Privacy UnpackedAccountability · updated hourly
California’s 30-day rule: how long companies take to tell
Since 1 January 2026, a business must tell Californians about a data breach within 30 days of finding it. From the companies’ own notice letters: the day each says it found the breach, to the day its notice reached California’s register.
- Notices in 2026 with a “found” date
- 410
- Median days, found to register
- 61
- Within 45 days
- 41%
- Over 90 days
- 36%
45 days is the 30 days to tell people plus the 15 the law gives to send California’s Attorney General a copy. A notice on the register within 45 days of the breach being found can have met both deadlines; one later than that can only have if a delay the law allows applied. 27% were on the register within 30 days.
Before and after the rule
Notices have come faster under the rule: a median of 61 days in 2026, against 69 in 2025.
| Notices to California | Letters | Median days | Within 45 days | Over 90 days |
|---|---|---|---|---|
| 2025, before the rule | 434 | 69 | 38% | 43% |
| 2026, under the rule | 410 | 61 | 41% | 36% |
The letters are read newest first, so 2026 is read in full sooner than 2025; the 2025 row will move as older letters are read.
The longest delays have shortened, though: three in four notices were on the register within 140 days in 2026, against 188 in 2025, and 20% took more than six months, against 26%.
Month by month
| Month on the register | Letters | Median days | Within 45 days |
|---|---|---|---|
| January 2026 | 40 | 43 | 50% |
| February 2026 | 31 | 94 | 35% |
| March 2026 | 31 | 62 | 32% |
| April 2026 | 30 | 56 | 37% |
| May 2026 | 34 | 38 | 56% |
| June 2026 | 34 | 74 | 38% |
| July 2026 | 44 | 63 | 34% |
| August 2026 | 40 | 60 | 35% |
| September 2026 | 43 | 63 | 49% |
| October 2026 | 54 | 66 | 31% |
The longest gaps in 2026
In the company’s own words, with its letter. The law allows a delay when law enforcement asks for one, or while a business works out what happened and secures its systems, and many letters explain the time taken: read each one before drawing a conclusion. A company that wants to add context can write to us, and we publish its reply.
- Impac Mortgage Holdings 758 days
On March 20, 2024, Impac identified indications of potential unauthorized access to its systems.
The letter - Inner City Education Foundation 746 days
On September 30, 2024, ICEF became aware of suspicious activity on its network.
The letter - The Phia Group 675 days
Recently, we learned that some of your personal information may have been involved in a data security incident we experienced. The incident began on July 9, 2024, when we discovered suspicious activity
The letter - UA Sprinkler Fitters Local 669 Joint Apprenticeship and Training Committee 624 days
On or about May 23, 2024, we became aware of suspicious activity related to certain JATC computer systems.
The letter - Richard D. Jones, A Professional Law 592 days
On or around November 3, 2024, Jones Mayer became aware of suspicious activity within our network environment.
The letter - North Los Angeles County Regional Center 579 days
On November 28, 2024, we discovered suspicious activity in our computer systems
The letter - The Phia Group 570 days
Recently, we learned that some of your personal information may have been involved in a data security incident we experienced. The incident began on July 9, 2024, when we discovered suspicious activity
The letter - Berkeley Research Group 547 days
On Sunday, March 2, 2025, we detected suspicious activity in our network
The letter - L.A. Care Health Plan 535 days
On or about January 13, 2025, a former L.A. Care Health Plan vendor, Conduent Business Services LLC (Conduent), discovered a cyberattack
The letter - Magna Hospitality Group 507 days
On May 24, 2025, Magna became aware of suspicious activity affecting certain systems on our network
The letter - Community Psychiatry Management LLC dba Mindpath Health 505 days
On November 25, 2024, we experienced a network disruption that impacted certain systems. Upon discovery, we took immediate action to address and investigate the event
The letter - Hausfeld 489 days
On February 21, 2025, Hausfeld became aware of suspicious activity involving our computer environment.
The letter - TABB Inc. ("TABB") 475 days
On October 25, 2024, we determined that the files contained your <<b2b_text_2 (name, variable data elements)>>.
The letter - Lansing Community College 472 days
On February 18, 2025, Lansing Community College identified unauthorized access to certain systems in its network environment.
The letter - Yellow 456 days
On around March 27, 2025, Yellow identified suspicious activity on its computer network.
The letter - Texas Tech University Health Sciences Center 455 days
on or about January 24, 2025, we completed a review that determined that your information was present in files which may be potentially affected by this incident
The letter - Johnson-Peltier Electric 444 days
On March 10, 2025, Johnson-Peltier detected suspicious activity related to certain systems within its environment.
The letter - The Health Trust and its subsidiary, FASS 436 days
On June 11, 2025, further suspicious activity was identified.
The letter - Conduent Business Services, LLC (revised submission) 435 days
On January 13, 2025, we discovered that we were the victim of a cyber incident
The letter - Friesen Group 433 days
The investigation determined on July 15, 2025, that an unauthorized user gained access to Friesen's network for a limited period of time and may have accessed data.
The letter
How it is measured
California’s Attorney General publishes every breach notice sent to more than 500 Californians, with the company’s letter. The tracker reads each letter and keeps the day it says the breach was found, only when the letter’s own sentence gives that day (the sentence is shown with it). The gap runs from that day to the day California’s register lists the notice as reported.
What the law says (Civil Code section 1798.82, as amended by SB 446 from 1 January 2026): people must be told within 30 calendar days of the business finding the breach, except when law enforcement asks it to wait or when the time is needed to find out what happened and restore its systems; a copy of the notice must reach the Attorney General within 15 days of telling them. A long gap here is therefore not, by itself, a finding that a business broke the law. Some letters count from the day suspicious activity was noticed, others from the day the business learned that personal data was involved; the tracker keeps the day the letter itself gives.
Letters with no readable text (scans) and letters that give no date are not counted. The letters are read a few dozen a day, newest first, so the counts grow; every letter counted links to its company’s page, with the letter.
For journalists and researchers
- Download every letter counted (CSV): the organisation, the day its letter says it found the breach, the day its notice reached California’s register, the days between, and links to its page and its letter. Updated with the site.
- Free to use with credit, under CC BY 4.0. Please cite: Privacy Unpacked, “California’s 30-day breach notice rule: how long companies take to tell”, https://privacyunpacked.com/breaches/thirty-days/, figures as of 15 November 2026.
- The figures move as more letters are read: quote them with their date. For a figure we do not show, or to check a company’s row, write to us.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.