North Los Angeles County Regional Center data breach: 298,629 people, notified 19 months after the attack

How many people were affected by the North Los Angeles County Regional Center data breach?

298,629 in total, the number NLACRC reported to Indiana. The letter and the California record give no count.

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by NLACRC	298,629	Notice sent June 30, 2026
Indiana attorney general	Indiana residents	20	Notice sent June 30, 2026
California attorney general	No count published	—	Recorded June 30, 2026

The ranking of 2026's largest breaches sets out the 25 largest and how the list is counted.

What happened, and when?

The center says it discovered suspicious activity on November 28, 2024, began an investigation and took steps to contain it. The letter lists the response: more monitoring, password changes, stronger password practices, a report to federal law enforcement and outside data security and privacy specialists.

Date	Event
November 20, 2024	Unauthorized activity begins
November 28, 2024	NLACRC discovers suspicious activity
December 1, 2024	Unauthorized activity ends
June 30, 2026	Notice sent (Indiana) and recorded (California)

Copying data and then encrypting systems is the pattern the ransomware glossary entry describes, though the letter itself does not use the word. It also does not say whether a ransom was demanded or paid.

Why did notices take 19 months?

The letter does not say. It states only that, after finding the intrusion, the center began analyzing information to confirm who was affected and notify them. Discovery to notice took 579 days. The guide to notice delays sets out the deadlines state laws and HIPAA set once a breach is found.

What information was involved?

Each letter fills in its own list of data elements, and the filed copy leaves that list blank. The letter says the investigation found no evidence that the information was misused for financial fraud or identity theft.

What should a recipient do?

Item	Detail from the letter
Help line	(844) 959-7149, Monday to Friday, 6:00 a.m. to 3:30 p.m. Pacific Time, excluding some U.S. national holidays
Advice	Monitor free credit reports, review account statements and report suspicious activity to financial institutions
Enclosure	An "Additional Resources" sheet with the three credit bureaus' contacts, free annual credit reports, fraud alerts and security freezes

California's record also holds a letter version whose file name refers to 12 months of credit monitoring; the copy fetched for this entry carries the same text as the standard letter. The guide to credit monitoring offers explains how such offers work.

What Massachusetts recorded

Massachusetts' Office of Consumer Affairs and Business Regulation lists a report from North Los Angeles County Regional Center, received on June 30, 2026, with 10 Massachusetts residents affected. For those residents it marks Social Security numbers and medical records as breached.

What the documents leave open

• Which data elements were involved, and for how many of the 298,629 people.
• Who the people are: clients, families, staff or vendors.
• How the intruder got in, and why notices came 576 days after the activity ended.