The Texas Office of the Attorney General published 9 new data security breach reports on October 6, 2026, according to a fresh scrape of the Texas OAG Data Security Breach Reports portal. Combined, these reports cover 311,033 Texans.
The largest filing — iRhythm Technologies Inc. — accounts for 298,647 affected Texans in this batch. See the live Texas OAG YTD dashboard for monthly charts.
October month-to-date now totals 27 published reports affecting 5,971,912 Texans through October 6, 2026.
Sector breakdown
- Law firms / legal: 2 reports, 2,705 Texans — led by Sheppard, Mullin, Richter & Hampton LLP
- Government / education: 2 reports, 6,187 Texans — led by Cleburne Independent School District
- Healthcare / medical: 4 reports, 301,475 Texans — led by iRhythm Technologies Inc.
- Other sectors: 1 report, 666 Texans
Reports Published October 6, 2026
| Entity | Texans Affected | Consumer Notice | Date Published |
|---|---|---|---|
| iRhythm Technologies Inc. | 298,647 | Yes | 10/06/2026 |
| Cleburne Independent School District | 3,187 | No | 10/06/2026 |
| Edgewood ISD | 3,000 | No | 10/06/2026 |
| Sheppard, Mullin, Richter & Hampton LLP | 2,326 | Yes | 10/06/2026 |
| Flowco Holdings Inc. | 1,771 | Yes | 10/06/2026 |
| Harman Fitness | 1,057 | Yes | 10/06/2026 |
| Capitol Pain Institute | 666 | No | 10/06/2026 |
| Fragomen, Del Rey, Bernsen & Loewy, LLP | 379 | Yes | 10/06/2026 |
| Healthcare Highways, LLC | 0 | Yes | 10/06/2026 |
The OAG notes that report details — including the number of affected Texans and whether consumer notice was provided — may change after a report is first listed.
Independent Cybersecurity Audits
EmailMeNow domain audits on October 6, 2026 scored 9 filer domains in this batch.
8 of 9 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Healthcare Highways, LLC (gehealthcare.com) leads at 72% overall; Fragomen, Del Rey, Bernsen & Loewy, LLP (fragomendelreybernsenloewy.com) scores 23%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| iRhythm Technologies Inc. | irhythmtech.com | 45% | 45% | 15% | 37% | Below Average |
| Cleburne Independent School District | sd42.ca | 63% | 90% | 15% | 39% | Above Average |
| Edgewood ISD | edgewood-isd.net | 41% | 10% | 15% | 70% | Below Average |
| Sheppard, Mullin, Richter & Hampton LLP | standpointe.com | 38% | 25% | 45% | 37% | Weak |
| Flowco Holdings Inc. | flowco.com | 42% | 35% | 15% | 40% | Below Average |
| Harman Fitness | harmanfitness.com | 48% | 50% | 15% | 40% | Below Average |
| Capitol Pain Institute | capitolpain.com | 31% | 10% | 15% | 37% | Weak |
| Fragomen, Del Rey, Bernsen & Loewy, LLP | fragomendelreybernsenloewy.com | 23% | 0% | 15% | 37% | Weakest |
| Healthcare Highways, LLC | gehealthcare.com | 72% | 75% | 15% | 87% | Good |
Audit links: irhythmtech.com · sd42.ca · edgewood-isd.net · standpointe.com · flowco.com · harmanfitness.com · capitolpain.com · fragomendelreybernsenloewy.com · gehealthcare.com
Related trackers
- All state AG trackers
- Texas OAG YTD dashboard
- California AG breach list
- Washington AG tracker
- Healthcare AG breach tracker