The California Office of the Attorney General disclosed a data breach affecting Tiburcio Vasquez Health Center Inc., facilitated by a third-party vendor, CaptureRx, on February 6, 2021. The incident involved unauthorized access to electronic files containing sensitive personal information, including names, dates of birth, and prescription details of patients. While the exact number of impacted individuals remains undisclosed, the breach exposed confidential health-related data, raising concerns about potential misuse for identity theft, fraud, or targeted phishing attacks. The delayed reporting (disclosed on June 22, 2021) further compounds risks, as affected individuals may have remained unaware of their compromised data for months. Given the nature of the exposed information—particularly prescription records—the breach poses significant privacy and compliance risks under healthcare regulations like HIPAA. The incident underscores vulnerabilities in third-party vendor security protocols and the critical need for timely breach notifications to mitigate downstream harm.