Catalyst Physician Group Data Breach Notice (California Attorney General)

The filing from Catalyst Physician Group shows that personal information belonging to an unknown number of California residents was exposed in an incident dated December 02, 2025. The organisation submitted its notification to the California Attorney General on September 11, 2026 — 283 days later.

Medical records tied to your name create permanent risk

If you received a letter from Catalyst Physician Group, the exposed personal information almost certainly includes details that link directly to your healthcare history. Unlike a credit card number, this combination cannot be cancelled or reissued. It remains valuable to identity thieves, insurance fraudsters, and anyone seeking to impersonate you for medical services or prescription drugs long after the initial breach.

The record lists only personal information as exposed. No passwords, no financial account numbers, and no government identifiers such as Social Security numbers appear in the filing. That absence is meaningful: the letter does not require you to change any Catalyst Physician Group password, because none was exposed.

What the nine-month gap actually means

The 283 days between the December 02, 2025 incident and the September 11, 2026 filing is the longest single fact this notification contains. State law allows organisations time to investigate and determine who was affected before notifying. The record does not disclose when Catalyst Physician Group discovered the breach, so it is impossible to know how much of that interval was investigation and how much was delay. What matters is that the notification has now reached the public record.

How this information is typically misused

Personal information linked to medical records is most often used for three purposes:

• Submitting false insurance claims in your name, which can distort your medical history and create surprise bills.
• Obtaining prescription medications or medical equipment that can later be sold.
• Building a more convincing identity-theft package when combined with information obtained elsewhere.

Because the data cannot be changed, the realistic goal is to make it harder for someone to use it successfully against you.

Checking whether you were affected

Catalyst Physician Group is required to notify affected individuals directly, usually by mail. If you have not received a letter at your address on file as of December 02, 2025, it is likely your records were not included. However, if you have moved since the incident date, the letter may have gone to an old address. In that case, contact the organisation directly to confirm whether you were part of this filing.

What you can still control

Even though the exposed data cannot be revoked, several practical steps remain available to limit its usefulness to an attacker.

• Place a free fraud alert with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts and lasts for one year.
• Review every Explanation of Benefits statement from your health insurer. Look for services you did not receive. Report discrepancies immediately.
• Monitor your medical bills and insurance correspondence for the next 12 to 24 months. Fraud involving medical data often surfaces slowly.
• Request a copy of your medical records from Catalyst Physician Group and review them for any entries that do not belong to you.
• Consider freezing your credit reports if you do not anticipate needing new loans or credit cards soon. This is stronger protection than a fraud alert.

The absence of exposed credentials in this incident is genuinely good news. You do not need to treat this as a password-related breach. The lasting exposure is the linkage between your name and your medical history, and that is what requires ongoing attention.