Teollimi

Teollimi data report

Companies took a median of 100 days to report a data breach

191 notices filed Nov 6, 2025 – Nov 6, 2026 · updated Oct 13, 2026

Key findings

  • Organizations took a median of 100 days (average 149) from becoming aware of a breach to notifying the Washington Attorney General.
  • 88% took longer than 30 days, 70% longer than 60 days and 26% longer than 180 days.
  • The notices covered 3.1 million Washington residents.

Why it matters

Until a notice arrives, people cannot freeze their credit, change passwords or watch for fraud with a reason to. Washington law sets a 30-day limit for notifying affected residents and, for breaches affecting more than 500 residents, the Attorney General (RCW 19.255.010). The figure here is the time to the Attorney General notice; the law allows delays requested by law enforcement, and the days are counted from the date the organization reports it became aware of the breach.

By industry

IndustryNoticesMedian days
Business85101
Health5188
Finance3392
Education14145
Government472
Non-Profit/Charity4168

Largest breaches and how long they took

OrganizationWA residentsDays
DriveWealth, LLCOct 13, 2026358,10439
Navia Benefit Solutions, Inc.Mar 18, 2026319,20854
Marquis Software SolutionsNov 26, 2025269,773104
Prosper Marketplace, IncDec 9, 2025249,84899
iRhythm Technologies Inc.Oct 6, 2026220,745120
DentaQuest, LLCJul 16, 2026153,30057
Bolt Solutions Inc. (“bolt”)Feb 26, 2026140,24959
700Credit, LLCDec 12, 2025121,82848
TriZetto Provider SolutionsFeb 6, 202676,562127
University of Phoenix, Inc.Dec 21, 202564,79630
Medtronic Inc.Jun 29, 202664,03575
Healthcare Interactive, Inc.Jan 7, 202661,225169
Carnival CorporationMay 27, 202654,96043
Caesars Entertainment, Inc.May 19, 202644,02385
SoFi Technologies, Inc.Jan 26, 202638,04924
Aesto, LLCAug 4, 202637,253229
Mt. Spokane PediatricsApr 30, 202629,410119
Paylogix, LLCAug 14, 202628,449269
Baylor GeneticsAug 14, 202627,24360
Xsolis, Inc.Jun 19, 202626,203148

Methodology

Source: the Washington State Attorney General’s Data Breach Notifications open dataset, updated daily. “Days” is the dataset’s field for days elapsed before the notice was submitted, which equals the submission date minus the date the organization says it became aware of the breach. We include notices submitted in the last 12 months with both dates. Washington publishes notices for breaches affecting 500 or more residents. Anyone can reproduce these figures from the public data; we update this page every day.

XRedditWhatsApp

Check whether the services you use were breached →