Olympia, Washington — The state’s Attorney General released its annual data‑breach report on Monday, revealing that 197 separate incidents affected Washington businesses, government agencies and other institutions between July 2025 and July 2026.

Key findings

According to the report, cyberattacks were responsible for 139 of the breaches, and ransomware was employed in 86 of those attacks. Social security numbers were exposed in 148 incidents, underscoring the sensitivity of the compromised information.

The Attorney General’s office sent more than 3.5 million breach notifications to Washington residents this year, fulfilling the state’s requirement that private and public entities alert individuals whose personal data may have been accessed by an unauthorized party.

Calls for legislative action

Attorney General Nick Brown said the data‑security landscape is evolving and that Washington’s laws must keep pace. “Every day, Washingtonians entrust their personal information to private companies and public institutions. Their data should be secured and not shared without their consent,” Brown said. “As threats to data security evolve, Washington’s approach to protecting this data must evolve as well.”

The report recommends several updates to the state’s data‑breach notification statutes, which were last revised in 2019. Among the proposals are:

• Creating a statewide data‑broker registry to increase transparency about entities that collect, share or sell personal information.
• Imposing stricter limits on the collection, sharing and sale of sensitive personal data, including social security numbers.
• Enhancing notification timelines and expanding the definition of “personal information” to cover emerging data types.

Lawmakers are urged to consider these recommendations as part of upcoming legislative sessions, with the goal of giving Washington residents stronger protections against identity theft and fraud.

What residents can do

Washingtonians who receive breach notices are encouraged to monitor their credit reports, place fraud alerts where appropriate, and take advantage of free identity‑theft protection services offered by many affected organizations. The Attorney General’s office maintains a Data Breach Resource Center where consumers can find guidance on protecting their information and reporting suspicious activity.

For more details on the 197 breaches, the full annual report, and resources for businesses and individuals, visit the Washington Attorney General’s Data Breach Resource Center.

Original reporting: KHQ Spokane (news) — read the source article.