Data breaches reported to Washington’s Attorney General during the latest reporting year generated more than 3.5 million notices to residents, according to a report released Monday, Nov. 9.
The 2026 Data Breach Report covers 197 incidents reported to the office between July 24, 2025, and July 23, 2026. The total counts notices sent to residents, rather than confirmed cases of identity theft.
Both the number of reported incidents and the notice total fell from the previous reporting year. Sensitive information was still exposed: Social Security numbers were compromised in 148 breaches, just over three-quarters of the incidents reported. Full dates of birth were exposed in 156.
Cyberattacks accounted for 139 incidents, and ransomware was the most common method of cyberattack. The report tracks breaches reported to the state, not every possible breach affecting a Washington resident.
If a breach notice arrives
The Attorney General’s Office recommends checking financial accounts, billing statements and credit reports for unfamiliar activity. Its Data Breach Resource Center also links to a directory of notices submitted to the office, which can help readers find the notice associated with an organization.
Two free tools can help protect against someone opening new credit in your name, according to the Federal Trade Commission:
- A credit freeze: Contact Equifax, Experian and TransUnion separately to freeze your reports. Placing or lifting a freeze is free. It stays in place until you lift it, and you may need to lift it temporarily when applying for credit.
- An initial fraud alert: If you suspect identity theft, contact one of the three bureaus. It must notify the other two. The free alert lasts one year and can be renewed; it tells businesses to verify your identity before opening new credit.
If you believe someone has used your identity, the FTC’s IdentityTheft.gov provides reporting and recovery tools. The state’s consumer resources page explains additional steps.
What the attorney general wants changed
The report recommends expanding the personal information covered by breach-notification laws, including Tribal identification and enrollment numbers, Individual Taxpayer Identification Numbers, IRS Identity Protection PINs and precise location data. It also calls for reasonable data-security safeguards and notification when an organization’s AI agent gains unauthorized access to personal information or a state agency.
These are recommendations for lawmakers, not new requirements enacted by the report.
Sources: Washington Attorney General’s Nov. 9 announcement; 2026 Data Breach Report, printed pages 2–8; Attorney General consumer resources; Federal Trade Commission.
