California Department of Corrections Data Breach Settlement: $1.8M

Individuals whose protected health information (PHI) and/or personally identifiable information (PII) was stored on CDCR's system and accessed by an unauthorized user in January 2022.

N/A

The California Department of Corrections and Rehabilitation (CDCR) has agreed to a $1.8 million settlement to resolve a class action lawsuit alleging it failed to protect sensitive inmate data from a January 2022 cyberattack.

According to the lawsuit, unauthorized individuals gained access to CDCR’s platform, exposing the personal and health information of approximately 1.4 million inmates. The compromised data reportedly included:

• Names
• Medical records and health information
• Social Security numbers
• Other personally identifiable information (PII)

Plaintiffs claim the breach could have been prevented if CDCR had implemented stronger security measures. The lawsuit alleges that the department failed to properly safeguard inmate records, leaving them vulnerable to cyberattacks.

CDCR denies any wrongdoing but has agreed to the settlement to resolve the claims and compensate affected individuals.

Settlement Benefits

• Cash Payment: Each eligible class member will receive an equal share of the net settlement fund. The exact amount depends on the number of claims filed and the deductions for attorneys’ fees and administrative costs.
• Automatic Payments: Class members who received a postcard notice about the settlement do not need to take any action—they will automatically receive their share.
• Claims Required for Others: Class members who did not receive a postcard notice must submit a valid claim form before the deadline to receive a payment.

If your protected health or personal information was stored on CDCR’s system during the January 2022 breach, you may be eligible for compensation. Check your eligibility and file a claim before the deadline.