Unauthorized actors acquired source code and inactive data files containing Protected Health Information (PHI) and Personally Identifiable Information (PII) for under 1% of clients.
Filing excerpt
For example, in early June 2026, we identified the unauthorized acquisition of point-in-time copies of source code, primarily used for testing purposes, from a cloud-based repository hosted by a third-party provider and the unauthorized acquisition of four files of inactive data from a single application, which had been written to cloud-based storage pending its scheduled destruction.
What this signalsFilings often name leadership changes, deals and spending plans.
Technologies
sec-10qcybersecurityIncidentGet every 10-Q signal for Waystar and the companies you sell to, in the tools you already use.
Connect Autobound to Claude, Claude Code or Cursor with MCP. Then ask: “What changed at Waystar this week?”
The Signal API returns 10-Q signals for any list of companies as JSON, for your CRM, warehouse or app.
Sign up and spend your free credits on the companies you sell to.
This page shows a preview. The full sec-10q record in the Signal API and MCP can also have these 8 fields. Some fields are empty for some signals.
Company
linkedin_urlValue in the APIindustriesValue in the APIemployee_count_lowValue in the APIemployee_count_highValue in the APIrevenueValue in the APIdescriptionValue in the APISignal
signal_nameValue in the APIassociationValue in the APIGET /v1/signals/f70d0823-8d19-42fd-9eb4-87e040c54b70 returns this record as JSON. POST /v1/companies/enrich returns every signal for waystar.com.
{
"signal_id": "f70d0823-8d19-42fd-9eb4-87e040c54b70",
"signal_type": "sec-10q",
"signal_subtype": "cybersecurityIncident",
"detected_at": "2026-08-04T07:03:41.072+00:00",
"company": {
"name": "Waystar",
"domain": "waystar.com"
},
"data": {
"detail": "Unauthorized actors acquired source code and inactive data files containing Protected Health Information (PHI) and Personally Identifiable Information (PII) for under 1% of clients. This incident creates urgent needs for remediation, client communication, and security posture review, despite the company's belief it will not have a material financial impact.",
"metrics": {
"pct": 0.01,
"timeframe": "current_quarter",
"pct_context": "Maximum percentage of clients whose PHI/PII was included in the breached data."
},
"summary": "Waystar suffered a data breach in June 2026, exposing source code and client PHI/PII.",
"excerpts": "For example, in early June 2026, we identified the unauthorized acquisition of point-in-time copies of source code, primarily used for testing purposes, from a cloud-based repository hosted by a third-party provider and the unauthorized acquisition of four files of inactive data from a single application, which had been written to cloud-based storage pending its scheduled destruction.",
"relevance": 1,
"sentiment": "negative",
"confidence": "high",
"source_url": "https://www.sec.gov/Archives/edgar/data/1990354/000199035426000035/way-20260630.htm",
"filing_date": "2026-07-29",
"filing_year": 2026,
"fiscal_year": 0,
"fiscal_year_end": "06/30",
"sales_relevance": "Urgent security needs",
"signal_category": "technology",
"technologies_mentioned": [
"cloud"
]
}
}
curl https://signals.autobound.ai/v1/signals/f70d0823-8d19-42fd-9eb4-87e040c54b70 \
-H "X-API-KEY: $AUTOBOUND_API_KEY"curl -X POST https://signals.autobound.ai/v1/companies/enrich \
-H "X-API-KEY: $AUTOBOUND_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"waystar.com","limit":20}'Long text fields are shortened on this page.
Looking up one signal by its id is free. Enrich costs 2 credits per signal returned; a call with no results is free.