairs issued general guidance warning sellers against engaging in price gouging during a declared state of emergency ahead of a major winter storm. The guidance cites New Jersey’s price gouging law, which prohibits price increases exceeding 10% of pre-emergency prices for necessary goods and services during the emergency and 30 days after its termination. Violations carry civil penalties up to $10,000 for first offenses and $20,000 for subsequent offenses, with each individual sale counted as a separate violation.
Consumer protection case involving charity fraud. A former Orangetheory Fitness instructor pleaded guilty to stealing charitable donations collected during workout classes between 2021 and 2024. He diverted over $24,000 intended for charities to his personal Venmo account to fund his cocaine habit. The Oregon DOJ and Multnomah County DA's Office pursued criminal charges and civil claims to secure restitution and prevent future charitable sector involvement.
Precipio, Inc. (Healthcare Provider, CT) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
New Jersey, serving as co-lead of a 22-state coalition, filed a motion for summary judgment on January 22, 2026, seeking an expedited order to stop the Trump Administration from defunding the Consumer Financial Protection Bureau (CFPB) before March 2026. The states argue that defunding the CFPB would undermine federal and state consumer protection efforts, including states’ reliance on CFPB consumer complaint data and mortgage lending data for enforcement actions. This motion builds on a December 2025 lawsuit filed by the same coalition challenging the administration’s threats to withhold CFPB funding.
AdventHealth Daytona Beach (Healthcare Provider, FL) reported a HIPAA breach affecting 821 individuals. Breach type: Loss. Location of breached information: Paper/Films.
True RCM, a Rapid Care Transcription, Inc., Company (Business Associate, MD) reported a HIPAA breach affecting 1,247 individuals. Breach type: Hacking/IT Incident. Location of breached information: Desktop Computer.
Middlesex Sheriff's Office (Healthcare Provider, MA) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
California Attorney General Rob Bonta, alongside attorneys general from New York, Colorado, Illinois, and Minnesota, filed a motion for preliminary injunction to continue blocking the Trump Administration's unlawful freeze of $10 billion in federal funding for child care and family assistance programs and to prevent broad data requests for personally identifiable information of millions of residents. The funding freeze targets five Democratic-led states without evidence of fraud, and the data requests are part of the challenged unlawful actions. A temporary restraining order was previously granted blocking these measures.
Benton County Health (Healthcare Provider, OR) reported a HIPAA breach affecting 1,476 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Central Texas MHMR Center dba Center for Life Resource (Healthcare Provider, TX) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
California Attorney General Rob Bonta joined a multistate coalition in filing an amicus brief opposing the U.S. Department of Justice's subpoena for patient records from University of Pittsburgh Medical Center related to gender-affirming care. The brief argues that the subpoena violates patient privacy, infringes on states' rights to regulate medicine, and exceeds DOJ's statutory authority.
Superior Care Plus LLC d/b/a Supportive Home Health LLC (Healthcare Provider, OH) reported a HIPAA breach affecting 1,415 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Administrators of the Tulane Educational Fund d/b/a Tulane University Medical Group (Healthcare Provider, LA) reported a HIPAA breach affecting 6,556 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Southern Immediate Care, LLC (Healthcare Provider, AL) reported a HIPAA breach affecting 7,447 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Florence County Commission on Alcohol & Drug Abuse – dba Circle Park Behavioral Health Services (“Circle Park”) (Healthcare Provider, SC) reported a HIPAA breach affecting 7,020 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
All data sourced from official government enforcement pages.