AccidentalDisposal ErrorCustomer Data InvolvedSupply Chain (3P Vendor)PHIHEALTH_BASICFINANCIAL_ACCOUNTIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Central Valley Regional Center
bd_d7c45d4be789f4fc · schema v1 · pii pii-v1
Full breach record for Central Valley Regional Center →Central Valley Regional Center, Inc. disclosed that a third-party janitorial service improperly disposed of confidential documents containing private health and financial information (including SSNs) between March and July 2025. The incident was discovered in July 2025. The organization contained the incident, notified authorities, and implemented physical security controls for shredding bins and revised vendor procedures.
California clockDiscovered Jul 1, 2025 → Notified Sep 12, 202573d ✗ CA 60-day late10 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-608462
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 11, 2025
- Raw hash
- 852ca35c8b811454f71393e41ccad1521dfa35b1af525f64cd4a40ac2f450d17
Reporting entity
- Name
- Central Valley Regional Centernorm: central valley regional center
Victim entity
- Name
- Central Valley Regional Centernorm: central valley regional center
Incident
- Discovered
- Jul 1, 2025
- Materiality determined
- —
- Notification sent
- Sep 12, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICFINANCIAL_ACCOUNTIDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- Threat actor
- Partner
- Regulator citations
- Notified the California Attorney GeneralNotified the California State Department of Developmental Services
- Third party
- via Janitorial service
Compliance
- Time to disclose
- 10 weeks(72 days from discovery to filing)
- Compliance flags
- CA 60-day late · 73d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 1, 2025→ Notified: Sep 12, 202573d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.