The Fresno County Department of Social Services has notified certain individuals that their personal information may have been accessed without authorization by an employee of the department. The county says it has no indication the information has been misused, but is notifying affected individuals out of caution.
Government agencies that collect and store sensitive personal and case information from the people they serve have a responsibility to limit and monitor internal access to that data, and to notify affected individuals promptly when a lapse occurs.
Fresno County Department of Social Services’s Data Breach Investigation
The Fresno County Department of Social Services administers public assistance and social services programs, including In-Home Supportive Services (IHSS) and Medi-Cal-related casework, for residents of Fresno County, California. According to a notification letter filed with the California Attorney General’s Office, the department learned on June 2, 2026, of anomalous unauthorized activity involving an employee.
Following an internal review, the department determined that on August 26, 2025, a data file containing sensitive client information was accessed by an unauthorized user. The department has stated that, at this time, it has no indication that the information involved has been improperly used, and reported the incident to the appropriate authorities, who are conducting their own investigation.
This incident illustrates a common but often overlooked category of data exposure: unauthorized internal access, rather than an outside hack. When an employee accesses files without proper authorization, an agency can face the same notification obligations as in a traditional cyberattack, since the affected individuals’ information is potentially just as exposed. Government social services agencies are frequent custodians of especially sensitive information, including case numbers tied to public benefits programs, which can reveal a person’s participation in means-tested government assistance, information many people consider private for reasons beyond simple identity theft risk.
Even without financial account numbers or a Social Security number being exposed, the combination of a person’s name, address, phone number, and government case identifiers such as a Client Index Number or IHSS case number can be used by bad actors to impersonate the affected individual when contacting benefits agencies, or to attempt fraudulent changes to an active public assistance case. Recipients of a breach notice like this one should treat any unsolicited calls or messages referencing their case number with skepticism, particularly if the caller asks for additional personal information under the guise of verifying their benefits.
The nearly nine-month gap between the date the county says the unauthorized access occurred (August 2025) and the date it was detected (June 2026) is not unusual for internal-access incidents, which often surface only after a routine audit, a whistleblower report, or an unrelated systems review flags anomalous account activity, unlike an external hack, which is sometimes detected in near real time by security monitoring tools.
When Did This Breach Occur?
According to the department’s own notification letter, the unauthorized access to the data file occurred on August 26, 2025. The department states it learned of the anomalous activity involving the employee on June 2, 2026, and subsequently determined the scope of what had been accessed. The notification letter to affected individuals was filed with the California Attorney General’s Office as incident number 26-0473.
What Information Was Breached?
The Fresno County Department of Social Services has disclosed that the information involved was limited to each affected individual’s first name, last name, address, Client Index Number (CIN) or Medi-Cal number, phone number, and In-Home Supportive Services (IHSS) case number. The department’s notice states that this information was disclosed only for the specific person named on each notification letter, rather than a single shared list.
What You Can Do
If you received a notice from the Fresno County Department of Social Services about this incident, consider taking the following steps:
- Keep a copy of the notice you received for your records.
- Review the identity theft risk-reduction information included with your notice.
- Be cautious of anyone contacting you and referencing your case or client information who did not initiate the contact.
- Monitor your accounts and any communications from the county regarding your case for anything unusual.
- Visit the California Attorney General’s website for additional identity theft prevention guidance.
File a Data Breach Lawsuit Against Fresno County Department of Social Services
Government agencies entrusted with sensitive personal and case information have a responsibility to control internal access to that data and to safeguard it from misuse. When a lapse like this occurs, affected individuals may have legal options available to them.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
