California Department of Corrections and Rehabilitation

California Department of Corrections and Rehabilitation reported to HHS on 2022-08-22 a Hacking/IT Incident affecting 236,000 individuals. Breached information located on Network Server. The incident involved a ransomware attack that encrypted and exfiltrated PHI, including names, SSNs, DOB, driver's license numbers, diagnoses, lab results, medications, and financial information. The entity secured its network, notified HHS, individuals, and media, and implemented additional safeguards.

Affected (this filing): 236,000

California Department of Corrections and Rehabilitation (CDCR) disclosed a data breach involving a password-protected file-sharing platform. Suspicious activity was discovered in January 2022, dating back to December 2021. An unauthorized user accessed the system, but no data was copied or downloaded. Affected data included names, addresses, contact info, and PHI (mental health, substance use treatment, COVID-19 results). CDCR shut down the platform and launched a multi-agency investigation.