In 2026, Regional Center of Orange County (RCOC), a nonprofit organization serving people with developmental disabilities, experienced a data breach. This incident involved the mishandling of paper records that were intended for secure destruction but were allegedly placed in regular trash by a contracted janitorial service. The breach was discovered on May 27, 2026, and RCOC began notifying affected individuals on July 27, 2026.
The compromised data types include name, address, date of birth, phone number, email address, Unique Client Identifier (UCI) number, and personal health information. Social Security numbers, financial account numbers, and medical record numbers were specifically stated as not involved. The number of affected individuals has not been publicly disclosed; however, RCOC stated it was notifying all individuals served through its Cypress office who may have been affected. The incident was filed with the California Attorney General’s Office. Only California is known to be affected.
Further details regarding the exact number of impacted individuals or any subsequent regulatory actions remain unclear. Notifications were sent to those potentially affected through the Cypress office.