California’s Attorney General added 4 new data breach notices to its public list on October 16, 2026, according to the California AG Data Breach List.
Unlike Texas and Washington, California’s public list does not publish a residents-affected count — so this roundup tracks incident visibility and reporting dates, not population impact. For affected-resident totals, see our Texas OAG breach tracker.
October month-to-date now totals 26 notices on the California list through October 16, 2026.
Notices Reported October 16, 2026
| Organization | Breach Date(s) (if known) | Reported |
|---|---|---|
| CDE | 05/22/2026 | 10/16/2026 |
| Inner City Education Foundation | 08/04/2024, 09/29/2024 | 10/16/2026 |
| John G. Yphantides, a Professional Law Corporation | n/a | 10/16/2026 |
| Neuro Wellness Spa | 08/24/2026 | 10/16/2026 |
Independent Cybersecurity Audits
EmailMeNow domain audits on October 16, 2026 scored 3 filer domains in this batch.
3 of 3 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Neuro Wellness Spa (neurowellnessspa.com) leads at 57% overall; Inner City Education Foundation (innercityeducation.org) scores 32%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Inner City Education Foundation | innercityeducation.org | 32% | 10% | 15% | 40% | Weak |
| John G. Yphantides, a Professional Law Corporation | john.com | 47% | 50% | 15% | 37% | Below Average |
| Neuro Wellness Spa | neurowellnessspa.com | 57% | 75% | 15% | 37% | Average |
Audit links: innercityeducation.org · john.com · neurowellnessspa.com
Related trackers
- All state AG trackers
- California AG breach list
- Texas OAG YTD dashboard
- Washington AG tracker
- Healthcare AG breach tracker
Source: California AG — Data Breach List