This is EmailMeNow’s multi-source breach data week snapshot for October 11, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 521 |
| Texas OAG | Texans affected | 35,755,786 |
| HHS OCR | 2026 submissions | 386 |
| HHS OCR | Individuals (2026) | 67,099,207 |
| SEC Form 8-K | Item 1.05 families YTD | 21 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 26 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 48 |
| California AG | YTD notices | 436 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 428,702 |
| Have I Been Pwned | 2026 listings | 87 |
| Have I Been Pwned | Accounts (2026 listings) | 295,614,595 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +9 (512 → 521)
- Texas YTD affected +311,033 (35,444,753 → 35,755,786)
- HHS 2026 submissions -18 (404 → 386)
- HHS 2026 individuals -515,013 (67,614,220 → 67,099,207)
Source roundups this week
Source-specific detail pages for this week’s new listings. This digest is the multi-source hub (YTD totals + companies); open a roundup below for that source’s table and audits.
| Source | Roundup | Tracker |
|---|---|---|
| Have I Been Pwned | October 9, 2026 | Open tracker |
| Texas OAG | October 6, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through October 11, 2026 (10 shown; 10 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| Neogen | Have I Been Pwned | neogen.com |
| iRhythm Technologies Inc. | Texas OAG | irhythmtech.com |
| Cleburne Independent School District | Texas OAG | sd42.ca |
| Edgewood ISD | Texas OAG | edgewood-isd.net |
| Sheppard, Mullin, Richter & Hampton LLP | Texas OAG | standpointe.com |
| Flowco Holdings Inc. | Texas OAG | flowco.com |
| Harman Fitness | Texas OAG | harmanfitness.com |
| Capitol Pain Institute | Texas OAG | capitolpain.com |
| Fragomen, Del Rey, Bernsen & Loewy, LLP | Texas OAG | fragomendelreybernsenloewy.com |
| Healthcare Highways, LLC | Texas OAG | gehealthcare.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on October 11, 2026 scored 10 filer domains in this batch.
9 of 10 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Healthcare Highways, LLC (gehealthcare.com) leads at 72% overall; Fragomen, Del Rey, Bernsen & Loewy, LLP (fragomendelreybernsenloewy.com) scores 23%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Neogen | neogen.com | 55% | 45% | 15% | 70% | Average |
| iRhythm Technologies Inc. | irhythmtech.com | 45% | 45% | 15% | 37% | Below Average |
| Cleburne Independent School District | sd42.ca | 63% | 90% | 15% | 39% | Above Average |
| Edgewood ISD | edgewood-isd.net | 41% | 10% | 15% | 70% | Below Average |
| Sheppard, Mullin, Richter & Hampton LLP | standpointe.com | 38% | 25% | 45% | 37% | Weak |
| Flowco Holdings Inc. | flowco.com | 42% | 35% | 15% | 40% | Below Average |
| Harman Fitness | harmanfitness.com | 48% | 50% | 15% | 40% | Below Average |
| Capitol Pain Institute | capitolpain.com | 31% | 10% | 15% | 37% | Weak |
| Fragomen, Del Rey, Bernsen & Loewy, LLP | fragomendelreybernsenloewy.com | 23% | 0% | 15% | 37% | Weakest |
| Healthcare Highways, LLC | gehealthcare.com | 72% | 75% | 15% | 87% | Good |
Audit links: neogen.com · irhythmtech.com · sd42.ca · edgewood-isd.net · standpointe.com · flowco.com · harmanfitness.com · capitolpain.com · fragomendelreybernsenloewy.com · gehealthcare.com
Website stack note
- Harman Fitness (
harmanfitness.com): TLS certificate expires in -502 day(s) - Sheppard, Mullin, Richter & Hampton LLP (
standpointe.com): WordPress behind current (running 6.6.10; latest 7.1.3)
Related trackers
- All state AG trackers
- Texas OAG YTD dashboard
- Have I Been Pwned 2026 tracker
- SEC Form 8-K Item 1.05 cyber disclosures YTD 2026
- HIPAA / HHS OCR statistics
- Breach monitoring guide
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR