California Department of Social Services

The California Department of Social Services (CDSS) disclosed that employees of a contractor operating the Sun Bucks call center improperly accessed case information in the ebtEDGE Web Admin platform between June 6 and June 18, 2024. The breach was discovered on July 19, 2024. Affected data included children's names, addresses, dates of birth, EBT card numbers, and account numbers. CDSS terminated the employees' access, compensated for lost benefits, issued new cards, and offered identity protection services.

On January 6, 2023, the California Department of Social Services (CDSS) discovered that an employee emailed a document containing names, Social Security numbers, and bargaining unit numbers to their personal email account. The incident was flagged by security monitoring software. CDSS contacted the employee and required immediate deletion of the email. The Department is evaluating procedures and implementing new security controls to prevent recurrence. Affected individuals were advised to place fraud alerts on their credit files.

On August 11, 2022, the California Department of Social Services (CDSS) experienced a data breach where an email containing personal information, including names and Social Security Numbers, was sent to unauthorized individuals. CDSS reported the incident to the California Office of Information Security and is reviewing procedures to prevent recurrence.

California Department of Social Services (CDSS) reported a July 16, 2014 incident where confidential documents containing names, addresses, DOBs, and SSNs of children in foster care and seniors were accidentally discarded for disposal prior to shredding. The documents were unretrievable. CDSS investigated, determined the incident accidental, and revised procedures to minimize recurrence.

The California Department of Social Services reported a security incident involving a package containing personal information for In Home Supportive Services (IHSS) providers and recipients. The package was in transit between the Hewlett Packard processing center and the State Compensation Insurance Fund when it arrived damaged on May 1, 2012, with some contents missing. Affected data included scanned document images and employer tax identification numbers. The state is working to recover the information and has notified the Attorney General and State Office of Privacy Protection.