San Andreas Regional Center sanandreasregional.org

San Andreas Regional Center data breach 2021: what happened and what to do

San Andreas Regional Center, a California regional center, reported a ransomware attack in July 2021 that affected 57,244 people. Exposed details included Social Security, driver's license and passport numbers, health insurance information, diagnoses and treatment information.

View all 13,177 breaches
Breach date
3 Jul 2021
Affected
57,244
Data exposed
Names, Addresses, Dates of birth, Phone numbers, Social security numbers, Driver's licenses, Passport numbers, Email addresses, Health insurance information, Photos, Diagnoses, Treatment information
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

San Andreas Regional Center reported a ransomware attack in July 2021. HIPAA Journal reports the attack was discovered on July 5, 2021, the investigation concluded on August 2, and notification letters went out on August 27. The center reported to HHS as a business associate, and the incident covers 57,244 people.

Sources checked: ocrportal.hhs.gov, hipaajournal.com, oag.ca.gov

Last verified against the official page:

How we research this Report an error

What was exposed

HHS lists names, addresses, dates of birth, telephone numbers, Social Security numbers, driver's license numbers, passport numbers, email addresses, health insurance information, photos, diagnoses and other treatment information.

That is a broad set of identity details. Government ID numbers and Social Security numbers can be used to open credit or file fraudulent tax returns. Phone numbers and email addresses let scammers send messages that look related to your services or benefits. Diagnoses and insurance details can be used for medical identity theft.

The company's response

The center told HHS it revised its HIPAA security procedures, retrained its workforce and added technical safeguards. HHS's Office for Civil Rights provided technical assistance. A class action over the attack was later settled, according to HIPAA Journal.

What to do if you were in it

  1. 1

    Freeze your credit at all three bureaus

    A credit freeze is free and stops lenders from opening new accounts in your name. Place one at Equifax, Experian and TransUnion, as the FTC explains. Do it for each bureau separately.

  2. 2

    Watch for misuse of a passport or driver's license number

    Check your credit reports at annualcreditreport.com and report any misuse at IdentityTheft.gov. If you suspect your passport number is being misused, contact the issuing agency.

  3. 3

    Read your insurance and medical statements

    Check the statements from your health insurer and your service providers. Report treatment, claims or bills you don't recognize to the insurer, since someone may be using your details to get care.

  4. 4

    Be wary of messages that mention the breach

    Scammers use real details to sound credible. Don't click links or call numbers in unexpected texts, emails or calls about your services, benefits or the breach. Go to the organization's own website instead. If you spot a scam, report it at IdentityTheft.gov.

  5. 5

    Check whether your email or phone is in other breaches

    Serus monitors breach databases and the dark web and alerts you when your details show up. Run a free scan to see where you stand. Our guide to what to do after a data breach covers the rest.

Official filings

Timeline

  1. The breach happened

  2. Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the San Andreas Regional Center breach?

HHS lists 57,244 people. The center sent notification letters starting August 27, 2021. If you or a family member used the center and heard nothing, ask the center directly.

Is there a settlement?

HIPAA Journal reports that the center agreed to settle a class action over the 2021 ransomware attack, with payments for documented expenses up to $500. Check the settlement notice for current deadlines.

What was exposed?

Names, addresses, birthdates, phone numbers, email addresses, Social Security, driver's license and passport numbers, health insurance information, photos, diagnoses and treatment information, per HHS.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to make your number private when you call fcc.gov How to stop spam emails consumer.ftc.gov How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com Remove yourself from Equifax equifax.com

Related articles

All articles

What Happens If Your Email Is on the Dark Web – And What to Do Next

How to Get My Information Off the Dark Web

What Can Someone Do with Your Phone Number?

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.