Identity Attack Ledger · Washington
Washington breach letters are as quiet as California's about how the attacker got in.
Of the Washington breach letters with a readable narrative filed between January 1, 2026 and September 30, 2026, 7.9% state the attack vector. In California over the same window, 6.4%. Washington's 2026 rate is slightly higher — 1.2× California's — but inside the band this ledger treats as the same.
7.9%
of 2026 filings name a vector
January 1 – September 30, 2026
81%
name a credential or a deceived person
of the 27 incidents that name any vector
134
days, breach to notification
median across 859 filings
922
Washington filings
January 1, 2023 – September 30, 2026
Source: Washington Attorney General data breach notifications.
The finding
How often Washington letters name a vector
A notification letter is not required to say how the attacker got in. Each row is the letters filed in that calendar year whose narrative could be read, and how many named a vector. A year the corpus does not cover in full is labelled with its window and shown as its own row rather than annualized.
| Report year | Window | Letters read | Named a vector | Rate |
|---|---|---|---|---|
| 2023 | Full year | 225 | 4 | 1.8% |
| 2024 | Full year | 216 | 6 | 2.8% |
| 2025 | Full year | 187 | 6 | 3.2% |
| 2026 | Jan 1, 2026 – Sep 30, 2026 | 140 | 11 | 7.9% |
The named subset
What the named vectors are
Across the full Washington corpus, 27 distinct incidents name a vector. This is the distribution of the named subset, not of all breaches.
| Vector named in the letter | Distinct incidents | Share of named |
|---|---|---|
| Phished or stolen credentials | 12 | 44.4% |
| Social engineering of a person | 10 | 37% |
| Third-party or contractor access | 3 | 11.1% |
| Service-account or non-human identity abuse | 1 | 3.7% |
| MFA bypass | 1 | 3.7% |
Two states
Washington against California
Both states cover the same window: January 1, 2023 – September 30, 2026. A vector with fewer than 10 incidents in either state is shown as a count, not a share, because a percentage of five is not a finding.
| Measure | Washington | California |
|---|---|---|
| Letters naming a vector, 2026 | 7.9% | 6.4% |
| Median days, breach to notification | 134 | 158 |
| Filings in the corpus | 922 | 2,242 |
| Phished or stolen credentials | 12 (44.4%) | 30 (56.6%) |
| Social engineering of a person | 10 (37%) | 12 (22.6%) |
| Third-party or contractor access | 3 | 10 |
| MFA bypass | 1 | 1 |
| Service-account or non-human identity abuse | 1 | 0 |
The negative result
4 identity vectors appear zero times in 768 readable Washington letters
The classification filter looks for nine identity vectors. These never appear in a Washington letter's narrative — not rarely, not once:
Session or token theft
Cookie replay and stolen session tokens.
Orphaned or dormant accounts
Accounts that outlived the person or the purpose.
Over-provisioned standing access
Privilege creep and entitlements nobody revoked.
SSO, IdP, or federation compromise
The identity provider itself as the target.
Absence from notification letters is a finding about disclosure practice, not about attacker behaviour. These attacks are well documented in incident-response reporting; they do not survive the trip into a consumer notification.
The evidence
The cited incidents
Every incident below carries the sentence from its own notification letter that establishes the vector, quoted verbatim, plus a link to that letter as filed with the Washington Attorney General. No incident is classified by inference.
Grouped by the vector the letter names. Each group opens to every incident in it, with its quote, its dates, and links to the letter and the filing.
Phished or stolen credentials12 incidentsA valid username and password reached the attacker — phished, reused, purchased, or taken from an earlier breach.
Xsolis, Inc. (Alexian Brothers Health System, Banner Health, Hendrick Medical Center dba Hendrick Health, Infirmary Health, Legacy Health, Mayo Clinic, Rochester Regional Health, UW Medicine, Virginia Hospital Center)
Sector: Healthcare
“Xsolis became aware of unauthorized activity resulting from a targeted phishing attack on January 22, 2026.”
- Breach began
- Jan 20, 2026
- Detected
- Jan 22, 2026
- Filed
- Jun 19, 2026
WellPoint (Independent Clinics of Washington, Elevance Health)
Sector: Healthcare
“On 3/2/2026, Clinics of Washington (ICW), a business associate of Wellpoint Washington, Inc. notified Wellpoint that they experienced a phishing incident.”
- Breach began
- Jun 24, 2025
- Detected
- Apr 28, 2026
- Filed
- Jun 2, 2026
Gastro Health
Sector: Healthcare
“On February 25, 2026, Gastro Health (“we” or “Gastro Health”) became aware of a phishing incident involving some of its personnel that resulted in unauthorized access to certain files and systems accessible to those personnel.”
- Breach began
- Feb 24, 2026
- Detected
- Feb 25, 2026
- Filed
- May 22, 2026
Outcomes One, Inc. (Aetna Health Insurance Company)
Sector: Healthcare
“We recently completed an investigation related to an email phishing incident that occurred on July 1, 2025.”
