The Regional Center of Orange County (RCOC), a nonprofit organization serving people with developmental disabilities, has notified individuals served through its Cypress office that documents containing their personal information were mistakenly disposed of as regular trash rather than through secure destruction. RCOC says it attempted to retrieve the documents once the error was discovered, but the trash had already been collected.
Organizations that serve vulnerable populations and handle sensitive personal and health information have a responsibility to ensure that even routine processes, like document destruction, are carried out securely from start to finish.
Regional Center of Orange County’s Data Breach Investigation
The Regional Center of Orange County provides services and support to individuals with developmental disabilities and their families throughout Orange County, California, including through its Cypress office location. According to a notification letter RCOC filed with the California Attorney General’s Office, the incident began on May 27, 2026, when a janitorial service contracted to clean the Cypress office mistakenly placed documents designated for secure destruction into regular trash bins instead.
RCOC states that its staff discovered the error the following morning, May 28, 2026, and immediately attempted to retrieve the documents, but the trash had already been collected and the documents could not be recovered. RCOC has said it cannot easily determine which specific documents were involved or exactly which individuals’ information was included, and out of an abundance of caution, it is notifying all individuals served through its Cypress office who may have been affected.
This incident is a reminder that data breaches are not always the product of a sophisticated cyberattack. Physical document mishandling, including improper disposal by an organization’s own vendors and contractors, remains a common and often underappreciated cause of personal information exposure. Organizations that outsource functions like janitorial services, shredding, or document storage to third-party vendors retain a responsibility to ensure those vendors follow the agreed-upon security protocols, and a lapse by a contractor can still result in the same notification obligations as an internal error.
RCOC has stated that it believes the risk of anyone actually accessing the discarded documents is extremely low, and that no Social Security numbers, financial account numbers, or medical record numbers were involved. Even so, the exposure of a Unique Client Identifier number alongside a child’s name, date of birth, and personal health information could still be used by a bad actor attempting to establish a fraudulent identity in a minor’s name, a form of identity theft that can go undetected for years since children rarely check their own credit reports.
Organizations serving individuals with developmental disabilities and their families occupy a position of particular trust, since the populations they serve, and their families, often rely heavily on the organization to safeguard sensitive personal and health details that families may not otherwise widely share. RCOC has stated it has replaced the bins involved with secure destruction containers and is reviewing its internal procedures, staff training, and vendor oversight to help prevent a similar incident going forward.
When Did This Breach Occur?
According to RCOC’s own notification letter, the janitorial service mistakenly discarded the documents on May 27, 2026, and RCOC staff discovered the issue the next day, May 28, 2026, but were unable to recover the documents because the trash had already been collected. The notification letter to affected families is dated July 27, 2026.
What Information Was Breached?
RCOC has disclosed that the documents involved may have contained a name, address, date of birth, phone number, email address, Unique Client Identifier (UCI) number, and personal health information. RCOC has specifically stated that Social Security numbers, financial account numbers, and medical record numbers were not involved in this incident.
What You Can Do
If you received a notice from the Regional Center of Orange County about this incident, consider the following steps:
- Keep a copy of the notice you received for your records.
- Consider enrolling in the complimentary one-year Experian IdentityWorks membership offered in the notice, which includes internet surveillance and identity theft insurance.
- Monitor your child’s information for any signs that it has been used to open new accounts or lines of credit.
- Be cautious of anyone contacting you and referencing your child’s case information who did not initiate the contact.
File a Data Breach Lawsuit Against Regional Center of Orange County
Organizations entrusted with sensitive personal and health information about vulnerable individuals and their families have a responsibility to ensure that information is protected and properly destroyed when no longer needed. When a lapse like this occurs, affected families may have legal options available to them.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
