This is EmailMeNow’s multi-source breach data week snapshot for October 18, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 543 |
| Texas OAG | Texans affected | 37,119,681 |
| HHS OCR | 2026 submissions | 386 |
| HHS OCR | Individuals (2026) | 67,066,081 |
| SEC Form 8-K | Item 1.05 families YTD | 22 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 27 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 50 |
| California AG | YTD notices | 452 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 428,702 |
| Have I Been Pwned | 2026 listings | 90 |
| Have I Been Pwned | Accounts (2026 listings) | 296,610,262 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +22 (521 → 543)
- Texas YTD affected +1,363,895 (35,755,786 → 37,119,681)
- HHS 2026 individuals -33,126 (67,099,207 → 67,066,081)
- SEC 8-K Item 1.05 families YTD +1 (21 → 22)
Source roundups this week
Source-specific detail pages for this week’s new listings. This digest is the multi-source hub (YTD totals + companies); open a roundup below for that source’s table and audits.
| Source | Roundup | Tracker |
|---|---|---|
| Have I Been Pwned | October 18, 2026 | Open tracker |
| California AG | October 16, 2026 | Open tracker |
| Texas OAG | October 16, 2026 | Open tracker |
| SEC Form 8-K | October 13, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through October 18, 2026 (19 shown; 16 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| Gîtes de France | Have I Been Pwned | gites-de-france.com |
| CDE | California AG | — |
| Inner City Education Foundation | California AG | innercityeducation.org |
| John G. Yphantides, a Professional Law Corporation | California AG | john.com |
| Neuro Wellness Spa | California AG | neurowellnessspa.com |
| AssuranceAmerica Managing General Agency, LLC | Texas OAG | assuranceamerica.com |
| Klein Independent School District | Texas OAG | sd42.ca |
| The Krum Public Library | Texas OAG | krumlibrary.org |
| JM Bullion, Inc. | Texas OAG | jmbullion.com |
| Stitch Connect Inc | Texas OAG | stitchconnect.com |
| Encore Enterprises | Texas OAG | encore-enterprises.com |
| Delek US Energy, Inc. | Texas OAG | peoplesenergy.co.uk |
| Porter and Company | Texas OAG | porterhedges.com |
| MLD Mortgage Inc. dba The Money Store | Texas OAG | — |
| Magna Hospitality Group | Texas OAG | magnahospitality.com |
| Iroquois Memorial Hospital | Texas OAG | iroquois.com |
| American Board of Preventive Medicine | Texas OAG | board.com |
| Mountrail County Medical Center | Texas OAG | — |
| Park Dental Partners, Inc. | SEC Form 8-K | park56dental.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on October 18, 2026 scored 16 filer domains in this batch.
15 of 16 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
American Board of Preventive Medicine (board.com) leads at 75% overall; Delek US Energy, Inc. (peoplesenergy.co.uk) scores 23%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Gîtes de France | gites-de-france.com | 51% | 35% | 15% | 70% | Average |
| Inner City Education Foundation | innercityeducation.org | 32% | 10% | 15% | 40% | Weak |
| John G. Yphantides, a Professional Law Corporation | john.com | 47% | 50% | 15% | 37% | Below Average |
| Neuro Wellness Spa | neurowellnessspa.com | 57% | 75% | 15% | 37% | Average |
| AssuranceAmerica Managing General Agency, LLC | assuranceamerica.com | 27% | 0% | 15% | 37% | Weakest |
| Klein Independent School District | sd42.ca | 63% | 90% | 15% | 39% | Above Average |
| The Krum Public Library | krumlibrary.org | 48% | 50% | 15% | 40% | Below Average |
| JM Bullion, Inc. | jmbullion.com | 73% | 75% | 15% | 92% | Good |
| Stitch Connect Inc | stitchconnect.com | 44% | 50% | 15% | 40% | Below Average |
| Encore Enterprises | encore-enterprises.com | 48% | 50% | 15% | 40% | Below Average |
| Delek US Energy, Inc. | peoplesenergy.co.uk | 23% | 0% | 15% | 37% | Weakest |
| Porter and Company | porterhedges.com | 58% | 75% | 15% | 40% | Average |
| Magna Hospitality Group | magnahospitality.com | 42% | 35% | 15% | 40% | Below Average |
| Iroquois Memorial Hospital | iroquois.com | 47% | 50% | 15% | 37% | Below Average |
| American Board of Preventive Medicine | board.com | 75% | 65% | 80% | 100% | Good |
| Park Dental Partners, Inc. | park56dental.com | 64% | 90% | 15% | 40% | Above Average |
Audit links: gites-de-france.com · innercityeducation.org · john.com · neurowellnessspa.com · assuranceamerica.com · sd42.ca · krumlibrary.org · jmbullion.com · stitchconnect.com · encore-enterprises.com · peoplesenergy.co.uk · porterhedges.com · magnahospitality.com · iroquois.com · board.com · park56dental.com
Website stack note
- Iroquois Memorial Hospital (
iroquois.com): Bootstrap: Bootstrap 3/4 are past primary vendor support; upgrade to Bootstrap 5 when practical (often theme-bundled). - Park Dental Partners, Inc. (
park56dental.com): Drupal major version behind (reports 10; current major is 11.4.10)
Related trackers
- All state AG trackers
- Texas OAG YTD dashboard
- Have I Been Pwned 2026 tracker
- SEC Form 8-K Item 1.05 cyber disclosures YTD 2026
- HIPAA / HHS OCR statistics
- Breach monitoring guide
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR