Government breach notices: what Foster City and McMinnville told residents

What the documents cover

This guide reads two primary documents. The first is the California Attorney General's breach notification record for the City of Foster City, dated October 15, 2026. The second is the City of McMinnville's resident notice, filed with the California Attorney General and dated September 29, 2026. No document about Jacksonville Beach was supplied, so nothing is reported about it here.

The two documents are not equal in detail. The Foster City item is a listing page that points to a sample letter, and the letter's text is not reproduced on it. McMinnville's item is the full letter. Most of what follows therefore comes from McMinnville, and the Foster City section sticks to what the listing records.

Foster City: what the Attorney General record shows

The record is titled "Submitted Breach Notification Sample" and names the filer. It lists the organization as the City of Foster City.

The attached sample letter is identified by a file name. The file name suggests an adult version of the notice with a 12-month offer, but the listing page does not describe the offer or the data involved. Those details cannot be reported from this document.

The record gives two breach dates, a Saturday in late February and a Wednesday in late March 2026, rather than a single date. The page does not say whether they mark the start and end of one period or two separate events. It also does not say when residents were notified.

McMinnville: what happened and when

McMinnville's letter opens by calling the incident a "recent event" that may affect personal information. It then states the city's position on misuse. The letter says the city is providing an overview, its response and resources "out of an abundance of caution."

The letter sets out a timeline in four steps.

The first step is detection. The letter says the city noticed the problem in mid-July 2026.

The second step is the investigation. The city says it began investigating promptly and brought in outside help. It reports that the intrusion window ran from June 1 to July 18, 2026. The window opens about six weeks before the date the city says it became aware.

The third step is the data review. The letter says the city then reviewed the affected data set to work out what was in it and whom it concerned. The fourth step is the individual determination.

The letter is dated seven days after that determination, according to the filing date on the document. The letter body itself does not give its own date.

What data was exposed

The McMinnville letter has a section headed "What Information Was Involved?" Its text is a lead-in followed by a list that is blank in the filed copy.

The data types are therefore not readable in this document. The page is redacted. The letter's own filename on the Attorney General site marks it as a redacted 12-month consumer notice. The letter does tell us how the city framed the exposure: information was "accessed and copied," and the effect differs by person.

The security-freeze instructions mention a Social Security number and date of birth, but only as items a person must supply to a credit bureau. They are not stated as the data taken from the city. Nothing in either document confirms which data types were involved at Foster City.

What residents are offered

McMinnville offers credit monitoring, a credit report and a credit score service at no charge. The letter describes what the monitoring does.

It also offers fraud assistance, run by an outside firm.

The city pays for the services, but residents must act to receive them.

The letter sets conditions on enrollment:

• There is a deadline.
• There is an age limit on the online service.
• There is a fixed term. The letter adds that the services are deactivated at the end of the twelve months.

Residents who want to ask questions can call a dedicated line. The letter asks callers to have it in hand.

The Foster City file name carries "12 months" as well, which would match the length of the McMinnville offer. The listing does not confirm what Foster City provides.

When notice arrives

In McMinnville's case, the letter reached residents after a sequence of dated steps. The dates it gives are June 1 to July 18 for the intrusion, July 15 for awareness, and September 22 for the individual determination. The filing with the Attorney General is dated September 29, 2026.

The letter links its notice to the review of data. It does not say residents were told when the city first learned of the activity. Its own wording puts notification after the review of the data set. The city describes its response this way: it moved promptly "to investigate and respond to the event and notify potentially impacted individuals."

The letter also addresses delay by police.

For Foster City, the record lists breach dates of February 28 and March 25, 2026, and the Attorney General's page is dated October 15, 2026. The document does not give a notice date, so the gap between the breach dates and the notice cannot be stated.

Rights information in the McMinnville letter

Most of the letter's length is a standard section titled "Steps You Can Take to Help Protect Personal Information." It covers free credit reports, security freezes, fraud alerts, police reports, the Federal Trade Commission and the Fair Credit Reporting Act.

On freezes, the letter states the cost rule. It lists the three national bureaus with addresses and phone numbers.

On fraud alerts, the letter gives durations. It also warns that an alert can slow credit applications.

The letter ends with state-by-state contacts for residents of the District of Columbia, Maryland, New York, North Carolina and Rhode Island. It includes the city's own address.

The Rhode Island paragraph is the one place where the letter gives a count. The letter gives no total number of people affected.

Reading the notices side by side

On the points the question asks about, the two documents compare as follows.

• Data exposed: McMinnville's list is blank in the filed copy. The Foster City listing gives no list at all.
• Offer: McMinnville states a 12-month credit monitoring and fraud assistance package. Foster City's file name points to 12 months, and the listing says nothing more.
• Timing: McMinnville gives awareness, intrusion and determination dates. Foster City gives two breach dates and no notice date.