1,788 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.
1,788
Total Actions
16
Jurisdictions
$51.8B+
Total Fines Tracked
Gainwell Technologies LLC (Business Associate, TX) reported a HIPAA breach affecting 912 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Other.
VIVA Health (Health Plan, AL) reported a HIPAA breach affecting 4,945 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Other.
Intercommunity Action Inc. (Healthcare Provider, PA) reported a HIPAA breach affecting 2,680 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
The California Privacy Protection Agency (CPPA) announced the approval of final regulations covering cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT), insurance companies, and updates to existing CCPA regulations. The regulations go into effect January 1, 2026, with phased compliance deadlines for businesses based on revenue and type of requirement.
Healthcare Interactive (Business Associate, MD) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
A coalition of 21 state attorneys general led by New York Attorney General Letitia James obtained a temporary restraining order from the District Court for the Northern District of California blocking the USDA from demanding personally identifiable information of all SNAP recipients, including Social Security numbers, home addresses, and immigration statuses. The lawsuit argued that the USDA’s demand violated federal and state laws prohibiting disclosure of SNAP data except in narrow circumstances, and that the data would be used for immigration enforcement against recipients. The order also prohibits the USDA from withholding SNAP funding from plaintiff states that refuse to comply with the data demand.
New York Attorney General Letitia James and a coalition of 20 other states sued the U.S. Department of Agriculture to stop its demand for personal information of SNAP recipients for immigration enforcement. The District Court issued a temporary restraining order blocking USDA's demand and preventing funding cuts, citing violations of laws protecting SNAP data confidentiality.
Munson Healthcare (Healthcare Provider, MI) reported a HIPAA breach affecting 1,186 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Paper/Films.
Trusteed Plan Services Corporation (Business Associate, WA) reported a HIPAA breach affecting 7,977 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Florida Attorney General James Uthmeier filed complaints against multiple pornography websites for violating Florida's age-verification law by not verifying users' ages, allowing children access to harmful material. The law requires such sites to implement age verification, and violations can result in fines up to $50,000 per violation. The complaints seek injunctions, civil penalties, and compliance with the law.
Cookeville Regional Medical Center (Healthcare Provider, TN) reported a HIPAA breach affecting 500 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Saint Anthony Hospital (Healthcare Provider, IL) reported a HIPAA breach affecting 6,679 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
North Penn Comprehensive Health Services d.b.a Laurel Health Centers (Healthcare Provider, PA) reported a HIPAA breach affecting 991 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
The California Legislature passed AB 566, the California Opt Me Out Act, which will require browsers to support opt-out preference signals (OOPS), allowing consumers to easily limit the sale and sharing of their personal information. The bill now heads to the Governor for signature. The CPPA commended the legislature for this action.
The FTC issued 6(b) orders to seven technology companies to investigate the safety and privacy practices of their AI chatbots, particularly regarding impacts on children and teens. The inquiry focuses on compliance with children's privacy laws, data handling, and disclosures, requiring companies to provide information on these aspects.
Western Skies Wellness LLC (Healthcare Provider, OR) reported a HIPAA breach affecting 1,700 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Electronic Medical Record, Other.
Franklin Dermatology Group, PLC (Healthcare Provider, TN) reported a HIPAA breach affecting 2,457 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Texas Center for Infectious Disease Associates (Healthcare Provider, TX) reported a HIPAA breach affecting 1,236 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Connecticut, California, and Colorado attorneys general, along with the California Privacy Protection Agency, announced a joint investigative sweep targeting businesses that fail to honor Global Privacy Control (GPC) signals, which allow consumers to opt-out of the sale of their personal information. The coalition sent letters to non-compliant businesses demanding immediate compliance with state privacy laws requiring respect for consumer opt-out preferences.
The California Privacy Protection Agency, together with the Attorneys General of California, Colorado, and Connecticut, announced an investigative sweep targeting businesses that fail to honor Global Privacy Control (GPC) signals, which automatically communicate consumers' opt-out requests. The coalition is contacting identified businesses and demanding immediate compliance with state privacy laws. This coordinated effort highlights the states' commitment to enforcing consumers' right to opt-out of the sale of their personal information.
Somerset County Children and Youth Services (Healthcare Provider, PA) reported a HIPAA breach affecting 2,251 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Coos County Family Health Services (Healthcare Provider, NH) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Twin Cities Pain Clinic (Healthcare Provider, MN) reported a HIPAA breach affecting 3,572 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Texas Attorney General Ken Paxton filed a lawsuit against PowerSchool, a provider of cloud-based services for K-12 schools, following a data breach that exposed the personal and health information of over 880,000 Texas school-aged children and teachers. The breach occurred in December 2024 when a hacker gained administrative access through a subcontractor's account and stole unencrypted data including Social Security numbers, medical details, and disability records. The lawsuit alleges PowerSchool violated Texas law by failing to implement basic security measures and by misleading customers about its security practices.
North Oaks Health System (Healthcare Provider, LA) reported a HIPAA breach affecting 6,243 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
La Perouse, LLC (Business Associate, NV) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Anthony L. Jordan Health Corporation (Healthcare Provider, NY) reported a HIPAA breach affecting 2,974 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Reimagine Network (Healthcare Provider, CA) reported a HIPAA breach affecting 4,799 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Florida Attorney General James Uthmeier issued a subpoena to Lorex as part of an ongoing consumer protection and data privacy investigation. The probe examines Lorex’s ties to Dahua Technology and potential foreign spying risks, including unauthorized access to children’s data, and whether the company misled consumers about the privacy and security of its camera products and apps. The subpoena seeks documents related to corporate structure, third-party contracts, software update origins, data center locations, security vulnerabilities, and marketing claims about privacy and security.
Carrollton Ear, Nose and Throat, PC (Healthcare Provider, GA) reported a HIPAA breach affecting 3,569 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
All data sourced from official government enforcement pages.