The California State Controller's Office experienced a data breach after an employee clicked a phishing link, granting an unauthorized user access to their email account from March 18-19, 2021. The attacker accessed Unclaimed Property Holder Reports containing names, addresses, SSNs, birth dates, and property values. Access was promptly removed, and 24 months of identity theft resolution services were offered to affected individuals.