News
Current events, industry audit reports, compliance watch updates, and technology alerts. By industry · National audits · Breach trackers · MFA directory · State collections: Texas · Florida · California · Illinois · New York · Pennsylvania — showing latest 30 of 790
Instant audit
Run a free scan at audit.emailmenow.com, then unlock the full technical report with remediation plan and compliance evidence for $99.
Scammers abuse real ChatGPT share links with fake high-traffic notices. OpenAI is not reported hacked. Audits (ideal 100%): pushsecurity.com 74%, microsoft.com 71%, openai.com 70%, chatgpt.com 68%.
Read Update
ATF confirmed a major incident on a standalone system holding investigation-target data. Qilin listed the bureau without samples; ATF has not attributed the actor. Audits (ideal 100%): atf.gov 66%, justice.gov 66%, login.gov 63%, eforms.atf.gov 43%. eForms MFA: password + PIN, no YubiKey.
Read Update
Multi-source breach data week of August 30, 2026: Texas OAG, HHS OCR, SEC Form 8-K, HIBP, and state AG trackers. Texas YTD reports +8 (418 → 426). 7 companies/entities from source roundups.
Read Update
Leighton’s in Montrose absorbed 30–45 tap-to-pay chargebacks after stolen cards were loaded onto phones. Audits (ideal 100%): apple.com 69%, intezer.com 63%, toasttab.com 42%, leightonshtx.com 33%. Toast Web: Google Authenticator yes, YubiKey not documented.
Read Update
City of Norcross confirmed ransomware on Aug 1, 2026; public notice came late August. Data exposure, actor, and ransom still undisclosed. Audits (ideal 100%): norcrossga.net 60%, gwinnettcounty.com 57%, civicplus.com 43%. CivicPlus: Google Authenticator yes, YubiKey not documented.
Read Update
AG Dave Sunday warned Aug 28 that a MyChart Medicare Kit does not exist. Officials describe impersonation, not a MyChart platform hack. Audits (ideal 100%): attorneygeneral.gov 78%, epic.com 69%, pennmedicine.org 58%, mychart.org 54%. Epic MFA: authenticator yes, YubiKey not named.
Read Update
Texas OAG published 6 new data security breach reports on August 28, 2026, affecting 7,750 Texans. Lovejoy Independent School District led the batch with 2,666 affected.
Read Update
Fortra FIRE reports a 40% Q2 2026 surge in Chameleon SEO poisoning — cloaked fake bank login pages that rank in Google and Bing but play dead to scanners. Audits (ideal 100%): texascapitalbank.com 85%, chase.com 79%, fortra.com 64%, bankofamerica.com 53% — 0/11 at 100%. Bank of America documents YubiKey; none advertise Google Authenticator.
Read Update
DOJ and FBI seized domains hard-coded into China-nexus QScan and QTRouter platforms used against NASA, the Federal Reserve, DOJ, and the U.S. Senate. Audits (ideal 100%): nih.gov 78%, energy.gov 73%, nsa.gov 55% — 0/11 at 100%. Login.gov documents YubiKey and authenticator apps.
Read Update
Have I Been Pwned added 1 breach on August 25, 2026, exposing 12,933,413 accounts globally. Carhartt led the batch with 12,933,413 accounts.
Read Update
Heights Finance confirmed a May 2026 third-party cloud incident. Texas OAG lists 734,828 Texans. Audits (ideal 100%): heightsfinance.com 60%. MyAccount login is cell-phone only — no YubiKey or Google Authenticator.
Read Update
Microsoft Defender ShieldBreak (CVE-2026-69414) is still unpatched. Apple fixed ImageIO CVE-2026-65346 in iOS 26.6.1. Audits (ideal 100%): microsoft.com 71%, apple.com 69%. Microsoft and Apple Accounts document YubiKey; Apple does not document Google Authenticator.
Read Update
U.S. Bank is investigating a LockBit leak-site claim. The bank says a fourth-party event outside its environment; no evidence its systems were hit. Audits (ideal 100%): usbank.com 68%. MFA: Fail (SMS OTP; no YubiKey/TOTP).
