Data Breaches Surge: Chick-fil-A, 23andMe, Law Firms Hit

What's happening

Data breach disclosures have piled up in rapid succession, painting a picture of a threat landscape that spans nearly every sector of American life — fast food, genetics testing, county government, and corporate law. A broad industry review of the closing weeks of July 2026 describes an alarming acceleration in breach volume, with major businesses and healthcare-adjacent companies losing sensitive personal and financial data belonging to millions of people 1. That overview is less a single incident than a warning about a trend, and the individual cases reported elsewhere fill in what that trend actually looks like on the ground.

Chick-fil-A disclosed that customer information was exposed in a breach touching nearly a dozen states, including North Carolina, raising concerns for a customer base that skews toward everyday consumers rather than high-value corporate targets 2. Meanwhile, Spartanburg County, South Carolina, is grappling with a far more entrenched problem: three separate cybersecurity attacks in three years, a pattern that suggests local government systems remain a persistent, repeatable target rather than victims of one-off bad luck 3.

On the corporate and legal side, Blank Rom, a U.S. law firm, is now facing a proposed class action after hackers reportedly accessed clients' Social Security numbers and other sensitive personal data following a breach in May 6. Reuters notes that Blank Rome is not an isolated case but the latest in a string of law firms hit with similar breaches and subsequent litigation, pointing to law firms as a recurring soft target because of the concentrated, high-value personal data they hold on behalf of clients 6.

And in a sign of how long the fallout from a breach can linger, Kentucky residents are now being notified about their share of an $18 million settlement tied to the 23andMe genetic data breach, a reminder that the consequences of a hack — legal, financial, and reputational — can stretch on for years after the initial intrusion 5.

Where the reporting agrees

Across these accounts, the throughline is consistency in kind, if not in scale. Every source describes organizations — whether a restaurant chain, a county government, a law firm, or a consumer genetics company — losing control of personal data that customers or clients had entrusted to them 12356. Multiple reports converge on the idea that breaches are not confined to one industry or type of institution; they cut across private business, government, and professional services alike 1236. There is also shared recognition that breaches generate consequences well beyond the initial hack itself, whether that's regulatory notification obligations, class-action lawsuits, or multimillion-dollar settlements reaching victims years later 56. The Reuters and Spartanburg County reporting in particular both frame their incidents as part of a broader pattern rather than isolated events — repeat law firm breaches in one case, repeat county attacks in the other 36.

Where it doesn't

The sources diverge mainly in scope and specificity rather than in direct contradiction. The general trend piece describes a sweeping, almost industry-wide surge in breaches during a specific window in July 2026, but it does not name the same incidents covered elsewhere — Chick-fil-A, Spartanburg County, Blank Rome, and 23andMe are not tied together in any single account 1. Each of the individual breach stories comes from a different outlet with a narrow regional or sector focus: a North Carolina television station reporting the Chick-fil-A exposure 2, a Yahoo-syndicated piece on Spartanburg County's repeated attacks 3, another Yahoo-syndicated report on the 23andMe settlement's reach into Kentucky 5, and Reuters covering the legal fallout facing Blank Rome 6. None of these sources overlaps with another on facts or figures, so there's no case of conflicting numbers or dates to resolve — the fragmentation itself is the notable feature. It's also worth flagging that one source in this set, on the carbon footprint of primary care prescribing, has nothing to do with data breaches at all and appears unrelated to the rest of the coverage 4.

What the evidence supports

Taken together, the reporting supports a picture of breach activity that is broad-based and structurally embedded rather than a single crisis with one villain or one fix. Local governments, law firms, restaurant chains, and consumer data companies are all being hit, and the Spartanburg and Blank Rome cases in particular suggest that repeat targeting — not just isolated bad luck — is becoming the norm for organizations holding valuable personal data 36. The 23andMe settlement payouts arriving now, long after the original breach, underscore that the financial and legal reckoning for these incidents unfolds on a multi-year timeline 5. The sources don't collectively prove a single coordinated wave of attacks, but they do corroborate that breach disclosures, lawsuits, and settlements are now a near-constant feature of the news cycle across very different corners of the economy.