This is EmailMeNow’s multi-source breach data week snapshot for July 26, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 352 |
| Texas OAG | Texans affected | 29,345,306 |
| HHS OCR | 2026 submissions | 246 |
| HHS OCR | Individuals (2026) | 24,493,394 |
| SEC Form 8-K | Item 1.05 families YTD | 14 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 18 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 31 |
| California AG | YTD notices | 310 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 551,124 |
| Have I Been Pwned | 2026 listings | 68 |
| Have I Been Pwned | Accounts (2026 listings) | 241,947,967 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +10 (342 → 352)
- Texas YTD affected +473,143 (28,872,163 → 29,345,306)
- HHS 2026 submissions +5 (241 → 246)
- HHS 2026 individuals +1,249,310 (23,244,084 → 24,493,394)
Source roundups this week
| Source | Roundup | Tracker |
|---|---|---|
| California AG | July 23, 2026 | Open tracker |
| Texas OAG | July 23, 2026 | Open tracker |
| Have I Been Pwned | July 19, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through July 26, 2026 (13 shown; 13 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| Devereux Foundation | California AG | devereux.org |
| Safetyfirst Systems, LLC | California AG | safetyfirst.com |
| The Moody Bible Institute of Chicago | California AG | moody.edu |
| Unlimited Technology Systems, LLC | Texas OAG | unlimitedtechnology.com |
| Xsolis, Inc. | Texas OAG | xsolis.com |
| Central Texas MHMR dba Center for Life Resource | Texas OAG | cflr.us |
| The Devereux Foundation | Texas OAG | devereux.org |
| Safetyfirst Systems, LLC | Texas OAG | safetyfirst.com |
| McEwen and Associates, Inc. | Texas OAG | mcewenassociates.com |
| First Advantage Corporation | Texas OAG | fadv.com |
| Texas Department of Criminal Justice | Texas OAG | tdcj.texas.gov |
| United States Tennis Association Texas | Texas OAG | ustatexas.com |
| Paidwork | Have I Been Pwned | paidwork.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on July 26, 2026 scored 11 filer domains in this batch.
10 of 11 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Central Texas MHMR dba Center for Life Resource (cflr.us) leads at 78% overall; United States Tennis Association Texas (ustatexas.com) scores 28%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Devereux Foundation | devereux.org | 70% | 90% | 15% | 43% | Good |
| Safetyfirst Systems, LLC | safetyfirst.com | 42% | 25% | 15% | 37% | Below Average |
| The Moody Bible Institute of Chicago | moody.edu | 64% | 75% | 15% | 45% | Above Average |
| Unlimited Technology Systems, LLC | unlimitedtechnology.com | 37% | 10% | 15% | 40% | Weak |
| Xsolis, Inc. | xsolis.com | 52% | 50% | 15% | 37% | Average |
| Central Texas MHMR dba Center for Life Resource | cflr.us | 78% | 75% | 15% | 90% | Good |
| McEwen and Associates, Inc. | mcewenassociates.com | 33% | 0% | 15% | 40% | Weak |
| First Advantage Corporation | fadv.com | 66% | 85% | 15% | 37% | Above Average |
| Texas Department of Criminal Justice | tdcj.texas.gov | 53% | 50% | 45% | 37% | Average |
| United States Tennis Association Texas | ustatexas.com | 28% | 0% | 15% | 37% | Weakest |
| Paidwork | paidwork.com | 67% | 60% | 15% | 92% | Above Average |
Audit links: devereux.org · safetyfirst.com · moody.edu · unlimitedtechnology.com · xsolis.com · cflr.us · mcewenassociates.com · fadv.com · tdcj.texas.gov · ustatexas.com · paidwork.com
Website stack note
- First Advantage Corporation (
fadv.com): WordPress behind current (running 3.7.1; latest 7.0.4); WordPress: WordPress core older than 6.4 has multiple known security fixes in later releases; upgrade promptly.
Related trackers
- Texas OAG YTD dashboard
- Government & education tracker
- Monitoring guide
- All state AG trackers
- Washington healthcare breaches (2026)
- Washington law firm breaches (2026)
- CA July roundup
- TX July roundup
- WA May roundup
- TX Parks breach
- Have I Been Pwned
- HIBP July roundup
- Breach data week (July)
- HHS OCR July roundup
- SEC 8-K July roundup
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR