North Los Angeles County Regional Center Data Breach Notice (Massachusetts Attorney General)

The North Los Angeles County Regional Center has notified 10 Massachusetts residents that their Social Security numbers and medical records were exposed in a data breach. The filing, submitted to the Massachusetts Office of Consumer Affairs on June 30, 2026, lists only these two categories of information.

Your Social Security Number Cannot Be Replaced

A Social Security number is a permanent identifier. Unlike a credit card or password, it cannot be changed at will. Once it is exposed, the risk of identity theft and tax fraud remains for the rest of your life. Medical records add another lifelong concern: they can be used to file false insurance claims, obtain prescription drugs, or build a synthetic identity that mixes real and fabricated details.

Because the filing names only these two categories, no passwords were exposed. That is genuine good news. You do not need to change any password connected to this organization. The breach does not put your account access at immediate risk in the way a credential leak would.

What the Two Exposed Categories Enable

With a Social Security number and medical records, someone can attempt to open accounts in your name, file fraudulent tax returns, or submit bogus medical claims that generate bills sent to you or your insurer. Medical information can also be sold on underground markets to scammers who specialize in healthcare fraud.

The filing does not state whether the data was copied and taken or simply viewed. It also does not disclose the root cause. What matters to you is that these records are now outside the organization’s control and have lifelong value to identity thieves.

How to Determine If This Filing Concerns You

The organization is required to notify affected individuals directly, usually by mail. If you have not received a letter from North Los Angeles County Regional Center, it is likely your information was not included. However, letters can go to outdated addresses. Anyone who has moved since the incident should contact the organization directly to confirm whether their records were part of the 10 affected in this Massachusetts filing.

The Lifelong Nature of These Records

Most data exposed in breaches loses immediate value over time. Social Security numbers and medical records do not. A stolen SSN retains its power to open new lines of credit or commit tax fraud years later. Medical records never expire in usefulness to someone building a fraudulent medical history. This is why regulators treat these categories with particular seriousness.

The small number of people named in the filing — exactly 10 Massachusetts residents — means the organization was able to limit the scope of individuals it had to notify. That does not reduce the severity for those who were included.

What Remains Under Your Control

You cannot change your Social Security number, but you can monitor and freeze access to the financial records tied to it. You cannot erase medical information that has already left the organization, but you can watch for suspicious claims and incorrect bills. These steps do not undo the exposure. They limit what thieves can do with the data.

Placing This Breach in Context

This incident reaches the public record through a mandatory state filing rather than a voluntary announcement. The record contains no details about how the breach occurred, how long any unauthorized access lasted, or what security measures were in place. Those facts remain unknown outside the ongoing investigation. The filing establishes only that the exposure happened, that 10 Massachusetts residents were affected, and that the two categories listed above were involved.

The same organization also appears in the breach-notice registry of Vermont, confirming the filing is not limited to a single state. No other categories of information are named.

Practical Steps Specific to This Exposure

• Place a freeze on your credit reports at Equifax, Experian, and TransUnion. This prevents new accounts from being opened in your name using the exposed Social Security number.
• Review every Explanation of Benefits statement from your health insurer. Look for services you did not receive or providers you did not visit. Report discrepancies immediately.
• Set up alerts with the IRS to be notified of any tax returns filed under your Social Security number. The IRS offers an online account and identity protection PIN for this purpose.
• Request your free annual credit reports and scan for unfamiliar accounts or inquiries that began after the incident.
• Contact North Los Angeles County Regional Center directly if you have moved or never received notification. Confirm whether your specific records were among the 10 affected.

The letter you may have received is the most reliable indicator of whether this filing applies to you. Absence of a letter usually means you were not included, but verification is the only way to be certain when addresses change.

This breach leaves you with permanent identifiers that require ongoing vigilance rather than a one-time fix. The exposure of medical records alongside Social Security numbers creates overlapping risks in both financial and healthcare systems. Monitoring both arenas is the realistic response available to you now.