AccidentalHealthcareHealthcareDisposal ErrorCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Financial accountGovernment IDIdentity (basic)MediumContained

Central Valley Regional Center

bd_d7c45d4be789f4fc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2025

Filed

Sep 11, 2025

To disclose

10 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Central Valley Regional Center →2 incidents on file

Central Valley Regional Center, Inc. disclosed that a third-party janitorial service improperly disposed of confidential documents containing private health and financial information (including SSNs) between March and July 2025. The incident was discovered in July 2025. The organization contained the incident, notified authorities, and implemented physical security controls for shredding bins and revised vendor procedures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 122 days

discovery → filing · 10 weeks / 72 days

Mar 1, 2025

Begins

Jul 1, 2025

Discovered

Sep 11, 2025

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Central Valley Regional Center
norm: central valley regional center

Name: Central Valley Regional Center
norm: central valley regional center
Industry: Healthcarellm

Discovered: Jul 1, 2025
Breach occurred: Mar 1, 2025 – Jul 7, 2025
Undetected for: 122 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2025
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Financial accountGovernment IDIdentity (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
Threat actor: Partner
Regulator citations: Notified the California Attorney GeneralNotified the California State Department of Developmental Services
Third party: via Janitorial service

During the incident: Stopped the improper disposal of confidential information
Notified law enforcement
Notified the California Attorney General
Notified the California State Department of Developmental Services
Offered identity protection services through LifeLock for one year at no cost
Implemented a call center dedicated to this incident
Changes made: Securing all shredding bins with locks to maintain confidentiality and prevent unauthorized handling
Ensuring access to locked shredding bins is restricted to only our approved shredding service provider
Revising our janitorial service procedures to provide more explicit instructions on waste disposal
Retraining our staff on data security protocols to ensure the highest levels of privacy, security, and legal compliance
Establishing in-office signage and visual cues directing proper waste disposal
Implementing routine audits to ensure compliance with internal protocols and applicable law
Affirming our expectations related to confidentiality and data protection to all CVRC staff, business partners and vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-608462
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2025
Raw hash: 852ca35c8b811454f71393e41ccad1521dfa35b1af525f64cd4a40ac2f450d17

Reporting entityCentral Valley Regional Center

Victim entityCentral Valley Regional Center

Incidentdiscovered Jul 1, 2025

Stated responseStopped the improper disposal of confidential information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov