This is EmailMeNow’s multi-source breach data week snapshot for September 13, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 454 |
| Texas OAG | Texans affected | 31,781,146 |
| HHS OCR | 2026 submissions | 338 |
| HHS OCR | Individuals (2026) | 65,513,278 |
| SEC Form 8-K | Item 1.05 families YTD | 20 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 25 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 46 |
| California AG | YTD notices | 385 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 530,935 |
| Have I Been Pwned | 2026 listings | 83 |
| Have I Been Pwned | Accounts (2026 listings) | 294,106,303 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +11 (443 → 454)
- Texas YTD affected +139,262 (31,641,884 → 31,781,146)
- HHS 2026 submissions +18 (320 → 338)
- HHS 2026 individuals +4,342,140 (61,171,138 → 65,513,278)
- SEC 8-K Item 1.05 families YTD +1 (19 → 20)
Source roundups this week
Source-specific detail pages for this week’s new listings. This digest is the multi-source hub (YTD totals + companies); open a roundup below for that source’s table and audits.
| Source | Roundup | Tracker |
|---|---|---|
| Have I Been Pwned | September 13, 2026 | Open tracker |
| Texas OAG | September 11, 2026 | Open tracker |
| SEC Form 8-K | September 8, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through September 13, 2026 (12 shown; 12 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| Chess.com (2026) | Have I Been Pwned | chess.com |
| Quatrro Business Support Services, Inc. (“Quatrro”) | Texas OAG | quatrro.com |
| Costa Solutions, LLC | Texas OAG | costasolutions.com |
| Vernon & Waldrep OB-Gyn Associates | Texas OAG | mckesson.com |
| Azle Cube Smiles PLLC | Texas OAG | azle.com |
| Greenberg Traurig, LLP (“GT”) | Texas OAG | greenbergtraurig.com |
| Heart of Texas Workforce Development Board, Inc. | Texas OAG | heart.com |
| Cardinal Services LLC | Texas OAG | cardinalsvc.com |
| North Dallas Shared Ministries, dba Now-Forward | Texas OAG | dallas.com |
| BOSTON SCIENTIFIC CORP | SEC Form 8-K | bostonscientific.com |
| FIRST CITIZENS BANCSHARES INC /DE/ | SEC Form 8-K | citizens.com |
| Veradigm Inc. | SEC Form 8-K | wolfram.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on September 13, 2026 scored 12 filer domains in this batch.
11 of 12 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Chess.com (2026) (chess.com) leads at 78% overall; Heart of Texas Workforce Development Board, Inc. (heart.com) scores 23%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Chess.com (2026) | chess.com | 78% | 90% | 15% | 87% | Good |
| Quatrro Business Support Services, Inc. (“Quatrro”) | quatrro.com | 47% | 50% | 15% | 37% | Below Average |
| Costa Solutions, LLC | costasolutions.com | 34% | 0% | 15% | 62% | Weak |
| Vernon & Waldrep OB-Gyn Associates | mckesson.com | 64% | 90% | 15% | 42% | Above Average |
| Azle Cube Smiles PLLC | azle.com | 43% | 50% | 15% | 37% | Below Average |
| Greenberg Traurig, LLP (“GT”) | greenbergtraurig.com | 49% | 65% | 15% | 37% | Below Average |
| Heart of Texas Workforce Development Board, Inc. | heart.com | 23% | 0% | 15% | 37% | Weakest |
| Cardinal Services LLC | cardinalsvc.com | 50% | 50% | 70% | 37% | Average |
| North Dallas Shared Ministries, dba Now-Forward | dallas.com | 27% | 0% | 15% | 37% | Weakest |
| BOSTON SCIENTIFIC CORP | bostonscientific.com | 56% | 70% | 15% | 40% | Average |
| FIRST CITIZENS BANCSHARES INC /DE/ | citizens.com | 59% | 75% | 15% | 43% | Average |
| Veradigm Inc. | wolfram.com | 64% | 75% | 15% | 62% | Above Average |
Audit links: chess.com · quatrro.com · costasolutions.com · mckesson.com · azle.com · greenbergtraurig.com · heart.com · cardinalsvc.com · dallas.com · bostonscientific.com · citizens.com · wolfram.com
Website stack note
- Cardinal Services LLC (
cardinalsvc.com): WordPress behind current (running 6.9.9; latest 7.1.2) - Costa Solutions, LLC (
costasolutions.com): WordPress behind current (running 3.7.1; latest 7.1.2); WordPress: WordPress core older than 6.4 has multiple known security fixes in later releases; upgrade promptly. - Quatrro Business Support Services, Inc. (“Quatrro”) (
quatrro.com):
Related trackers
- Texas OAG YTD dashboard
- Government & education tracker
- Monitoring guide
- All state AG trackers
- Washington healthcare breaches (2026)
- Washington law firm breaches (2026)
- CA September roundup
- TX September roundup
- WA September roundup
- TX Parks breach
- Have I Been Pwned
- HIBP September roundup
- Breach data week (September)
- HHS OCR August roundup
- SEC 8-K September roundup
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR