A letter or email saying your information was exposed in a data breach is alarming, and easy to mistake for a scam. This article explains what California law requires of organizations that lose control of personal data, how the state keeps a public record of larger breaches and what federal guidance suggests a recipient do next.
What does California require when personal data is exposed?
According to the California Attorney General’s office, state law requires a business, or a state or local agency, to notify California residents whose unencrypted personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person. The Attorney General’s page cites section 1798.82 of the Civil Code for businesses and section 1798.29 for state agencies.
Two details in that wording matter. First, the duty applies to unencrypted information. Encryption, which scrambles data so it is unreadable without a key, changes the analysis. Second, the standard includes data “reasonably believed” to have been acquired, so an organization cannot always wait for proof that data was taken.
The Attorney General’s page does not set out the notification deadline or the full list of required notice contents, and this article does not state them either. Readers who need those details should consult the statute text on the state’s legislative information site or a qualified attorney.
Why does the 500-resident line matter?
The notice that lands in your mailbox is not the only record. According to the Attorney General, a business that must notify more than 500 California residents because of a single breach must electronically submit one sample copy of the notice to the Attorney General’s office. The sample must leave out personally identifiable information, and businesses send it through an online submission form.
The threshold has a practical consequence. Smaller incidents, at or below 500 residents, can still require notices to the people affected, but they do not appear in the state’s public sample collection. The Attorney General’s page does not say what applies at or below that number, so the absence of a company from the list is not proof that no breach occurred.
How does the Attorney General’s public breach list work?
The state publishes a searchable list of the submitted notices. As of the page’s display in early November 2026, according to the Attorney General, the first page showed 50 entries with reported dates running from October 13 to October 30, 2026, and the list ran to well over 100 pages.
Each entry gives:
| Field | What it tells you |
|---|---|
| Organization name | Who submitted the notice |
| Breach date(s) | When the incident is said to have happened, sometimes “n/a” |
| Reported date | When the notice reached the Attorney General |
| Sample notice | A link to the letter or email recipients received |
The list can be searched by organization name or by a range of breach dates, and the whole list can be downloaded as a spreadsheet file in CSV format. Because it is searchable and downloadable, journalists, researchers and ordinary residents can check whether a letter matches a real filing.
Is the company named on the list the one that was hacked?
Not necessarily. The Attorney General notes that the organization sending a notice may not be the one that was breached. Its own example is a bank reporting a breach of card numbers that happened at a merchant. Payroll processors, software vendors and other service providers can create the same pattern: a company you never dealt with directly may have held your data on behalf of one you did.
The list also shows how long some incidents take to surface. One entry the Attorney General’s page displayed gave a breach date of September 1, 2019 and a reported date of October 22, 2026, a gap of more than seven years. The page does not explain such gaps, and one entry should not be read as typical. It does show that the “reported” date and the “breach” date are different facts.
Is the notice you received real?
Because criminals know people are worried after breaches, fake notices exist. The Federal Trade Commission’s guidance for businesses says a good notice should describe how the breach happened and when, what personal information was involved, what the company has done in response and what recipients can do, with contact details. It also recommends that the notice explain how the company will contact people in the future, which the FTC says helps people avoid phishing scams tied to the breach.
Those features give readers something to test:
- Does the notice describe what happened, rather than only urging you to click?
- Does it say what type of information was involved?
- Can you reach the organization using contact details you find independently, rather than only those in the message?
- Does the notice appear in the Attorney General’s list, if the breach was large enough to be filed?
Text messages and links deserve the same caution described in how to spot phishing texts and smishing. A message that demands immediate payment or login credentials is a warning sign whatever its subject.
What does the FTC suggest after a notice arrives?
The FTC’s breach-response guide lists steps for recipients. As summarized from that guide:
- Consider a free fraud alert. Contacting any one of the three national credit bureaus places an alert that, according to the FTC, lasts one year and can be renewed. Creditors must then contact you before opening new accounts or changing existing ones.
- Get your free credit reports. The FTC guide describes checking each bureau’s report for accounts or inquiries you do not recognize, and continuing to check periodically even if the first reports look clean.
- Consider a free credit freeze. The FTC says a freeze makes it harder for someone to open new accounts in your name, though you will need to lift it when you apply for credit yourself.
- Report misuse. The agency points to IdentityTheft.gov, which provides a recovery plan.
If a Social Security number was exposed, the FTC adds that people can use free credit monitoring if the company offers it, file taxes early and respond quickly to any IRS letters. It also warns against trusting callers who threaten arrest over taxes or debt, even if the caller knows part of the number.
A fraud alert and a freeze work differently. An alert asks lenders to take extra steps; a freeze restricts access to the credit file. Which fits depends on individual circumstances, so these are descriptions of the options, not advice for any one person.
What do businesses owe affected people beyond the letter?
The FTC’s guide for companies says a business should secure affected systems quickly, change credentials, preserve forensic evidence and notify law enforcement and affected individuals as applicable state and federal law requires. It also says companies should offer at least a year of free credit monitoring or identity protection, especially where financial data or Social Security numbers were exposed. That is the agency’s guidance. The Attorney General’s breach-reporting page does not describe a specific monitoring requirement, so readers should not assume one applies in every case.
State law is only part of the picture. The FTC notes that every state, the District of Columbia, Puerto Rico and the Virgin Islands have their own breach laws, so a company with customers across the country may send different notices to different people.
How does this connect to California privacy rights?
Breach notification is one piece of California’s privacy framework. A separate set of rules, covered in your privacy rights under the CCPA and CPRA, gives residents rights over how businesses collect and use their data in the first place. Notification rules respond after something has gone wrong; the other rules aim at limiting what is collected, and so what can be lost.
Residents who want to reduce exposure can start with account basics: unique passwords and two-step sign-in. Passkeys, a newer sign-in method, are one option. Those details change as products change, so check each provider’s current instructions.
Reading a breach notice calmly
A breach notice is a record that an organization lost control of some data, not a finding that anyone’s identity was stolen. California’s system gives residents two tools to understand it: the letter itself and, for larger incidents, a public list with a sample of the notice. Checking the list, verifying contact details independently and weighing the FTC’s options at an unhurried pace is a sound response to most notices. For current rules and the full legal text, consult the Attorney General’s website and the statute itself.
This article is general information, not personalized legal, financial or identity-protection advice.
Sources: California Attorney General; Federal Trade Commission
