Center Theatre Group has notified current and former employees of a data incident in which a file holding their names and Social Security numbers was handed to a California state agency by mistake. The company says the agency confirmed that it deleted the information, and that it sees no sign the file reached anyone else.
Even so, a Social Security number is among the most sensitive identifiers a person has. Employers that collect and store this information for payroll and reporting purposes have a responsibility to handle it carefully, and people whose numbers are mishandled deserve clear answers about what happened and what comes next.
Center Theatre Group’s Data Breach Investigation
Center Theatre Group, often shortened to CTG, is a Los Angeles-based theatre company. According to the notice of data breach it sent to affected individuals, California law requires employers to report information about newly hired workers to the Employment Development Department, a state government agency known as EDD. On July 27, 2026, a CTG employee mistakenly provided EDD with a file that contained personal information about current and former CTG employees, rather than only the new-hire details the agency expects to receive.
After learning of the mistaken upload, CTG says it contacted EDD and received confirmation that the information in the file was deleted from the agency’s databases. The company states that it has no reason to believe the file was shared with unauthorized third parties. It also says it is reviewing related procedures and improving how the tool and the data submitted to EDD are checked, in an effort to prevent a repeat of the error.
This incident looks different from the ransomware attacks and hacking campaigns that dominate breach headlines. The notice does not describe an outside attacker. Instead, the exposure came from a human error during a routine compliance task. That distinction matters for understanding how the event happened, but it does not erase the underlying concern. Employee Social Security numbers left the company’s control and went to a third party without the knowledge or consent of the people they belong to.
CTG’s notice does not say how many current and former employees were affected. A sample copy of the notice was filed with the California Attorney General, and that office posts samples only when a notice goes to a large group of California residents, so the filing suggests the group is sizable. Until the company or a regulator publishes a figure, the total number of affected people remains unknown, and this page will not guess at one.
Mistaken disclosures like this one are a recurring source of data incidents, especially in human resources and payroll settings. Employers routinely move spreadsheets and data exports between internal teams, benefits providers, payroll vendors and government agencies. When a person selects the wrong file, or a system pulls more records than intended, a large amount of sensitive information can leave an organization in a single step. Technical safeguards are designed to catch outside intruders, but they are often less effective at preventing an authorized employee from sending the wrong document to a legitimate recipient.
Names paired with Social Security numbers are the combination fraudsters value most. With both, a criminal can attempt to open credit accounts, file false tax returns to claim refunds, apply for government benefits, or pose as the victim to a bank or employer. The risk does not expire when a credit monitoring offer ends, because a Social Security number rarely changes during a person’s lifetime. Anyone who receives a notice like this should treat it seriously, even when the organization reports that the recipient of the data acted responsibly and deleted it.
The notice states that the file did not contain bank account information, which limits one category of risk. It also states that CTG is offering affected individuals complimentary credit monitoring, fraud resolution services and identity theft insurance through Experian for 12 months. Those steps are helpful, but they do not answer every question an affected employee may have, including exactly which records were in the file, how long it remained in the agency’s systems before deletion, and who had access during that time.
Employees and former employees who received a letter from CTG should keep it, note the enrollment deadline, and watch their financial and tax accounts closely. Those who have not received a letter but believe they worked for the company during the relevant period can contact CTG directly to ask whether their information was included. Because the facts available publicly come mainly from the company’s own notice, further details may emerge as regulators review the filing and as affected people compare what they were told.
When Did This Breach Occur?
According to the notice, the mistaken upload to EDD took place on July 27, 2026. The letter sent to affected individuals is dated November 3, 2026, and CTG reported the incident to the California Attorney General on November 3, 2026.
That means affected people were told several months after the file was sent. The notice does not explain exactly when CTG first became aware of the mistake, only that the company engaged with EDD after learning of it and then received confirmation of deletion. The deadline to enroll in the complimentary Experian credit monitoring offer is January 31, 2027, so recipients should act before that date.
What Information Was Breached?
CTG states that the file contained each affected person’s name and Social Security number. The company states that the file did not contain bank account information. The notice does not list any other categories of personal information.
The file included current and former employees in addition to new hires. Anyone who worked for CTG in the past and has not received a letter may wish to contact the company to ask about their status.
What You Can Do
Whether or not you have received a letter, taking a few protective steps is sensible after any exposure of your Social Security number:
- Enroll in the complimentary Experian IdentityWorks membership before January 31, 2027, using the instructions and the support line listed in your letter.
- Review your credit reports from all three nationwide credit bureaus, which you can request for free at annualcreditreport.com, and look for accounts or inquiries you do not recognize.
- Consider placing a fraud alert or a security freeze on your credit file. A freeze is free and blocks new creditors from viewing your file without your consent.
- Watch your bank, card and tax accounts for unfamiliar activity, and consider requesting an IRS Identity Protection PIN to help prevent false tax filings.
- Be wary of unexpected emails, calls or texts that mention your employment or your Social Security number, and do not click links in messages you did not expect.
If you discover that someone has misused your information, report it to the Federal Trade Commission at identitytheft.gov, file a police report, and notify the affected financial institutions right away.
File a Data Breach Lawsuit Against Center Theatre Group
Employees whose Social Security numbers were exposed because of an employer’s mistake may have legal options. Lawsuits over data exposure commonly allege that an organization failed to use reasonable safeguards to protect sensitive information, and they can seek compensation for the time, expense and risk that affected individuals face. Whether a claim is available depends on the specific facts of the incident and where the affected person lives, which is why speaking with a qualified attorney is the best way to understand your rights.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
