NLACRC Data Breach
The 2024 NLACRC data breach affected 298,629 people according to updated regulatory disclosures. The attacker copied data from certain systems and then encrypted or encoded systems to make them inaccessible.
Exposed Data Types
11 sensitive22- Health insurance information
- Health plan identification numbers
- Health plan beneficiary numbers
- Face photographs
- Patient IDs
- Medical information
- Prescription information
- Diagnoses
- Treatment information
- Treatment cost information
- Disability codes
- Names
- Physical addresses
- Dates of birth
- Phone numbers
- Email addresses
- Social security numbers
- Financial account information
- Payment card information
- Test results
- Certificate identification numbers
- License information
About This Breach
North Los Angeles County Regional Center (NLACRC) is a nonprofit organization under contract with the State of California that coordinates services for people with developmental disabilities and their families.
How Did the Incident Occur?
NLACRC detected suspicious system activity with indicators of ransomware on November 28, 2024. Its investigation found unauthorized activity from November 20 through December 1, 2024, and determined that the attacker copied data before encrypting certain systems.
What Information Was Affected?
The information varied by person. The disclosed scope includes names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, financial-account information, and payment-card information. Health-insurance and health-plan numbers, patient identifiers, face photographs, medical information, lab results, medications, diagnoses and treatment details, treatment costs, disability codes, and certificate or license numbers may also have been involved.
How Did NLACRC Respond?
The organization said it notified federal law enforcement, worked with cybersecurity and privacy specialists, and brought affected systems back online securely. It enhanced monitoring, changed passwords, and added technical safeguards. At the time of the official notice, NLACRC said it had no evidence of identity theft or fraud related to the incident.
What Should Affected People Do?
Notice recipients should review credit reports, financial accounts, and health-insurance explanations of benefits for transactions or services they do not recognize. They should contact the relevant healthcare provider or insurer about a suspicious medical or insurance entry and the appropriate bank or card issuer about an unfamiliar financial transaction.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