- Breach began
- Jul 1, 2025
- Detected
- Not stated
- Filed
- Sep 23, 2025
VetCT
Sector: Not classified
“An external person gained access to a single VET.CT Gmail account on 23rd March 2025 and we believe that this was almost certainly as a result of a successful phishing attempt.”
- Breach began
- Mar 23, 2025
- Detected
- Not stated
- Filed
- Apr 10, 2025
SAG-AFTRA Health Plan
Sector: Healthcare
“This incident resulted from a phishing email, and it is important to note that the Plan’s systems were not impacted.”
- Breach began
- Sep 17, 2024
- Detected
- Sep 18, 2024
- Filed
- Mar 14, 2025
United of Omaha Life Insurance Company
Sector: Insurance
“The access was the result of a phishing campaign targeting United of Omaha employees.”
- Breach began
- Apr 21, 2024
- Detected
- Apr 23, 2024
- Filed
- Jul 26, 2024
Levi Strauss & Co.
Sector: Not classified
“Our investigation showed characteristics associated with a “credential stuffing” attack where bad actor(s) who have obtained compromised account credentials from another source (such as a third-party data breach) then use a bot attack to test these credentials against another website – in this case www.levis.com.”
- Breach began
- Jun 13, 2024
- Detected
- Not stated
- Filed
- Jun 21, 2024
BioLife Plasma Services L.P.
Sector: Healthcare
“A dedicated cybersecurity team immediately investigated the incident and determined that beginning on or about January 31, 2024, the Donor Scheduling System was the victim of a credential stuffing attack.”
- Breach began
- Jan 31, 2024
- Detected
- Feb 6, 2024
- Filed
- Mar 15, 2024
Perry Johnson & Associates, Inc. (PJ&A) (Concentra, Inc.)
Sector: Not classified
“The investigation also determined that the unauthorized actor gained initial access to company systems by logging into an RDS Web application. It is unknown how the actor obtained the relevant login credentials.”
- Breach began
- Mar 27, 2023
- Detected
- May 2, 2023
- Filed
- Nov 3, 2023
European Wax Center, Inc.
Sector: Not classified
“The threat actor had utilized stolen credentials to gain access to an EWC account managed by our point-of-sale provider, Zenoti.”
- Breach began
- Apr 18, 2023
- Detected
- Not stated
- Filed
- May 25, 2023
General Mills, Inc. ("General Mills")
Sector: Manufacturing
“Our investigation determined that an unauthorized party likely obtained usernames (email addresses) and passwords from outside of General Mills’ sites and systems and, at certain times between November 18 and December 31, 2022, used these credentials to log into our BettyCrocker.com website.”
- Breach began
- Nov 18, 2022
- Detected
- Not stated
- Filed
- Jan 12, 2023
10 incidentsA human was deceived into granting access, resetting a credential, or approving a request. Includes vishing and help-desk pretexting.
LHC Group, Inc.
Sector: Not classified
“On April 7, 2026, LHC became aware that an employee may have been the victim of a vishing (voice phishing) attack.”
- Breach began
- Apr 7, 2026
- Detected
- Apr 7, 2026
- Filed
- Sep 4, 2026
AdaptHealth, LLC
Sector: Healthcare
“Through this investigation, we learned that the unauthorized third-party gained access to our systems on June 5 through a social engineering attack targeting a single company user account and took with them certain data, including patient information.”
- Breach began
- Jun 5, 2026
- Detected
- Jun 15, 2026
- Filed
- Aug 14, 2026
Quantum Health, Inc.
Sector: Healthcare
“Our investigation determined that the service outage was related to unauthorized access to our IT network, resulting from a user responding to a vishing call on May 29, 2026.”
- Breach began
- May 26, 2026
- Detected
- Jun 1, 2026
- Filed
- Aug 14, 2026
Lennar Mortgage, LLC
Sector: Financial services
“We then determined that an unauthorized party used sophisticated social engineering tactics to access some of our systems between May 26, 2026 and June 1, 2026.”
- Breach began
- May 26, 2026
- Detected
- Jun 1, 2026
- Filed
- Aug 14, 2026
Fox Rothschild LLP
Sector: Legal services
“Our investigation determined that on May 21, 2026 the employee was the target of a social engineering attack, commonly referred to as “vishing”, and certain files were copied and taken.”
- Breach began
- May 21, 2026
- Detected
- May 21, 2026
- Filed
- Jul 16, 2026
Carnival Corporation
Sector: Not classified
“An unauthorized actor used social engineering to deceive an employee to gain access to a limited portion of the Company’s IT system.”
- Breach began
- Apr 10, 2026
- Detected
- Apr 14, 2026
- Filed
- May 27, 2026
Betterment LLC
Sector: Not classified
“As you may be aware, on January 9, 2026, an unauthorized actor gained access to certain Betterment systems through social engineering.”
