San Bernardino County housing authority breach exposed 18,689 people

The Housing Authority of the County of San Bernardino, a California agency that administers rental assistance and affordable housing programs, notified about 18,689 people in early January 2024 that their personal information had been exposed through a compromised employee email account.

According to the agency's filing with the California Attorney General's office, the unauthorized activity took place between May 19 and June 26, 2023. HACSB said it learned on June 19, 2023 that an outside party had gained access to a single staff mailbox.

The agency reset the password on the account and brought in third-party forensic investigators, who concluded that a limited amount of information held in the mailbox may have been viewed. Names and Social Security numbers were among the data involved. HACSB said it found no evidence that the information had been misused.

Notification letters went out roughly six months after the intrusion was discovered, and the agency offered affected individuals a year of credit monitoring and identity protection through IDX. The breach notification was submitted to the California Attorney General's office on January 4, 2024, and separate filings were made in other states where affected residents lived.