The data
What a BreachTally record contains, where it comes from and how it is normalized. Everything on this page applies to the site, the alerts, the CSV files and the API alike.
Try it before paying
The 500 most recent records, every field, no account needed. The same file format as the paid exports. The RSS feed at /feed.xml carries the 50 most recent records.
Coverage
| Portal | Jurisdiction | Records | Checked | Last checked |
|---|---|---|---|---|
| California AG | California | 5,415 | Every 30 minutes | 2026-11-09 11:30 UTC |
| Texas AG | Texas | 716 | Every 30 minutes | 2026-11-09 11:31 UTC |
| Massachusetts OCABR | Massachusetts | 1,949 | Every six hours | 2026-11-08 23:48 UTC |
| Washington AG | Washington | 55 | Every 30 minutes | 2026-11-09 11:31 UTC |
| Delaware DOJ | Delaware | 311 | Every 30 minutes | 2026-11-09 11:31 UTC |
| Vermont AG | Vermont | 574 | Every 30 minutes | 2026-11-09 11:31 UTC |
| Iowa AG | Iowa | 48 | Every 30 minutes | 2026-11-09 11:31 UTC |
| Wisconsin DATCP | Wisconsin | 21 | Every 30 minutes | 2026-11-09 11:31 UTC |
| Oregon DOJ | Oregon | 1,662 | Every six hours | 2026-11-09 06:54 UTC |
| HHS OCR | Federal | 767 | Every 30 minutes | 2026-11-09 11:31 UTC |
| SEC 8-K Item 1.05 | Federal | 1 | Every 30 minutes | 2026-11-09 11:31 UTC |
Records go back to each portal's earliest published year where the portal keeps an archive, and to the first day of indexing where it does not. New portals are added as their parsers are validated against the agency's own counts. Request one: support@breachtally.com.
Fields
| Field | Type | Meaning |
|---|---|---|
id | string | Stable record id, <source>:<source id>. Use it to deduplicate across pulls. |
source | enum | Portal the record came from: ca-ag, tx-ag, ma-ocabr, wa-ag, de-ag, vt-ag, ia-ag, wi-datcp, or-doj, hhs-ocr, sec-8k. |
source_label | string | Human name of the portal, as shown on the site. |
org_name | string | Organization name as filed, whitespace and encoding cleaned, otherwise verbatim. |
org_slug | string | Normalized organization key (lowercase, punctuation and corporate suffixes removed). The same organization filing in several states shares one slug in most cases. |
reported_date | date | The date the agency shows as the filing or posting date. ISO yyyy-mm-dd. Null when the portal gives none. |
breach_start / breach_end | date | Start and end of the breach window parsed from the filing. Equal when the filing gives one day. Null when the filing says unknown. |
breach_dates_raw | string | The date text exactly as the portal shows it, for when the parse is not enough. |
affected_count | integer | Number of people affected as stated to the agency. Null when the portal does not publish a count (California, SEC 8-K). |
affected_scope | enum | state_residents when the count covers residents of the filing state, total when it covers everyone (HHS, Oregon). |
total_affected | integer | Everyone affected by the incident, when the filing says so: the count itself for HHS and Oregon, and the total Texas publishes next to its own residents. Null otherwise. |
affected_state | string | Two-letter state of the filing. Null for federal sources (HHS, SEC). |
data_types | string[] | Categories of data exposed, normalized from the filing text into the fixed vocabulary below. Empty when the portal lists none. |
notice_url | url | The agency's copy of the consumer notice letter (PDF) or the SEC filing. Null when the agency publishes none. |
detail_url | url | The record on the agency's own site. |
summary | string | Short text from the filing: the information listed as compromised, the entity type, or the Item 1.05 excerpt. |
first_seen_at | datetime | UTC minute at which BreachTally indexed the record. This is the alert timestamp. |
updated_at | datetime | UTC time of the last change to the record after indexing (amended counts, added letter). Null if never changed. |
url | url | The record's page on this site. |
Data type vocabulary
Portals describe exposed data in free text. Each record is tagged with every category its text matches, so a filter means the same thing in every state.
| Token | Label |
|---|---|
ssn | Social Security number |
drivers_license | Driver's license / state ID |
passport | Passport number |
financial | Financial / bank account |
medical | Medical / health information |
health_insurance | Health insurance |
dob | Date of birth |
credentials | Usernames / passwords |
email | Email address |
biometric | Biometric data |
military_id | Military ID |
tax_id | Tax ID / EIN / ITIN |
phone | Phone number |
address | Postal address |
name | Name |
What is not changed
Organization names, dates, counts and letter links are reproduced as the agency published them. Normalization adds fields (slug, ISO dates, data type tags), it never edits the agency's values. When an agency amends a record, the record here is updated and updated_at is set. When you report an error we check it against the agency's record and correct it within one business day, noting the correction on the record page.
Timing
Portals are checked every 30 minutes. Paid alerts go out in the same cycle a record is first seen, so the delay between an agency posting and the alert is under 30 minutes plus the agency's own publication lag. first_seen_at is on every record so the timing is verifiable.