Read Update
Multi-source breach data week of August 23, 2026: Texas OAG, HHS OCR, SEC Form 8-K, HIBP, and state AG trackers. Texas YTD reports +14 (404 → 418). 18 companies/entities from source roundups.
Read Update
Beazley Security’s Q2 2026 threat report: disclosed CVEs +36%, CISA KEV +10%, but 67% of ransomware still starts with stolen VPN/RDP passwords. Device-code phishing beats MFA. Audits (ideal 100%): hackerone.com 88%, nist.gov 84%, beazley.security 78% — none at 100%.
Read Update
Have I Been Pwned added 1 breach on August 22, 2026, exposing 568,972 accounts globally. Golf Canada led the batch with 568,972 accounts.
Read Update
UT San Antonio detected attempted unauthorized activity at the network edge, took systems offline, and delayed fall classes to Aug 24. No evidence of data theft. Audits (ideal 100%): utsa.edu 70%, passphrase.utsa.edu 34%. Duo recommends YubiKey; Google Authenticator not documented.
Read Update
California's data breach list added 4 notices on August 21, 2026. California does not publish residents-affected counts — this roundup tracks reporting visibility.
Read Update
Texas OAG published 13 new data security breach reports on August 21, 2026, affecting 136,398 Texans. Wilmer Cutler Pickering Hale and Dorr LLP led the batch with 80,528 affected.
Read Update
FBI PSA 2026-08-10: phishing lookalike domains and fake support texts steal MFA codes to take over social accounts. Audits (ideal 100%): ic3.gov 87%, instagram.com 80%, google.com 55%. Instagram MFA Pass; Facebook Strong.
Read Update
Group-IB: SpyNote RAT plus WindRelay NFC relay in a live bank-impersonation call. Sideload is the install. Audits (ideal 100%): chase.com 79%, malwarebytes.com 71%, bankofamerica.com 53%. YubiKey does not stop a RATted phone.
Read Update
Multi-source breach data week of August 16, 2026: Texas OAG, HHS OCR, SEC Form 8-K, HIBP, and state AG trackers. Texas YTD reports +22 (382 → 404). 21 companies/entities from source roundups.
Read Update
Fort Worth’s JPS Health Network isolated systems Aug 3 after suspicious activity. EHR returned Aug 15; MyChart stayed down. Audits (ideal 100%): jpshealthnet.org 33% (Identity 0%); jpshealth.org 58%. MyChart MFA: SMS/email OTP, passkeys on login, no documented YubiKey.
Read Update
California's data breach list added 5 notices on August 14, 2026. California does not publish residents-affected counts — this roundup tracks reporting visibility.
Read Update
Delta Flight 591 (LAS–ATL, Aug 10) carried a rogue “Delta WiFi Fast” network after DEF CON 34. Delta says aircraft systems were not hacked. Domain audits (ideal 100%): defcon.org 79%; viasat.com 77%; delta.com 70%; google.com 52% — none at 100%. SkyMiles MFA: SMS/email OTP, no YubiKey or Google Authenticator.
Read Update
Texas OAG published 15 new data security breach reports on August 14, 2026, affecting 1,214,857 Texans. Heights Finance Holdings Co. led the batch with 734,828 affected.
Read Update
Washington's Attorney General published 4 new data breach notifications on August 14, 2026, affecting 76,323 Washingtonians. Paylogix, LLC led the batch with 28,449 affected.
Read Update
Have I Been Pwned added 1 breach on August 13, 2026, exposing 1,596,490 accounts globally. RingCentral led the batch with 1,596,490 accounts.
Read Update
Multi-source breach data week of August 9, 2026: Texas OAG, HHS OCR, SEC Form 8-K, HIBP, and state AG trackers. Texas YTD reports +12 (370 → 382). 10 companies/entities from source roundups.
Read Update
Have I Been Pwned added 1 breach on August 9, 2026, exposing 218,395 accounts globally. Alcon led the batch with 218,395 accounts.
Read Update