Texas Breach Reports: 99 in October 2026, What Houston Should Know

The 99 reports the Texas Attorney General listed with an October date, and what they look like.

The Texas Attorney General listed 99 data breach reports dated October 1 through October 30, 2026. The previous high on the listing was 77 in September 2026, and the 11 full months from November 2025 through September 2026 averaged 53.7 reports a month.

The October reports look like the rest of the list. Their median is 1,771 Texans. Of the 99, 32 cover fewer than 1,000 people, 75 list Social Security numbers, and 65 came from filers outside Texas. Houston-area addresses appear on 11 of them. In 13 of them, consumers had not yet been notified when the report went up.

A month is counted by the date the Attorney General listed the report, which is the only date the listing shows. Section 521.053(j) gives the office 30 days to post each new notice, so a busy listing month can be a busy filing month in Austin as much as a busy breach month in Texas. One high month is not a trend. The listing only holds about a year, which is the reason CinchOps keeps a dated copy every month.

Row-by-row comparison of the two saved copies of the listing.

Between October 3, 2026 and October 31, 2026, 82 reports were added to the Texas listing and 40 were removed or revised, taking the count from 652 to 694. Of the 40 removed rows, 31 were dated October 2025, which is the first-anniversary removal that Section 521.053(j) requires.

The total number of Texans counted fell while the number of reports rose. On October 3, 2026 the 652 reports added up to 52,366,726 Texans. On October 31, 2026 the 694 reports add up to 44,264,036. The difference is one report covering 11,331,028 Texans that aged off the list. The 82 reports added in the month covered 3,537,866 Texans between them, and the largest of them covered 970,891.

The headline measures barely moved. The median report went from 1,668 to 1,669 Texans. The share under 1,000 Texans went from 39.3% to 38.2%. Social Security numbers went from 82.5% to 82.4% of reports. Out-of-state filers went from 58.4% to 59.2%. Houston-area filers stayed at 81, because 7 arrived and the same number left.

The 82 new reports had a median of 1,643 Texans. Of those, 29 covered fewer than 1,000, 18 covered 10,000 or more, 63 listed Social Security numbers, and 26 came from a Texas address. The listing states that details may change after a report is posted, so a row whose figures were corrected counts here as one removal and one addition.

The median is the durable number on this list and the total is the fragile one. Any month in which a multi-million-record report reaches its anniversary will cut the total by millions while the typical Texas breach stays exactly where it was.

A walk through the six sections of the index page and the three rules behind it.

The Texas Breach Notice Index at cinchops.com/texas-breach-notice-index is a standing page, refreshed monthly, that turns the Attorney General's listing into the totals the listing itself does not publish: reports per month, breach size, the data types exposed, notice status and methods, and where the filers are.

The page opens with the listing at a glance: 6 headline cards, a chart of reports listed each month, and a chart of breach size in 3 bands. Key Findings follows with 6 figures and one sentence of context each. The exposed-data section shows the share of reports listing each data type and each notice method.

Where the Filers Are carries the Texas, out-of-state and Houston-area shares, the states that file the most Texas reports, and a map of the United States shaded by filings. The Houston section matches 3 figures from the listing to the CinchOps service that answers each, next to the free security score form. The page closes with 8 FAQ answers and a methodology block that lists sources, snapshot checks, known limits and a dated revisions line.

Three rules govern the page. Aggregates only, so no organization is named or ranked. Every figure, chart and sentence is generated by script from the saved snapshot, so a refresh updates all of them together. Each edition is dated, and any correction to a published figure is named in the revisions line with its prior value. The October 2026 edition is the first entry on that line after the launch.

Houston-area filers, out-of-state filers, and the vendor question both point to.

Houston-area filers, meaning a Texas ZIP code starting 770 through 775, account for 81 of the 694 reports on the October 31, 2026 listing, 28.6% of all Texas-based filers. Their median report covers 1,957 Texans, 29 of the 81 cover fewer than 1,000, and 85.2% list Social Security numbers.

A 770 ZIP code, which covers the city of Houston itself, appears on 47 of the 81. Another 18 cover 10,000 Texans or more, and in 9 of the 81 consumers had not been notified when the report was listed. A Houston law firm, CPA practice or construction company that pictures its own exposure should look at the 1,957 figure, which is the size of a client list or a few years of payroll files.

Most filers are not in Texas at all. Out-of-state filers account for 411 reports (59.2%), from organizations in 44 other states and the District of Columbia, led by California with 53, New York with 33 and Florida with 29. The Texas rule follows the residents, so the payroll processor, benefits administrator or software vendor that holds a Katy company's employee records reports to Austin when it loses them.

For a business in Katy, Sugar Land or The Woodlands, that makes the vendor list part of breach prevention. The question to ask each vendor is plain: which of our records do you hold, where do they sit, and who else has a copy. Most of the Texas list is someone else's vendor.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Through cybersecurity services, CinchOps runs 24/7 threat monitoring on the accounts and devices that hold Social Security numbers, medical records and financial data.
• With managed IT support, help desk requests are answered in under 15 minutes, so a suspicious email gets a real answer before someone clicks it.
• In a breach response engagement, CinchOps works the technical side of an incident while the owner, the attorney and the insurer handle the notices.
• Through business continuity and disaster recovery, backup copies are immutable and stored offsite, which keeps a ransomware incident from also becoming a data-loss incident.
• CinchOps serves Houston, Katy, Sugar Land and The Woodlands, with industry programs for law firms, CPA firms and construction companies.

The October 2026 listing added 82 reports and the typical one still covers fewer than 2,000 Texans, the size of the records an ordinary Houston employer keeps. CinchOps prices the work that keeps a business off that list at a flat $100 to $250 per user per month, on Zero-Zero-Zero terms: no long-term contracts, no hidden fees and no cancellation penalties. An owner who wants to know where the company's Social Security numbers and client records actually sit, and which vendors hold a copy, can talk to CinchOps.