El Camino Health data breach: what was exposed and what to do

What information was involved

According to the sample notice letter El Camino Health filed with the California AG (read the letter), the information involved may include:

NameSocial Security numberDriver's license / state IDBank or financial accountMedical informationHealth insurance informationDate of birth

“The information involved varies per individual. Based on our ongoing review, the documents may contain your name and some or all of the following: your contact information, demographic information, Social Security number, driver’s license number, date of birth, medical record number, patient account number, diagnosis information, treatment information, prescription information, provider name(s), date(s) of…”

Extracted automatically from the letter’s “What information was involved” section. Not every item applies to every person; your own letter says what applied to you.

Steps for the information in this notice

Matched to the information types listed above. All free.

1. Freeze your credit at all three bureaus (free): Equifax, Experian and TransUnion. A freeze blocks most new accounts in your name and doesn’t affect your score.
2. Get an IRS Identity Protection PIN at IRS.gov. It stops someone filing a tax return with your Social Security number.
3. Check your Social Security record: create or review your my Social Security account so no one else can claim it.
4. Driver’s license or state ID: watch for mail or tickets you don’t recognize, and ask the DMV about a replacement if you see misuse.
5. Call your bank or card issuer using the number on the back of your card or your statement. Ask about a new card or account number, and turn on transaction alerts.
6. Review your “explanation of benefits” statements from your health plan for care you didn’t get, and ask your insurer whether a new member ID is possible.
7. Be wary of calls, texts and emails that mention this breach. Don’t give out information; contact the organization using the details in the official letter.

If the letter offers free credit monitoring, enroll using the code in the letter, not a link from an unexpected email or text.

What to do now

This is general guidance for anyone who receives a data breach notice. Read the official notice for details about your situation.

1. Read the official notice. It should say what happened, what kinds of information were involved, and whether free credit monitoring is offered (and the enrollment deadline).
2. Freeze your credit — it's free. A freeze stops new credit from being opened in your name. Contact each bureau separately:
   • Equifax credit freeze
   • Experian credit freeze
   • TransUnion credit freeze
3. Or place a free fraud alert. A fraud alert tells lenders to verify your identity before opening credit. Contact one bureau and it must notify the other two. An initial alert lasts one year.
4. Check your credit reports. Get free reports at AnnualCreditReport.com, the official site, and look for accounts you don't recognize.
5. Change passwords. If an account password may be involved, change it, and change it anywhere else you reused it. Turn on two-step verification where you can.
6. Watch your statements for bank, card, insurance, and medical charges you don't recognize, and be wary of calls, texts, or emails that mention the breach and ask for information.
7. If someone uses your information, report it and get a recovery plan at IdentityTheft.gov (Federal Trade Commission).

Read the full what-to-do guide →

Is this breach letter real?

Companies that notify more than 500 Californians must send a sample of the letter to the California Attorney General, so a matching listing on the AG’s site (linked above) is a good sign the notice is genuine. Still, don’t call numbers or click links in an unexpected email or text that mentions a breach. Use the phone number in the mailed letter or on the organization’s own website.

Related notices

Recent notices in Healthcare:

• EyeMed Vision Care, LLC · October 30, 2026
• Central Ohio Primary Care Physicians, Inc. (COPC) · October 30, 2026
• Marathon Health · October 29, 2026
• HCA Healthcare, Inc. · October 29, 2026
• Photon Health · October 28, 2026