Central Valley Regional Center Data Incident Exposes Social Security Numbers

Published
September 19, 2025
Updated
September 19, 2025
Central Valley Regional Center Data Incident Exposes Social Security Numbers
Central Valley Regional Center
Types of INFORMATION affected
  • Names
    Names
  • Social security numbers
    Social Security Numbers
  • Dates of birth
    Dates of Birth
  • Addresses
    Addresses
  • Government IDs
    Government IDs
  • Medical Information
    Medical Info
  • Financial Info
    Financial Info

Affected by the

Central Valley Regional Center

data breach?

Join the Lawsuit

It's free to join. 

Banner advertisement for ExpressVPN to take control of your online security

Claim Depot may receieve a commission from links on this page

Between March 1 and July 7, 2025, Central Valley Regional Center (CVRC) experienced a major data breach affecting confidential information of individuals and families served by the organization. The breach was discovered in July 2025, when CVRC learned that a newly contracted janitorial service had been improperly disposing of sensitive documents.

Instead of being securely shredded, confidential paperwork was placed in trash bags with other waste at one CVRC facility. The affected documents, spanning service years from 2015 to 2025, may have included names, addresses, dates of birth, Social Security numbers, medical information and other personal data.

The breach was reported to the California Attorney General on Sept. 11, 2025. CVRC also posted a notice about the incident on their website.

Central Valley Regional Center's response

Upon learning of the breach, CVRC immediately launched an internal investigation and notified law enforcement, as well as state and federal authorities, including the California Department of Developmental Services. The organization took several steps to address the security lapse:

  • All shredding bins are now secured with locks to prevent unauthorized access.
  • Only the approved shredding service provider is permitted to access these bins.
  • Janitorial service procedures have been revised with explicit instructions on waste disposal.
  • Staff have been retrained on data security protocols.
  • New in-office signage and visual cues direct proper waste disposal.
  • Routine audits have been implemented to ensure compliance with internal protocols and applicable law.
  • All staff, business partners and vendors have been reminded of confidentiality and data protection expectations.

To support those affected, CVRC is offering one year of complimentary identity protection services through LifeLock. Impacted individuals can activate this service online or by phone using a provided promo code and member ID. Additionally, a dedicated call center has been established at 1-888-840-0361, available Monday through Friday from 8 a.m. to 6 p.m. Pacific Time, to answer questions and provide further assistance.

Protect Your Data

A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.

This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.

Notice Letter

This browser does not support inline PDFs. Please download the PDF to view it: Download PDF

CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image