California Virtual Academies (CAVA) notified employees of a data security incident discovered on December 9, 2015. A data security researcher identified a vulnerability in a data storage system. CAVA, with support from vendor K12 Inc., secured the data within hours. Forensic analysis indicated unauthorized access was limited to the researcher who flagged the issue. Social Security numbers and other personal information may have been accessed. CAVA offered 12 months of identity theft protection and credit monitoring.