This is EmailMeNow’s multi-source breach data week snapshot for August 23, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 418 |
| Texas OAG | Texans affected | 31,463,930 |
| HHS OCR | 2026 submissions | 293 |
| HHS OCR | Individuals (2026) | 48,523,665 |
| SEC Form 8-K | Item 1.05 families YTD | 17 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 22 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 38 |
| California AG | YTD notices | 360 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 502,335 |
| Have I Been Pwned | 2026 listings | 78 |
| Have I Been Pwned | Accounts (2026 listings) | 260,039,472 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +14 (404 → 418)
- Texas YTD affected +358,777 (31,105,153 → 31,463,930)
- HHS 2026 submissions +19 (274 → 293)
- HHS 2026 individuals +3,919,346 (44,604,319 → 48,523,665)
Source roundups this week
Source-specific detail pages for this week’s new listings. This digest is the multi-source hub (YTD totals + companies); open a roundup below for that source’s table and audits.
| Source | Roundup | Tracker |
|---|---|---|
| Have I Been Pwned | August 22, 2026 | Open tracker |
| California AG | August 21, 2026 | Open tracker |
| Texas OAG | August 21, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through August 23, 2026 (18 shown; 17 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| Golf Canada | Have I Been Pwned | golfcanada.ca |
| ASOS US Sales LLC | California AG | asos.com |
| Kern Psychiatric Health and Wellness Center, Inc | California AG | kern.com |
| POLAM Federal Credit Union | California AG | polamfcu.com |
| The Health Trust and its subsidiary, FASS | California AG | health.com |
| Wilmer Cutler Pickering Hale and Dorr LLP | Texas OAG | wilmer.com |
| Williams Brothers Construction Co., Inc. | Texas OAG | williamsbrothersconstruction.com |
| ASOS US Sales LLC | Texas OAG | asos.com |
| Community First Health Plans, Inc. | Texas OAG | communityfirsthealthplans.com |
| Forrestall CPAs LLC | Texas OAG | forrestallcpas.com |
| Turner Construction Company | Texas OAG | alcastcompany.com |
| HUT American Group LLC | Texas OAG | — |
| Ozark Interests, Inc. | Texas OAG | ozark.com |
| Southern Illinois University | Texas OAG | southerncompany.com |
| Cantex, Inc. | Texas OAG | cantexinc.com |
| Monmouth University | Texas OAG | monmouth.edu |
| Allstate | Texas OAG | allstate.com |
| United Language Group, LLC | Texas OAG | unitedlanguagegroup.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on August 23, 2026 scored 16 filer domains in this batch.
13 of 16 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Monmouth University (monmouth.edu) leads at 82% overall; Wilmer Cutler Pickering Hale and Dorr LLP (wilmer.com) scores 24%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Golf Canada | golfcanada.ca | 37% | 25% | 15% | 37% | Weak |
| ASOS US Sales LLC | asos.com | 62% | 85% | 15% | 40% | Above Average |
| Kern Psychiatric Health and Wellness Center, Inc | kern.com | 55% | 50% | 15% | 65% | Average |
| POLAM Federal Credit Union | polamfcu.com | 47% | 50% | 15% | 37% | Below Average |
| The Health Trust and its subsidiary, FASS | health.com | 55% | 65% | 15% | 45% | Average |
| Wilmer Cutler Pickering Hale and Dorr LLP | wilmer.com | 24% | 0% | 15% | 40% | Weakest |
| Williams Brothers Construction Co., Inc. | williamsbrothersconstruction.com | 59% | 90% | 15% | 37% | Average |
| Community First Health Plans, Inc. | communityfirsthealthplans.com | 41% | 35% | 15% | 37% | Below Average |
| Forrestall CPAs LLC | forrestallcpas.com | 39% | 25% | 50% | 37% | Weak |
| Turner Construction Company | alcastcompany.com | 57% | 75% | 15% | 39% | Average |
| Ozark Interests, Inc. | ozark.com | 31% | 10% | 15% | 37% | Weak |
| Southern Illinois University | southerncompany.com | 38% | 25% | 15% | 40% | Weak |
| Cantex, Inc. | cantexinc.com | 63% | 90% | 15% | 37% | Above Average |
| Monmouth University | monmouth.edu | 82% | 90% | 70% | 90% | Good |
| Allstate | allstate.com | 55% | 65% | 40% | 40% | Average |
| United Language Group, LLC | unitedlanguagegroup.com | 35% | 0% | 15% | 65% | Weak |
Audit links: golfcanada.ca · asos.com · kern.com · polamfcu.com · health.com · wilmer.com · williamsbrothersconstruction.com · communityfirsthealthplans.com · forrestallcpas.com · alcastcompany.com · ozark.com · southerncompany.com · cantexinc.com · monmouth.edu · allstate.com · unitedlanguagegroup.com
Website stack note
- Turner Construction Company (
alcastcompany.com): PHP outdated/unsupported (8.0.30 — no vendor security patches) - Community First Health Plans, Inc. (
communityfirsthealthplans.com): WordPress behind current (running 7.0.4; latest 7.1) - POLAM Federal Credit Union (
polamfcu.com): WordPress behind current (running 7.0.2; latest 7.1) - United Language Group, LLC (
unitedlanguagegroup.com): WordPress behind current (running 3.7.1; latest 7.1); WordPress: WordPress core older than 6.4 has multiple known security fixes in later releases; upgrade promptly.
Related trackers
- All state AG trackers
- Texas OAG YTD dashboard
- Have I Been Pwned 2026 tracker
- SEC Form 8-K Item 1.05 cyber disclosures YTD 2026
- HIPAA / HHS OCR statistics
- Breach monitoring guide
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR