The California Office of the Attorney General reported a data breach involving the National Capital Poison Center (NCPC) on December 8, 2017. The breach occurred on October 21, 2017, possibly involving unauthorized access to a database containing information collected during calls from 1997 to October 21, 2017. Although it is unknown how many individuals were affected, the breach potentially compromised sensitive information collected over a span of two decades.

National Capital Poison suffered from a ransomware attack that involved records of people who called them between January 1, 1997, and October 21, 2017. There have been no reports of actual or attempted misuse of the information, and NCPC is unable to determine whether any of the data in the database was accessed improperly. If the information was provided, the database server includes one or more of the following types of information: caller name, name of the person who may have been exposed to a poison and date of birth, address and phone number, details about the exposure and clinical course, recommendations made to the caller, caller's email address, and, if applicable, treating facility name and medical record number. NCPC did not indicate whether they paid any ransom or whether they attempted to restore from backup.