- Status
- Confirmed breach
- People affected
- Not reported yet
- Reported
- 28 July 2026
- Breach began
- 26 August 2025
- Found to notice
- 56 days (found 2 June 2026, by the company’s letter)
- Time to tell
- 336 days (the median in California’s notices over the last year: 154 days)
What was exposed
The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.
How it happened
- How
- Insider
anomalous unauthorized activity involving an employee
source
What the letter says
- Found
On 6/2/26, the Department learned of anomalous unauthorized activity involving an employee.
- Began
on 8/26/25 a data file containing sensitive information was accessed by an unauthorized user
- Exposed
First Name, Last Name, Address, Client Index Number (CIN) or Medi-Cal Number, Phone Number, and In Home Supportive Services (IHSS) Case Number.
- Offered
Read the Reducing the Risk of Identity Theft page included with this letter and consider taking the recommended actions.
Got a letter or email about this breach? Check it is real →
Read the letter (PDF), as filed with the California Attorney General.
Sources
Official notices are read by code from the regulator’s own register. More notices to California. · Corrections and changes