State Data Breach Notices

Data-breach notices filed with US state attorneys general, normalised into one dataset.

States covered (v0.4)

State	Status	Source	affected means	Data types	Notice link
CA	current	official CSV export (one request)	not published (always null)	no	no
WA	current	AG table, paged newest-first	Washington residents	yes	PDF
VT	current	AGO category page: recent table (one request) + archive pages	Vermont residents (recent table); null for archive rows	yes (recent table)	archive rows only
OR	current, from 2015	DOJ table (one request)	the number reported to Oregon DOJ; the list does not say whether Oregon-only or total	no	no
MA	current, from 2024	OCABR yearly report PDFs, one per year	Massachusetts residents	five Yes/No categories	no
NH	current, from 2006	DOJ document list (the page's own JSON), newest first	not published (always null)	no	PDF
IA	current (years 2020, 2023 on)	AG yearly pages	not published (always null)	no	PDF
TX	current, rolling (~18 months)	OAG Salesforce page, headless browser	Texas residents	yes	no
MT	current but months behind (newest 2026-06-15 on 2026-10-24), from 2015	OCP table page, headless browser (Cloudflare)	Montana residents	no	letter PDF
DE	archive: newest report 2025-07-11	DOJ database page (one request)	Delaware residents (only breaches of 500+ DE residents are filed)	no	sample notice PDF
MD	archive: newest report 2025-03-21	OAG's public SharePoint lists, one JSON request per year (2022 on)	Maryland residents	free text, one string	notice PDF

DE and MD still serve their lists but stopped adding to them in 2025 (checked 2026-10-24). They return nothing for a recent daysBack; use daysBack: 0 or an older since for history. If either state resumes publishing, the new rows are picked up with no code change (MD reads a new year's list as soon as it exists).

TX and MT are the only states that start a browser (one headless Chromium per run, closed at the end). A run without them never loads Playwright.

Per-state notes

• CA: breachStart/breachEnd come from the free-text "Date(s) of Breach"; no counts, types or links.
• WA: affected is WA residents only; dataTypes split from the AG's semicolon list.
• VT: the recent table (from 2026-04-17) gives VT-resident counts and the AGO's data categories (comma list, e.g. "Social Security Numbers"), but no notice link and no breach dates. Older notices come from the archive, where each notice is a document titled "YYYY-MM-DD Organisation - Data Breach Notice to Consumers": reportedDate is that title date, organization is parsed from the title (older slug-style titles lose any hyphens in the name), noticeUrl is the document page, and affected/dataTypes are null. The archive is only fetched when since reaches back before the table's first date.
• OR: has breach, discovery and notice-sent dates. affected is the "Number Affected" column, scope unstated. A breach-date cell of 1/1/2001 is Oregon's placeholder for unknown: the dates are null, breachDatesRaw keeps it.
• MA: read from the yearly PDF (the office prints its spreadsheet), so text is placed by position. affected is MA residents. dataTypes lists the categories marked "Yes" out of five (Social Security numbers, medical records, financial account numbers, driver's license numbers, credit/debit card numbers); all "No" gives null (something else was exposed, not nothing). Voided rows ("-") and rows marked "DUPLICATE OF …" are dropped. 2023 and earlier PDFs use different layouts and are not read. The same organisation filing twice on the same day collapses to one notice (shared id); this is common in MA (about 2-5% of a year's rows, e.g. repeated card-issuer filings), so counts for those are the first row's. A few dates are the office's own typos (one 2024 row reads 09-Feb-14) and are kept.
• NH: reportedDate is the date DOJ posted the notice; a handful of old items have no posting date (null). The organisation is the document title (supplements are separate items). No counts or breach dates.
• IA: a notice card can list related entities that reported the same breach; each is returned as its own notice. Year pages the AG links for 2011-2019, 2021 and 2022 answer 404 and are skipped. A date the AG mistyped (4-23-025) is null.
• TX: reportedDate is the date published on the OAG site. affected is Texas residents as listed; the state shows 0 for a few notices, which is kept. Breach start/end and discovery dates come from the report. dataTypes split from the OAG's semicolon list. Texas removes reports from the list after about 18 months.
• MT: "Date Reported" is sometimes prose for supplemented notices ("First reported 06/02/2023 … additional residents on 07/10/2023"); reportedDate is the first date. affected is Montanans; "Unknown" and blanks are null.
• DE: a few rows have a non-date in "Reported Date" (e.g. "Awaiting supplemental response from counsel"); their reportedDate is null and they appear only when no date filter is set. "Addendum"/"Supplemental" labels are dropped from the organisation name. Two-digit years (10/08/21) are read as 20xx.
• MD: dataTypes is the state's free-text sentence as a single string, not split. One 2023 row reports 0 Maryland residents; that is the state's figure and is kept. The same organisation filing twice on the same day collapses to one notice (shared id).

