Texas Breach Notice Index
What 652 data breach reports to the Texas Attorney General show about breach size,
exposed data and Houston-area filers.
October 3, 2026 snapshot. Refreshed monthly. Research by Shane Stevens, CEO of CinchOps.
The Listing at a Glance
The finding: the typical data breach reported in Texas is small. The median report on the Texas Attorney General's listing covers 1,668 Texans, 39.3% cover fewer than 1,000, and 82.5% involve Social Security numbers. A handful of very large filings produce the headlines: the 2 largest reports account for 46.1% of the 52,366,726 Texans counted.
Key Findings
What Texas Breach Reports Expose, and How People Were Told
Each report lists the types of information affected, and a report can list more than one. The median report lists 5 types, so a single incident usually exposes a full identity record. 43.3% of reports list a Social Security number and financial information together.
Where the Filers Are
The Texas rule follows the residents, so most reports come from organizations outside the state. 381 reports (58.4%) were filed from 44 other states and the District of Columbia. 81 came from filers with a Houston-area address, 49 of them in a 770 ZIP code, and 86.4% of those Houston-area reports list Social Security numbers.
What This Means for a Houston Business
The listing is mostly ordinary organizations holding ordinary records: payroll files, client lists and patient rosters. A Houston law firm, CPA practice or construction company that pictures its own exposure should look at the 1,668 figure, not the multi-million headlines. CinchOps prices the work that keeps a business off the list at a flat $100 to $250 per user per month, with no long-term contracts, no hidden fees and no cancellation penalties.
| What the listing shows | Figure | The CinchOps answer |
|---|---|---|
| Reports listing Social Security numbers | 82.5% | 24/7 threat monitoring on the accounts and devices that hold that data |
| Reports covering fewer than 1,000 Texans | 39.3% | Managed IT for businesses with 10 to 200 employees, with under-15-minute help desk response |
| Reports listed before consumers were notified | 29 reports | Breach response: containment and the evidence an attorney and an insurer will ask for |
Know Your Business Security Score
Get a free security assessment for your Houston area business. See what an attacker sees across your network, applications, and DNS.
Companion Guides to This Index
Frequently Asked Questions
What is the Texas Breach Notice Index?
The Texas Breach Notice Index is a CinchOps count of every data breach report the Texas Attorney General lists publicly. The October 2026 edition covers 652 reports and shows how large the breaches were, what personal information was exposed, whether consumers were notified, and how many filers are in the Houston area.
Who has to report a data breach to the Texas Attorney General?
Texas Business and Commerce Code Section 521.053(i) requires anyone who must notify individuals of a breach to also notify the Texas Attorney General when the breach involves at least 250 Texas residents. The notice is due as soon as practicable and no later than 30 days after the breach is determined.
How many data breaches were reported in Texas in the past year?
The Texas Attorney General listed 652 data breach reports on October 3, 2026, dated April 1, 2025 to October 2, 2026. Across the 11 full calendar months in the listing, that averages 54.5 reports a month, from a low of 29 in January 2026 to a high of 81 in September 2026.
How large is a typical data breach reported in Texas?
The median report on the October 3, 2026 listing covers 1,668 Texans. 39.3% of reports cover fewer than 1,000 Texans, 40.5% cover 1,000 to 9,999, and 20.2% cover 10,000 or more. The average is far higher because 8 reports cover 1,000,000 or more.
What information is exposed most often in Texas data breaches?
Social Security numbers appear in 82.5% of the 652 Texas breach reports listed on October 3, 2026. Medical information appears in 52.9%, driver's license numbers in 51.8%, and financial account or card information in 46.8%. The median report lists 5 types of information.
How many Houston-area organizations reported a data breach to the Texas Attorney General?
81 of the 652 reports listed on October 3, 2026 came from filers with a Houston-area address, defined as a Texas ZIP code starting with 770 through 775. That is 29.9% of all Texas-based filers. The median Houston-area report covered 2,123 Texans.
How often is the index updated?
Monthly. The Attorney General's site keeps no history and removes reports after about a year, so CinchOps saves a dated copy of the full listing each month and regenerates every chart, figure and statement on this page from it. The current edition uses the October 3, 2026 snapshot.
What does cybersecurity to prevent a data breach cost in Houston?
CinchOps prices managed IT and cybersecurity for Houston-area businesses at a flat $100 to $250 per user per month, with 24/7 threat monitoring. The CinchOps model is Zero-Zero-Zero: no long-term contracts, no hidden fees and no cancellation penalties. A 25-person office would pay between $2,500 and $6,250 a month.
- Purpose and intent
- To count what the Texas Attorney General's public breach listing actually shows, since the listing itself has no totals, no export and no history, and to publish it as a reference a Houston business can measure its own exposure against.
- Coverage
- All 652 reports on the listing on October 3, 2026, with published dates from April 1, 2025 to October 2, 2026. 3 reports dated before October 2025 remain on the listing and are included in every figure except the monthly average.
- Sources
- The Texas Attorney General Data Security Breach Reports listing, read in full on October 3, 2026. Each report shows 10 fields: name, address, city, state, ZIP code, types of information affected, number of Texans affected, whether notice was provided to consumers, the methods of notice, and the date published. No surveys and no filer participation.
- Who is on the list
- Texas Business and Commerce Code Section 521.053(i) requires notice to the Attorney General when a breach involves at least 250 Texas residents, no later than 30 days after the breach is determined. Section 521.053(j) requires the Attorney General to post the listing, update it within 30 days of each new notice, and remove a report by its first anniversary if the filer has reported no further breach.
- Snapshot checks
- The saved copy holds 652 reports, equal to the count the listing displayed, with 0 duplicate rows. The number of Texans affected is a whole number on every row.
- Breach size
- Size is the number of Texans affected as shown on each report. The index reports the median and 3 size bands because the average, 80,317, is dominated by a few very large reports. The total, 52,366,726, counts notices: one person can appear in several reports.
- Information types
- Each type is counted once per report. A report can list several types, so the shares add to more than 100%.
- Filer location
- Texas and out-of-state shares use the state on each report. Houston area means a Texas address with a ZIP code starting 770, 771, 772, 773, 774 or 775. The address is the filer's, which says nothing about where the affected Texans live.
- Monthly average
- The average of 54.5 reports a month uses the 11 full calendar months from November 2025 through September 2026. The first and last months in the listing window are partial.
- Known limitations
- The index covers only breaches reported to the Texas Attorney General, and a breach affecting fewer than 250 Texans is not required to be reported there, so the true number of Texas breaches is higher. 20 listed reports show fewer than 250 Texans, including 2 that show 0, and the index counts them as listed. The listing states that details may change after a report is listed. It has no field for industry, company size or cause, so the index cannot say which sectors or attack types drive the reports. No listed organization is named or ranked on this page.
- Revisions
- 2026-10-03: first edition, 652 reports. Any correction to a published figure will be named here with its prior value.
- Refresh
- Monthly. Every figure, chart and statement on this page is generated from the saved snapshot by script, so each refresh updates all of them together. Because reports are removed after about a year, each edition is a rolling 12-month window.
CinchOps - Houston Managed IT
I run CinchOps, a managed IT provider in Katy. The Texas Attorney General publishes every breach report it receives, but as a list with no totals. We counted it because the pattern matters to the owners we work with: most reports are small, and most involve data that every employer holds.
CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees. See IT support in Houston, or talk to CinchOps.
- Shane Stevens, CEO and Founder, CinchOps - LinkedIn
"The reports that should get an owner's attention are the ones with 800 or 1,500 people on them. Nobody writes a headline about those, and that is the size of a client list or a payroll file at the companies I sit down with every week."