This is EmailMeNow’s multi-source breach data week snapshot for August 2, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 370 |
| Texas OAG | Texans affected | 29,722,801 |
| HHS OCR | 2026 submissions | 257 |
| HHS OCR | Individuals (2026) | 24,810,594 |
| SEC Form 8-K | Item 1.05 families YTD | 15 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 20 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 34 |
| California AG | YTD notices | 321 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 658,884 |
| Have I Been Pwned | 2026 listings | 70 |
| Have I Been Pwned | Accounts (2026 listings) | 243,644,945 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +18 (352 → 370)
- Texas YTD affected +377,495 (29,345,306 → 29,722,801)
- HHS 2026 submissions +11 (246 → 257)
- HHS 2026 individuals +317,200 (24,493,394 → 24,810,594)
- SEC 8-K Item 1.05 families YTD +1 (14 → 15)
Source roundups this week
| Source | Roundup | Tracker |
|---|---|---|
| Have I Been Pwned | August 1, 2026 | Open tracker |
| SEC Form 8-K | July 31, 2026 | Open tracker |
| Texas OAG | July 31, 2026 | Open tracker |
| California AG | July 27, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through August 2, 2026 (11 shown; 10 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| SplitVPN | Have I Been Pwned | splitvpn.io |
| AMGEN INC | SEC Form 8-K | amgen.com |
| SM Energy Company | Texas OAG | peoplesenergy.co.uk |
| Travis County Credit Union | Texas OAG | traviscountytx.gov |
| Goodwin Procter LLP | Texas OAG | goodwinprocter.com |
| TELUS International AI, Inc., d/b/a TELUS Digital | Texas OAG | telusinternational.com |
| MPS Enterprises, Inc. (“MPS”) | Texas OAG | mpsenterprises.co.uk |
| Sunrise Company | Texas OAG | sunrisecompany.nl |
| JRK Property Holdings, Inc. | California AG | jrk.com |
| Regional Center of Orange County | California AG | — |
| SPay Inc dba Stack Sports | California AG | stacksports.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on August 2, 2026 scored 10 filer domains in this batch.
7 of 10 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
AMGEN INC (amgen.com) leads at 66% overall; SM Energy Company (peoplesenergy.co.uk) scores 23%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| SplitVPN | splitvpn.io | 48% | 50% | 15% | 40% | Below Average |
| AMGEN INC | amgen.com | 66% | 90% | 50% | 43% | Above Average |
| SM Energy Company | peoplesenergy.co.uk | 23% | 0% | 15% | 37% | Weakest |
| Travis County Credit Union | traviscountytx.gov | 62% | 50% | 15% | 87% | Above Average |
| Goodwin Procter LLP | goodwinprocter.com | 47% | 50% | 15% | 37% | Below Average |
| TELUS International AI, Inc., d/b/a TELUS Digital | telusinternational.com | 53% | 65% | 15% | 37% | Average |
| MPS Enterprises, Inc. (“MPS”) | mpsenterprises.co.uk | 41% | 35% | 15% | 37% | Below Average |
| Sunrise Company | sunrisecompany.nl | 38% | 25% | 45% | 37% | Weak |
| JRK Property Holdings, Inc. | jrk.com | 62% | 85% | 45% | 37% | Above Average |
| SPay Inc dba Stack Sports | stacksports.com | 65% | 90% | 15% | 45% | Above Average |
Audit links: splitvpn.io · amgen.com · peoplesenergy.co.uk · traviscountytx.gov · goodwinprocter.com · telusinternational.com · mpsenterprises.co.uk · sunrisecompany.nl · jrk.com · stacksports.com
Website stack note
- MPS Enterprises, Inc. (“MPS”) (
mpsenterprises.co.uk): PHP outdated/unsupported (5.3.29 — no vendor security patches) - Sunrise Company (
sunrisecompany.nl): PHP outdated/unsupported (7.4.33 — no vendor security patches); WordPress behind current (running 6.7.7; latest 7.0.4) - Travis County Credit Union (
traviscountytx.gov): Bootstrap: Bootstrap 3/4 are past primary vendor support; upgrade to Bootstrap 5 when practical (often theme-bundled).
Related trackers
- Texas OAG YTD dashboard
- Government & education tracker
- Monitoring guide
- All state AG trackers
- Washington healthcare breaches (2026)
- Washington law firm breaches (2026)
- CA July roundup
- TX July roundup
- WA May roundup
- TX Parks breach
- Have I Been Pwned
- HIBP August roundup
- Breach data week (August)
- HHS OCR July roundup
- SEC 8-K July roundup
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR