This is EmailMeNow’s multi-source breach data week snapshot for September 20, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 467 |
| Texas OAG | Texans affected | 32,154,611 |
| HHS OCR | 2026 submissions | 355 |
| HHS OCR | Individuals (2026) | 66,014,887 |
| SEC Form 8-K | Item 1.05 families YTD | 20 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 25 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 47 |
| California AG | YTD notices | 398 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 428,130 |
| Have I Been Pwned | 2026 listings | 83 |
| Have I Been Pwned | Accounts (2026 listings) | 294,106,303 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +13 (454 → 467)
- Texas YTD affected +373,465 (31,781,146 → 32,154,611)
- HHS 2026 submissions +17 (338 → 355)
- HHS 2026 individuals +501,609 (65,513,278 → 66,014,887)
Source roundups this week
Source-specific detail pages for this week’s new listings. This digest is the multi-source hub (YTD totals + companies); open a roundup below for that source’s table and audits.
| Source | Roundup | Tracker |
|---|---|---|
| Texas OAG | September 17, 2026 | Open tracker |
| California AG | September 15, 2026 | Open tracker |
| Have I Been Pwned | September 13, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through September 20, 2026 (11 shown; 11 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| TEXAS REGIONAL ASTHMA, ALLERGY & IMMUNOLOGY CENTER | Texas OAG | regional.com |
| 7 to 7 Dental & Orthodontics | Texas OAG | dentalorthodontics.com |
| Three Oaks Hospice of Dallas | Texas OAG | threeoakshospice.com |
| Centennial Bank (including its division Happy State Bank) | Texas OAG | my100bank.com |
| LeTourneau University | Texas OAG | letourneauuniversity.com |
| Elevation Hospice of Utah, LLC | Texas OAG | elevationhospiceutah.com |
| Three Oaks Hospice of Austin | Texas OAG | threeoakshospice.com |
| Alliance Environmental Group, LLC | California AG | allianceenvironmentalgroup.com |
| Leggett & Platt, Incorporated Employee Benefits Plan | California AG | leggett.com |
| Tarter Krinsky & Drogin LLP | California AG | tarterkrinsky.com |
| Chess.com (2026) | Have I Been Pwned | chess.com |
Independent Cybersecurity Audits
EmailMeNow domain audits on September 20, 2026 scored 10 filer domains in this batch.
9 of 10 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Chess.com (2026) (chess.com) leads at 78% overall; Elevation Hospice of Utah, LLC (elevationhospiceutah.com) scores 24%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| TEXAS REGIONAL ASTHMA, ALLERGY & IMMUNOLOGY CENTER | regional.com | 47% | 50% | 15% | 37% | Below Average |
| 7 to 7 Dental & Orthodontics | dentalorthodontics.com | 43% | 50% | 15% | 37% | Below Average |
| Three Oaks Hospice of Dallas | threeoakshospice.com | 37% | 25% | 15% | 37% | Weak |
| Centennial Bank (including its division Happy State Bank) | my100bank.com | 63% | 90% | 15% | 37% | Above Average |
| LeTourneau University | letourneauuniversity.com | 43% | 50% | 15% | 37% | Below Average |
| Elevation Hospice of Utah, LLC | elevationhospiceutah.com | 24% | 0% | 15% | 40% | Weakest |
| Alliance Environmental Group, LLC | allianceenvironmentalgroup.com | 27% | 0% | 15% | 37% | Weakest |
| Leggett & Platt, Incorporated Employee Benefits Plan | leggett.com | 63% | 65% | 15% | 70% | Above Average |
| Tarter Krinsky & Drogin LLP | tarterkrinsky.com | 53% | 35% | 50% | 70% | Average |
| Chess.com (2026) | chess.com | 78% | 90% | 15% | 87% | Good |
Audit links: regional.com · dentalorthodontics.com · threeoakshospice.com · my100bank.com · letourneauuniversity.com · elevationhospiceutah.com · allianceenvironmentalgroup.com · leggett.com · tarterkrinsky.com · chess.com
Website stack note
- Alliance Environmental Group, LLC (
allianceenvironmentalgroup.com): WordPress behind current (running 3.7.1; latest 7.1.2); WordPress: WordPress core older than 6.4 has multiple known security fixes in later releases; upgrade promptly. - Centennial Bank (including its division Happy State Bank) (
my100bank.com): WordPress behind current (running 5.9.10; latest 7.1.2); WordPress: WordPress core older than 6.4 has multiple known security fixes in later releases; upgrade promptly. - TEXAS REGIONAL ASTHMA, ALLERGY & IMMUNOLOGY CENTER (
regional.com): TLS certificate expires in 14 day(s)
Related trackers
- Texas OAG YTD dashboard
- Government & education tracker
- Monitoring guide
- All state AG trackers
- Washington healthcare breaches (2026)
- Washington law firm breaches (2026)
- CA September roundup
- TX September roundup
- WA September roundup
- TX Parks breach
- Have I Been Pwned
- HIBP September roundup
- Breach data week (September)
- HHS OCR September roundup
- SEC 8-K September roundup
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR