Charles Schwab

Disclosed May 3, 201610 years ago22,442 affectedConfirmed

What is known

People affected	22,442 (as reported by the organization)
Disclosed	May 3, 2016
Discovered	Mar 17, 2016
Happened	Mar 25, 2016
Attack	Hacking
Data exposed	Names, Passwords
Sector	Tech · US
Status	Confirmed

Source	Kind
California Attorney General breach notice: Charles Schwaboag.ca.gov · Official notice	Official notice
Washington Attorney General breach notice: Charles Schwabatg.wa.gov · Official notice	Official notice
Oregon DOJ breach notice: Charles Schwabjustice.oregon.gov · Official notice	Official notice
Indiana Attorney General 2017 data breach report: Charles Schwabin.gov · Official notice	Official notice
Indiana Attorney General 2016 data breach report: Charles Schwabin.gov · Official notice	Official notice
Maine Attorney General breach notice archive: Charles Schwabmaine.gov · Official notice	Official notice

Where	Filed	People
California AGresidents of CA	May 3, 2016
Maine AGresidents of ME	May 3, 2016	7
Washington AGresidents of WA	Nov 11, 2016	975
Oregon DOJresidents of OR	Nov 11, 2016	22,442
Indiana AGresidents of IN	Nov 11, 2016	351
Maine AGresidents of ME	Nov 11, 2016	55
Indiana AGresidents of IN	Jul 19, 2017	6

Breach	Disclosed	Attack	Sector	Status	Affected
Disclosed Jun 9, 2023Jun 9, 20233 years ago	Jun 9, 20233 years ago	Not stated	Tech	Confirmed	774
Disclosed Mar 23, 2022Mar 23, 20224 years ago	Mar 23, 20224 years ago	Not stated	Tech	Confirmed	5,083
Disclosed May 24, 2017May 24, 20179 years ago	May 24, 20179 years ago	Not stated	Tech	Confirmed	940
Disclosed May 21, 2015May 21, 201511 years ago	May 21, 201511 years ago	Not stated	Tech	Confirmed	9

History of this record

2026-09-25 · data_types: ["names"] to ["names","passwords"] · backfill source
2026-09-25 · data_types: [] to ["names"] · backfill source
2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2016.pdf · backfill source
2026-09-25 · records: 442 to 22442 · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 442 · backfill source
2026-09-25 · occurred: empty to 2016-03-25 · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · discovered: empty to 2016-03-17 · backfill source
2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.