Cotton Incorporated
Sep 2026 · Graded Verified · Technology and Software · Government record
Incident summary
Cotton IncorporatedSep 2026
Not yet quantified
VVerifiedCotton Incorporated left an unsecured database export from CottonWorks.com, its B2B site, exposed during a web hosting transition, and unknown parties downloaded it four times between September 18 and October 15, 2026. The file held names, addresses, affiliations, biographical details, and passwords in plaintext, for a headcount that the filing never gives. Plaintext passwords were the design fail, a design decision waiting years for a migration to leave the door open.
Technology and Software
California AG breach notification
About this record
This incident is on the public government record: an SEC 8-K filing or a state-regulator notification, graded Verified. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.