The Department of Toxic Substances Control (DTSC) experienced a data breach on March 10, 2023, reported publicly on March 23, 2023, due to an email account compromise. The incident exposed sensitive personal information, including names, Social Security Numbers (SSNs), Driver’s License Numbers, and medical records of individuals associated with the DTSC. While the breach involved unauthorized access to an email account, no files were downloaded, suggesting the exposure was limited to data visible within the compromised emails. The compromised information poses a high risk of identity theft, financial fraud, and privacy violations, particularly given the nature of the exposed data (SSNs and medical details). However, since no files were exfiltrated and the breach was contained to email access, the scope of the leak remains constrained to the data visible in the inbox/sent items. The DTSC has not confirmed whether the breach was part of a larger cyberattack (e.g., phishing, credential stuffing) or an isolated incident. The lack of file downloads reduces the likelihood of mass exploitation but does not eliminate risks for affected individuals, who may face targeted scams or misuse of their exposed credentials.

On February X, 2014, the California Environmental Protection Agency (CalRecycle) disclosed a data breach that occurred on January 23, 2014. The incident involved the unauthorized electronic transmission of a Leave Activity and Balances Report to Personnel Liaisons. The exposed report contained sensitive personal information, specifically individuals' names and Social Security Numbers (SSNs). The exact number of affected individuals remains undetermined, raising concerns about potential identity theft or fraud risks. The breach stemmed from an internal mishandling of data, where confidential employee records were inadvertently shared beyond authorized recipients. While no evidence of malicious exploitation was reported, the exposure of SSNs—highly valuable for identity fraud—poses significant long-term risks to affected employees. The incident highlights vulnerabilities in CalRecycle’s data-sharing protocols and the critical need for stricter access controls to prevent similar leaks in the future.