California data breach statistics
1,174 data breach notices were filed with the California Attorney General from October 1, 2024 to October 22, 2026: about 47 a month. Computed from the notices on this site and rebuilt with every data update.
Key numbers
- 1,174 notices; busiest month July 2025 (61).
- Most common sector: Healthcare (188 notices).
- 108 organizations filed more than one notice (list).
Median time from the first listed breach date to the notice being filed: 174 days (across 1,095 notices that list a breach date). A quarter took longer than 309 days.
Notices by month
The current month is partial.
By sector
| Sector | Notices | Share |
|---|---|---|
| Schools, colleges & school districts | 56 | 5% |
| Healthcare | 188 | 16% |
| Cities, counties & government | 31 | 3% |
| Banks, credit unions & finance | 139 | 12% |
| Law firms | 50 | 4% |
Sectors are assigned from the organization name by keyword, so many notices are in none of these groups.
What was exposed
| Data type | Notices | Share of letters read |
|---|---|---|
| Social Security numbers | 284 | 67% |
| dates of birth | 208 | 49% |
| medical information | 158 | 37% |
| driver's license or state ID numbers | 123 | 29% |
| health insurance information | 114 | 27% |
| bank or financial account numbers | 102 | 24% |
| payment card numbers | 69 | 16% |
| passport numbers | 53 | 12% |
| tax IDs or tax documents | 30 | 7% |
| usernames and passwords | 18 | 4% |
From the 424 sample letters where the “what information was involved” section could be read automatically. Some letters don’t list types.
Source
California Attorney General, data security breach reports (oag.ca.gov/privacy/databreach/list). California requires a sample notice when a breach affects more than 500 residents, so this is a California view, not a national count. See about & disclaimer.