Reading a California AG breach notice: what the letter and the AG record each tell you

Two documents, two jobs

A California Attorney General breach filing gives a reader two things to look at. One is the sample letter the organization sent to affected people. The other is the Attorney General's own record page for that filing. This guide compares both for two filings: Inner City Education Foundation (ICEF) and City of Foster City. It answers five questions: when the intrusion happened, when it was found, when people were told, what data was involved, and what protection is offered.

The record page is thin. After the organization name and the breach dates, the text we reviewed moves straight to links and site navigation. Discovery, notice and data details are not on the record page text. They have to come from the letter.

When the intrusion happened

The record page and the letter both speak to this question, and in these two filings they agree.

For ICEF, the Attorney General's record lists the breach dates as Sunday, August 4, 2024 and Sunday, September 29, 2024. The ICEF letter gives the same window in its own words, saying an unauthorized actor gained access and may have taken certain information.

For Foster City, the record lists Saturday, February 28, 2026 and Wednesday, March 25, 2026. The Foster City letter describes the same period and uses slightly different wording about what the third party did.

Both letters use "may have." ICEF says the actor "may have taken" information, and Foster City says the third party "may have viewed or acquired" files. Neither letter states flatly that data was removed. A reader asking what was "taken" should keep that wording in mind.

The record page labels its date field "(if known)." The page presents the dates as a range, not as separate events.

When it was found

Discovery dates appear only in the letters, and the two letters differ in precision.

The ICEF letter names a day. That is one day after the end of the intrusion window the letter and record both give.

The Foster City letter gives no day. Because the letter's own date field is an unfilled merge field, the phrase "earlier this year" cannot be tied to a calendar year from the letter text alone. A reader should treat the discovery date as not stated in this filing.

When people were told

Here the two letters differ most. Notice date is not a field on the Attorney General's record page, so it has to be read from the letter.

The ICEF letter carries a date. Set against the September 30, 2024 awareness date in the same letter, the letter's date falls more than two years later. The letter explains part of that interval as a review of the affected files. The letter does not give a date for when that review finished. It says only that the process was completed and that notice is being provided.

The Foster City sample shows no date. The date line is a blank template field. The letter does give the end of its file review. That date marks when the City determined personal information was in the files. It is not stated as the date letters went out.

So the ICEF letter gives a letter date but no review completion date. The Foster City letter gives a review completion date but no letter date. Neither filing, as read here, supplies both.

What data was involved

Both samples leave this blank. Organizations commonly send one template to many people and merge in each person's details. The text filed with the Attorney General shows the template, not the merged result.

In the ICEF letter, the sentence that should list the data types has a gap where the information would go. Nothing in the filed text says which kinds of information that refers to.

In the Foster City letter, the data elements appear as placeholder names. The letter confirms that a name may be involved and nothing more specific.

The Foster City letter also contains a section on medical information. It says the City has no evidence of misuse. That sentence does not say what kinds of medical information, if any, were involved for any given person. The filing text alone does not settle what data types were affected.

What protection is offered

This is the part of the letters with the most detail, and the part where specifics differ.

ICEF offers a bundle of single-bureau services for a fixed term. The letter sets a deadline tied to its own date. Because the ICEF letter is dated October 16, 2026, that clock runs from the date printed on it.

Foster City offers an Experian product for one year. The letter lists insurance among the features. The enrollment deadline is another unfilled field. The filed sample therefore does not show how long Foster City recipients have to activate.

The ICEF letter is for single-bureau monitoring, and the Foster City letter names a three-bureau product by its title. The Foster City letter describes the product as monitoring Experian, Equifax and TransUnion files. Both letters also include general sections on fraud alerts, credit freezes and free credit reports.

What each source can and cannot answer

The Attorney General's record answers one question reliably: what date range the organization reported for the breach. The letter answers the rest, but only as far as its template was filled in when it was filed. In these two filings, the intrusion dates match between record and letter. The discovery date is complete for ICEF and missing for Foster City. The letter date is present for ICEF and blank for Foster City. The data types are blank for both. The protection terms are complete for ICEF and missing a deadline for Foster City.

A reader logging these incidents should record each of those gaps as "not stated in the filing" rather than filling it in from outside sources.