Not covered, and why (checked 2026-10-24)

• Maine: the AG has taken the public breach database offline ("The public-facing database will remain offline") after abuse of the reporting system; still offline on 2026-10-24.
• Indiana: PDF year-to-date reports only.
• Hawaii: clean table, but it holds only 2023-11 to 2024-04 notices.
• Wisconsin: a short prose list (about 20 entries since 2024) with no date reported to the state.
• North Dakota: no public list found on attorneygeneral.nd.gov.

Fields

id (stable hash of state + organisation + reported date), state, organization, reportedDate, breachStart, breachEnd, breachDatesRaw, discoveredDate, noticeSentDate, affected, affectedScope, dataTypes, noticeUrl, sourceUrl. Unknown is null, never 0 (a 0 appears only where the state itself printed 0). affected is in the state's own scope (affectedScope says which).

Input

states (default all supported), daysBack (default 30; 0 = all), since (YYYY-MM-DD, overrides), search, maxItems.

Pricing

Pay per event: notice, $0.002 per notice returned.

Politeness and access

CA: one CSV request per run (its robots.txt asks for a 10 s crawl delay). WA: 2 s between pages, stops at the first page older than since. VT: one request unless since predates the recent table, then 2 s between archive pages, stopping at the first page older than since. OR: one request. MA: one PDF (about 1.4 MB) per year from the current year back to since's year (2024 at most), 2 s apart. NH: 100 notices per request, 2 s apart, stopping at the first page older than since (the whole record is about 100 requests). IA: one page per year back to since's year, 5 s apart (its robots.txt Crawl-delay). TX and MT: one page load each in a headless browser. DE: one request. MD: one JSON request per year from the current year back to since's year (at least one list must answer), 1 s apart. The actor is meant to run at most daily.

These are public government records with no login. Oregon's robots.txt is Disallow: /; per the owner's access rule (2026-10-24) that alone is not a reason to skip a public record. MT's page sits behind a Cloudflare JavaScript check, which the headless browser passes by itself; nothing solves CAPTCHAs, no accounts are used, and TX's data is the response the page itself receives (no token is copied or replayed). A bot check that does not clear on its own fails that state with a message saying so. The plain-HTTP user agent avoids the word "collector", which Iowa's firewall blocks. A state whose page layout changes fails loudly in the run log; it never returns a silent empty list.

Run locally

npm install, npx playwright install chromium (for TX and MT), put input in storage/key_value_stores/default/INPUT.json, npm start. npm test runs a live check against every registered state (60 days for current states, 180 for IA, 365 for MT, the whole record for DE and MD). The Docker image is apify/actor-node-playwright-chrome:22-1.64.1; keep playwright in package.json at the same version.

Next states

Add one file in src/sources/ exporting collect({since}) and parse(), register it in src/collect.js, and check the site's terms first. Use src/browser.js (withPage, gotoPastChallenge) only when plain HTTP cannot get the data.