MACT Health Board Data Breach Exposes Social Security Numbers

The MACT Health Board Inc., a non-profit tribal healthcare provider serving rural communities in California, recently experienced a significant data breach that compromised sensitive patient and employee information. According to a disclosure filed with the California Attorney General on Jan. 23, 2026, the incident occurred between Nov. 12 and Nov. 20, 2025, when an unauthorized party accessed files on the organization’s IT systems.

The breach was not attributed to a specific individual or group, and there is no information yet on how the unauthorized party gained access. A thorough review of the affected files began Nov. 25, 2025, and was completed Jan. 9, 2026.

The investigation revealed that the exposed data included both personally identifiable information (PII) and protected health information (PHI).

The types of information compromised varied by individual but may have included name, Social Security number, driver’s license number, medical information (such as doctors, diagnoses, insurance details, medications, test results, medical images, and care and treatment records). For employees, the breach also exposed names, Social Security numbers and/or driver’s license numbers.

While the exact number of affected individuals has not been publicly disclosed, the breadth of information exposed indicates a serious risk of identity theft and medical privacy violations.

MACT Health Board's response

In response to the breach, MACT Health Board secured its systems and engaged third-party forensic experts to investigate the incident. The organization also notified law enforcement and began a detailed review of the compromised files to determine whose information was affected.

For those impacted, MACT Health Board is offering a complimentary 12-month membership to Experian’s IdentityWorks Credit 3B service.

This product provides credit monitoring across all three major credit bureaus, identity theft detection, identity restoration support, and up to $1 million in identity theft insurance. Individuals can enroll using the instructions provided in the consumer notice and do not need a credit card to sign up.

A dedicated incident response line is available at 844-354-0260, Monday through Friday from 6 a.m. to 3:30 p.m. Pacific time, for those with questions about the breach or the identity protection services.