Cornick Data Breach Notice (California Attorney General)

The filing from Cornick reports that a breach occurred on February 14, 2025. The organisation submitted its notification to the California Attorney General on November 09, 2026 — an interval of 633 days, or roughly 20.8 months. The record does not state how many people were affected.

Personal information from your customer records is now exposed

If you received a letter from Cornick, your personal information was included in this incident. The filing lists personal information as the category exposed. No passwords, financial account numbers, Social Security numbers, driver’s license numbers, or medical details appear in the disclosed categories.

This is genuinely good news on the credential side: nothing in the record indicates that login credentials were compromised. You do not need to change any Cornick password because of this breach.

What permanent risk this exposure creates

Personal information tied to your name and address history retains value for identity thieves long after the incident. While the exact data points are not further detailed in the filing, any combination that confirms identity can support fraudulent applications, account takeovers at other companies, or tax-related fraud. These risks do not expire the way a credit card number does.

The letter is the only reliable way to know whether your records were included. Absence of a letter usually means you were not in the affected group. However, if you have moved since February 14, 2025, contact Cornick directly to confirm your status, as mailed notices can miss updated addresses.

Why the 20-month gap matters to you

The 633 days between the February 2025 incident and the November 2026 filing is the most notable fact in the record. Notification timelines vary by state law and investigation length, so the filing itself does not characterise the delay. For you, it simply means the information has had a long period in which it could have been used before you learned of it.

What you can still control

Place a fraud alert or credit freeze with the three major bureaus. Even without a Social Security number listed, early protection limits what thieves can do with confirmed personal details.

Review your annual credit reports now and again in 90 days. Look for accounts or inquiries you do not recognise. Early detection remains the most effective step when personal information is exposed.

Be alert for phishing attempts that reference Cornick or this breach. Attackers sometimes use breach news to craft convincing messages asking for additional verification.

Keep records of the letter and filing date. If identity theft appears later, these documents help establish when the breach occurred and support disputes with banks or credit agencies.