Confirmed breach

Cotton data breach

USUnited States · cottonworks.com · Cotton Incorporated

Cotton (United States) notified the California Attorney General of a data breach on 2 November 2026.

People affected: Not reportedno count given yet
Reported: 2 November 2026Official notice
Time to tell: 45 daysfrom 18 September 2026 · the median is 147

Found to notice: 18 days (found 15 October 2026, by the company’s letter)

What was exposed

The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.

How it happened

How: Data left open (misconfiguration) In the process of transitioning the CottonWorks.com website from one hosting provider to another, a database export containing information about our users was inadvertently made public. source

What the letter says

Found: We believe that this database export was downloaded four times by unknown parties between September 18, 2026 and October 15, 2026.
Exposed: This information may include your name and email address, the name of your employer, college or university, your physical address, biographical information you entered and the plaintext password you use at CottonWorks.com.
Offered: We are notifying individuals of this event when they access CottonWorks.com and are requiring them to change their passwords.

Got a letter or email about this breach? Check it is real →

Read the letter (PDF), as filed with the California Attorney General.

Sources 1

Official noticeCalifornia Attorney General2 November 2026
Archived copy Wayback Machine, 3 November 2026

Official notices are read by code from the regulator’s own register. More notices to California. · Corrections and changes

If Cotton had your data

Look for Cotton Incorporated’s own notice or letter: it should say what of yours was involved. Keep it.
The register’s list does not say what was exposed; the notice it links to (under Sources) usually does. If Cotton Incorporated has a password of yours, change it now to be safe.
Expect scams that use your details: calls, texts or emails pretending to be Cotton Incorporated, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

What to do after a data breach →

Use Cotton? Hear first next time

Breach Radar tells you when a company you use is breached, and what to do. Free, and your list stays on your phone.

Download on the App Store

Questions about the Cotton breach

Was Cotton hacked?

Cotton (United States) notified the California Attorney General of a data breach on 2 November 2026. How it happened, by the sources: misconfiguration.

What data was exposed in the Cotton breach?

The notices and reports so far do not say what was exposed. This page is updated when they do.

How do I know if I was affected?

Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. The letter it filed is on this page. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.

Is there a Cotton data breach settlement?

No settlement open for claims is on record for Cotton as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.

Is a letter, email or text about the Cotton breach real or a scam?

A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Cotton’s own site, or check the letter here.

More breaches in United States

Every breach in United States →

Data breach settlements open for claims

Not about Cotton: settlements over other US data breaches that people can still claim money from.

Finastra file by 27 November 2026
Auxilio Mutuo Hospital file by 21 December 2026
Columbia University file by 21 January 2027

Every open settlement →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.