Washington sees all-time high in data breaches after 2 'mega breaches': Report

PORTLAND, Ore. (KOIN) – Data breaches in Washington have reached an all-time high, according to a report released Tuesday by the Washington Attorney General's Office.

The office started tracking data breaches nearly a decade ago, and so far in 2024, just over 11.4 million data breach notices have been sent to Washingtonians, surpassing the state's population for the first time.

The 11.4 million notices sent in 2024 also exceeds the previous all-time high in 2021 by five million notices, according to the report, which tracks data breach notifications from July 24, 2023, to July 23, 2024.

Additionally, the number of data breaches impacting at least 500 Washingtonians increased to 279 in 2024, which is the second-highest recorded since 2016 and more than the 178 reported in 2023.

“The more people know about data breaches, the more they can protect themselves,” Washington Attorney General and Governor-Elect Bob Ferguson said. “This report offers recommendations for responding to a growing problem and continues to be a resource for Washingtonians looking for ways to protect their personal information.”

According to the report, in the last year, cyberattacks – especially ransomware attacks – remained the most common type of breach, making up 78% of all reported breaches.

The increase in Washingtonians affected by data breaches in the last year is from two "mega breaches" at Comcast and Fred Hutchinson Cancer Center, the Attorney General’s Office said – noting this was the first time more than one mega breach, which affects more than one million Washingtonians, was reported in a single year.

To minimize risks from data breaches, the report offers several recommendations for lawmakers including, reducing the deadline to provide notice of a data breach to three days, requiring data breach notifications to be sent in languages other than English, and expanding the definition of “personal information” to include someone’s name in combination with a redacted Social Security number and an individual’s tax identification numbers.