On September 1, 2026, we identified unusual activity in our Microsoft 365 system.
Began
intermittent unauthorized access to the Microsoft 365 accounts for four employees between August 26, 2026 and September 2, 2026
Exposed
your name and some or all of the following: your contact information, demographic information, Social Security number, driver's license number, date of birth, medical record number, patient account number, diagnosis information, treatment information, prescription information, provider name(s), date(s) of service, and/or health insurance information. For some patients, financial account and routing numbers may have also been involved.
Offered
we secured the services of Experian to provide you with one year of complimentary identity monitoring services through Experian®'s IdentityWorks
Official notices are read by code from the regulator’s own register. An attackers’ claim is their own word and is not verified. More notices to California. · Corrections and changes
Questions about the El Camino Health breach
Was El Camino Health hacked?
El Camino Health (CA, United States) notified the California Attorney General of a data breach on 30 October 2026. How it happened, by the sources: ransomware.
What data was exposed in the El Camino Health breach?
The notices and reports so far do not say what was exposed. This page is updated when they do.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. The letter it filed is on this page. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a El Camino Health data breach settlement?
No settlement open for claims is on record for El Camino Health as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the El Camino Health breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to El Camino Health’s own site, or check the letter here.
Privacy Unpacked