- Breach began
- Jan 9, 2026
- Detected
- Not stated
- Filed
- Mar 27, 2026
SoFi Technologies, Inc.
Sector: Technology
“ON JANUARY 2, WE IDENTIFIED THAT A SCAMMER USED SOCIAL ENGINEERING TO ACCESS SOME OF OUR INTERNAL SYSTEMS OVER THE PREVIOUS TWO DAYS.”
- Breach began
- Dec 29, 2025
- Detected
- Not stated
- Filed
- Jan 26, 2026
Pillsbury Winthrop Shaw Pitman LLP
Sector: Legal services
“Pillsbury was one of many law firms recently targeted by sophisticated social engineering attempts.”
- Breach began
- Apr 29, 2025
- Detected
- Not stated
- Filed
- Nov 6, 2025
Sno-Isle Regional Library System
Sector: Technology
“This access was through a phishing-type attack in which an outside party posing as an Sno Isle employee convinced an employee to provide a file containing information about certain individuals who worked for Sno-Isle during 2022.”
- Breach began
- Mar 22, 2023
- Detected
- Not stated
- Filed
- Apr 21, 2023
Third-party or contractor access3 incidentsThe path in belonged to a vendor, contractor, or service provider rather than to the filing organization.
Farmers New World Life Insurance Company
Sector: Insurance
“On May 30, 2025, FNWL’s parent company was alerted that a third-party vendor identified suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing FNWL customer information (the “Incident”).”
- Breach began
- May 29, 2025
- Detected
- May 30, 2025
- Filed
- Aug 22, 2025
Benworth Capital Partners
Sector: Financial services
“We believe that the incident occurred when a criminal actor accessed certain components of our systems through a third-party service provider.”
- Breach began
- May 16, 2025
- Detected
- May 23, 2025
- Filed
- Jul 23, 2025
CUSO Financial Services, LP
Sector: Financial services
“On January 19, 2024, CUSO became aware of suspicious activity involving a third-party service provider which we use for archiving communications as required by The Financial Industry Regulatory Authority (“FINRA”).”
- Breach began
- Dec 19, 2023
- Detected
- Jan 19, 2024
- Filed
- Oct 28, 2024
Service-account or non-human identity abuse1 incidentMachine credentials used as a way in.
QuoteWizard
Sector: Not classified
“On June 11, 2024, QuoteWizard determined that an unknown third party used a service account credential to access certain vendor-hosted business systems, which likely resulted in the unauthorized access to or disclosure of consumer data.”
- Breach began
- May 26, 2024
- Detected
- Not stated
- Filed
- Aug 5, 2024
MFA bypass1 incidentA second factor was defeated rather than absent — push fatigue, prompt bombing, or a bypassed enrollment flow.
Bankers Life and Casualty Company
Sector: Insurance
“Based on our investigation and response to this event, however, it appears the threat actor was able to bypass the multi-factor authentication and other common security controls the company had in place that were designed to protect the company’s data.”
- Breach began
- Nov 28, 2023
- Detected
- Nov 29, 2023
- Filed
- Jan 30, 2024
The dense layer
How long Washington organizations took to tell anyone
Washington publishes the breach date and the report date as their own list columns, as California does, so disclosure lag comes from the list, not the letters. Across 859 filings, the median is 134 days. 59 filings state no breach date and 4 have dates that cannot be right (a report before the breach, or more than 2,000 days after it); both are excluded.
| Statistic | Days |
|---|---|
| 25th percentile | 71 |
| Median | 134 |
| 75th percentile | 240 |
| 90th percentile | 379 |
How this was built
Methodology
- One record is one filing listed by the Washington Attorney General. Filings reported outside the corpus window are excluded so Washington and California start and end on the same days.
- Figures are as filed with the Washington Attorney General, without correction; the State does not warrant their accuracy.
- Washington lists filings some time after they are reported. The newest filing in this corpus was reported on September 11, 2026; filings reported after that and on or before September 30, 2026 that were not yet listed are missing and will be added at the next refresh.
- Disclosure lag is the days between the Date of Breach and the Date Reported columns. Filings with a blank or impossible breach date are excluded from lag; the count above is the filings that remain.
- A vector is recorded only where the letter's own What Happened narrative states it, quoted verbatim. Advice, remediation and denial language is excluded, and the rules are the same code that classifies California.
- Of 922 filings, 768 letters yielded a readable What Happened narrative. 138 had no recognisable section structure and 16 were scanned images with no text layer; those are counted as unreadable, not as letters that named nothing.
- Every one of the 27 Washington citations was checked by hand against its filed letter. An earlier random sample found false positives; the quote rules were tightened for both states and the full check recorded with the corpus.
Put a number on your own breach
The AttackCost calculator prices the disruption for your own organization — outage, productivity, revenue, incident response and market value — free and without a sign-up.