This is EmailMeNow’s multi-source breach data week snapshot for September 6, 2026, covering Texas OAG, California AG, Washington AG, Have I Been Pwned, HHS OCR, and SEC Form 8-K cyber filings. Figures come from our committed datasets after the weekly refresh — not a single regulator feed.
Current YTD snapshot
| Source | Metric | Value |
|---|---|---|
| Texas OAG | YTD reports | 443 |
| Texas OAG | Texans affected | 31,641,884 |
| HHS OCR | 2026 submissions | 320 |
| HHS OCR | Individuals (2026) | 61,171,138 |
| SEC Form 8-K | Item 1.05 families YTD | 19 |
| SEC Form 8-K | Item 1.05 raw filings YTD | 24 |
| SEC Form 8-K | Cyber-related 8-Ks tracked | 43 |
| California AG | YTD notices | 381 |
| Washington AG | YTD reports | 50 |
| Washington AG | Washingtonians affected | 570,121 |
| Have I Been Pwned | 2026 listings | 81 |
| Have I Been Pwned | Accounts (2026 listings) | 283,048,751 |
Week-over-week changes
Compared with the prior weekly alert baseline:
- Texas YTD reports +17 (426 → 443)
- Texas YTD affected +169,301 (31,472,583 → 31,641,884)
- HHS 2026 submissions +26 (294 → 320)
- HHS 2026 individuals +12,654,912 (48,516,226 → 61,171,138)
- SEC 8-K Item 1.05 families YTD +2 (17 → 19)
Source roundups this week
Source-specific detail pages for this week’s new listings. This digest is the multi-source hub (YTD totals + companies); open a roundup below for that source’s table and audits.
| Source | Roundup | Tracker |
|---|---|---|
| Texas OAG | September 4, 2026 | Open tracker |
| California AG | September 2, 2026 | Open tracker |
| Have I Been Pwned | September 2, 2026 | Open tracker |
| SEC Form 8-K | September 1, 2026 | Open tracker |
Companies added this week
Entities newly listed in source roundups through September 6, 2026 (13 shown; 13 with a researched domain). Domain audit scores for scored filers follow in Independent Cybersecurity Audits.
| Organization | Source | Domain |
|---|---|---|
| LHC Group, Inc | Texas OAG | lhcgroup.com |
| Bimbo Bakeries USA | Texas OAG | bimbobakeriesusa.com |
| Brown, Jake & McDaniel, P.C. | Texas OAG | brown.com |
| Virta Health Corp. and Virta Medical, PC | Texas OAG | virtamedical.com |
| Fiesta Insurance Franchise Corporation | California AG | fiesta.com |
| Fishbrain AB | California AG | fishbrain.com |
| HumanEdge, Inc. | California AG | humanedge.com |
| Knowledge Research Center | California AG | knowledgeresearchgroup.com |
| See’s Candies, Inc. | California AG | sees.com |
| YouLend US LLC | California AG | youlend.com |
| Manchester Airports Group | Have I Been Pwned | magairports.com |
| Park Dental Partners, Inc. | SEC Form 8-K | park56dental.com |
| NovoCure Ltd | SEC Form 8-K | oteis.fr |
Independent Cybersecurity Audits
EmailMeNow domain audits on September 6, 2026 scored 13 filer domains in this batch.
11 of 13 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
YouLend US LLC (youlend.com) leads at 78% overall; Fiesta Insurance Franchise Corporation (fiesta.com) scores 23%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| LHC Group, Inc | lhcgroup.com | 49% | 55% | 15% | 37% | Below Average |
| Bimbo Bakeries USA | bimbobakeriesusa.com | 43% | 0% | 15% | 90% | Below Average |
| Brown, Jake & McDaniel, P.C. | brown.com | 37% | 25% | 15% | 37% | Weak |
| Virta Health Corp. and Virta Medical, PC | virtamedical.com | 23% | 0% | 15% | 37% | Weakest |
| Fiesta Insurance Franchise Corporation | fiesta.com | 23% | 0% | 15% | 37% | Weakest |
| Fishbrain AB | fishbrain.com | 69% | 95% | 70% | 43% | Above Average |
| HumanEdge, Inc. | humanedge.com | 63% | 90% | 15% | 37% | Above Average |
| Knowledge Research Center | knowledgeresearchgroup.com | 37% | 25% | 15% | 37% | Weak |
| See’s Candies, Inc. | sees.com | 54% | 65% | 15% | 40% | Average |
| YouLend US LLC | youlend.com | 78% | 90% | 40% | 84% | Good |
| Manchester Airports Group | magairports.com | 63% | 90% | 15% | 37% | Above Average |
| Park Dental Partners, Inc. | park56dental.com | 64% | 90% | 15% | 40% | Above Average |
| NovoCure Ltd | oteis.fr | 47% | 50% | 15% | 37% | Below Average |
Audit links: lhcgroup.com · bimbobakeriesusa.com · brown.com · virtamedical.com · fiesta.com · fishbrain.com · humanedge.com · knowledgeresearchgroup.com · sees.com · youlend.com · magairports.com · park56dental.com · oteis.fr
Website stack note
- Bimbo Bakeries USA (
bimbobakeriesusa.com): Drupal behind current (running 11; latest 11.4.6) - Fiesta Insurance Franchise Corporation (
fiesta.com): Bootstrap: Bootstrap 3/4 are past primary vendor support; upgrade to Bootstrap 5 when practical (often theme-bundled). - Knowledge Research Center (
knowledgeresearchgroup.com): PHP outdated/unsupported (7.1.33 — no vendor security patches); WordPress behind current (running 4.2.38; latest 7.1); WordPress: WordPress core older than 6.4 has multiple known security fixes in later releases; upgrade promptly.; Contact Form 7: Contact Form 7 versions before 5.9 include fixed XSS and related issues. - NovoCure Ltd (
oteis.fr): WordPress behind current (running 6.7.7; latest 7.1) - Park Dental Partners, Inc. (
park56dental.com): Drupal major version behind (reports 10; current major is 11.4.6)
Related trackers
- Texas OAG YTD dashboard
- Government & education tracker
- Monitoring guide
- All state AG trackers
- Washington healthcare breaches (2026)
- Washington law firm breaches (2026)
- CA September roundup
- TX September roundup
- WA August roundup
- TX Parks breach
- Have I Been Pwned
- HIBP September roundup
- Breach data week (September)
- HHS OCR August roundup
- SEC 8-K September roundup
Sources: Texas OAG · California AG · Washington AG · Have I Been Pwned · HHS OCR · SEC EDGAR