Recent cyber attacks and data breaches

Rockwood Retirement Communities (Spokane United Methodist Homes) notified the Washington State Attorney General on August 20, 2026 of a data breach that occurred on February 15, 2026, affecting 7,136 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Financial & Banking Information, Full Date of Birth, Passport Number, Health Insurance Policy or ID Number, Medical Information, Email Address and Password/Security Question Answers, Protected Health Information owned or licensed by a HIPAA covered entity.

Life Bridges, Inc., a healthcare provider in TN, reported a breach of health information affecting 5,194 people to the US Department of Health and Human Services on August 20, 2026. HHS records the breach type as hacking/it incident, involving network server.

In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack . The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.

In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates . The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.

Silver Summit Medical Corporation notified the California Attorney General of a data breach on August 19, 2026, with the breach dated November 27, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

Nebraska Orthopaedic Center (Aesto, LLC) notified the Washington State Attorney General on August 19, 2026 of a data breach that occurred on December 2, 2025, affecting 992 Washington residents. Information involved: Name, Social Security Number, Full Date of Birth, Medical Information.

United Language Group, LLC, a business associate in KS, reported a breach of health information affecting 4,649 people to the US Department of Health and Human Services on August 19, 2026. HHS records the breach type as hacking/it incident, involving network server.

Apple American Group LLC and Apple American Group II, LLC notified the Washington State Attorney General on August 18, 2026 of a data breach that occurred on April 8, 2026, affecting 20,653 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Financial & Banking Information, Full Date of Birth, Military ID Number, Passport Number, Health Insurance Policy or ID Number, Medical Information, Biometric Data, Username and Password/Security Question Answers, Email Address and Password/Security Question Answers.

Turner Construction Company notified the Washington State Attorney General on August 18, 2026 of a data breach that occurred on July 2, 2026, affecting 3,401 Washington residents. Information involved: Name, Social Security Number, Financial & Banking Information, Full Date of Birth, Passport Number.

Forrestall CPAs LLC notified the California Attorney General of a data breach on August 17, 2026, with the breach dated December 22, 2025. The notice covers more than 500 California residents; California does not publish the exact number.