AG’s annual Data Breach Report recommends stronger protections for Washingtonians’ personal information

The Attorney General's Office released its annual Data Breach Report today following a year in which businesses, government agencies, and other institutions reported 197 data breaches to the state and sent more than 3.5 million notices to Washington residents.

The report analyzes these results and also recommends updates to the state's data breach notification laws to strengthen data security and further ensure Washingtonians are notified when their personal information is compromised.

"Every day, Washingtonians entrust their personal information to private companies and public institutions. Their data should be secured and not shared without their consent," said Attorney General Nick Brown. "As threats to data security evolve, Washington's approach to protecting this data must evolve as well."

A data breach is an unauthorized access of data that compromises security, confidentiality or integrity of personal information maintained by an individual, business or agency. Corporations collect and sell massive amounts of sensitive personal data. The more this data is shared and collected, the more vulnerable consumers are to data breaches and cybercrime.

Washington law requires private and public entities to notify any Washington resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. If the breach affects more than 500 Washington residents, it must be reported to the Attorney General's Office.

The report covers breach notices the Attorney General's Office received between July 24, 2025, and July 23, 2026. While both the number of reported breaches and the number of notices declined from the previous reporting year, the findings show that sensitive personal information remains at risk.

Key findings include:

• Cyberattacks were the leading cause of data breaches, accounting for 139 incidents. Ransomware remained the most common method of cyberattack, responsible for 86 incidents.
• Social Security numbers were exposed in 148 breaches -over 75% of all reported breaches.
• During the year, no mega breaches affecting 1 million or more Washington residents were reported.

Washington's data breach notification laws were last updated in 2019. The report recommends that lawmakers:

• Expand the definition of personal information to include additional identifiers, such as Individual Taxpayer Identification Numbers, Tribal identification and enrollment numbers, IRS Identity Protection PINs, precise geolocation data and the last four digits of Social Security numbers when combined with a person's name.
• Require entities that own or license Washingtonians' personal information to maintain reasonable security procedures and practices appropriate to the information they hold.
• Require notification when an AI agent operated by an entity gains unauthorized access to a Washington resident's personal information or a state agency.

The recommendations also reflect the findings of the AG's recent 2026 Data Privacy Report, which identified broader steps to strengthen protections for data that businesses and institutions collect, retain and share. That report also encourages lawmakers to consider a data broker registry and additional limits on the collection, sharing and sale of sensitive personal information.

For more information about breaches, past reports, and resources for consumers and businesses, visit the AGO's Data Breach Resource Center.

Read the report.

-30-

Washington's Attorney General serves the people and the state of Washington. As the state's largest law firm, the Attorney General's Office provides legal representation to every state agency, board, and commission in Washington. Additionally, the Office serves the people directly by enforcing consumer protection, civil rights, and environmental protection laws. The Office also prosecutes elder abuse, Medicaid fraud, and handles sexually violent predator cases in 38 of Washington's 39 counties.

Visit www.atg.wa.gov to learn more.

Media Contact:

Email: [email protected]

Phone: (360) 753-2727

General contacts: Click here

Media Resource Guide & Attorney General's Office FAQ