PhysicalGovernmentGovernmentLossEmployee Data InvolvedPIIGovernment IDMediumContained

The City of San Jose, California

bd_1a1663b7e2b1795b · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 9, 2026

To disclose

—

Affected

Not disclosed

Confidence

89%

Full breach record for The City of San Jose, California →

The City of San José notified affected individuals of a data security incident in which a workforce member lost a USB/thumb drive on January 9, 2026, containing names and Social Security numbers of current and former employees. The loss was discovered on January 12, 2026. Law enforcement was notified and the city is reviewing its data storage and transfer policies. Complimentary 12-month credit monitoring was offered through Epiq Privacy Solutions ID.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 9, 2026

Begins

Feb 9, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: The City of San Jose, California
norm: the city of san jose california

Name: The City of San Jose, California
norm: the city of san jose california
Industry: Governmentllm

Discovered: —
Breach occurred: Jan 9, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIGovernment ID
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Initial access: insider_action

During the incident: Immediately launched an investigation
Notified law enforcement
Offering a complimentary one-year membership to Epiq Privacy Solutions ID
Changes made: Reviewing our data storage and transfer policies
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-618398
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2026
Raw hash: 33bec502d9c9372cbc06022da1620a2220482d16c4f1941ea9dcb1d04503bbaf

Reporting entityThe City of San Jose, California

Victim entityThe City of San Jose, California

IncidentUnknown

Stated responseImmediately launched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov