The California Office of the Attorney General disclosed that Advanced Data Processing, Inc. suffered a data breach on October 1, 2012, caused by an employee’s illegal access and unauthorized disclosure of patient account information. The compromised data included names, dates of birth, Social Security numbers, and record identifiers, though the exact number of affected individuals remains undetermined. Notably, no medical records were accessed, limiting the scope to personally identifiable information (PII) rather than sensitive health data. The breach stemmed from internal misconduct, highlighting vulnerabilities in employee access controls and oversight. While the incident did not involve external cybercriminals or sophisticated hacking techniques, the exposure of SSNs and other PII poses significant risks, including identity theft, financial fraud, and reputational harm to both the company and the affected individuals. The lack of clarity on the number of victims further complicates mitigation efforts, as the full extent of the damage—such as potential fraudulent use of the stolen data—cannot be precisely assessed. As a healthcare-adjacent service provider, the company’s failure to prevent unauthorized internal access underscores systemic weaknesses in data governance, particularly in sectors handling sensitive personal information. The breach serves as a cautionary example of how insider threats can exploit procedural gaps, even without external cyberattacks.