---
title: "Center Theatre Group employee-file disclosure"
description: "Center Theatre Group inadvertently sent California’s Employment Development Department a file containing current and former employees’ personal information while reporting new hires on July 27, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-05"
canonical_url: "https://www.ally.security/incidents/center-theatre-group-employee-file-disclosure-2026"
markdown_url: "https://www.ally.security/incidents/center-theatre-group-employee-file-disclosure-2026.md"
stix_url: "https://www.ally.security/incidents/center-theatre-group-employee-file-disclosure-2026/stix.json"
---

# Center Theatre Group employee-file disclosure

Center Theatre Group inadvertently sent California’s Employment Development Department a file containing current and former employees’ personal information while reporting new hires on July 27, 2026.

Last modified Nov 5, 2026 · 1 source

## Summary

- **Environment:** Employee reporting file sent to California EDD
- **Operational impact:** Current and former employee names and Social Security numbers disclosed
- **Financial impact:** No incident cost publicly quantified

## What happened

[Center Theatre Group](https://www.centertheatregroup.org/) inadvertently sent California’s [Employment Development Department](https://edd.ca.gov/) a file containing current and former employees’ personal information while reporting new hires on July 27, 2026. [1](#source-1)

## Impact

The file included names and Social Security numbers, but not bank-account information. [1](#source-1)

## Timeline

### July 27, 2026 — Employee file inadvertently uploaded

Employee file inadvertently uploaded, as described in the [incident notice](https://oag.ca.gov/system/files/Notification%20Letter%20-%20Template_0.pdf). [1](#source-1)

### November 3, 2026 — Notification letter dated

Notification letter dated, as described in the [incident notice](https://oag.ca.gov/system/files/Notification%20Letter%20-%20Template_0.pdf). [1](#source-1)

### November 5, 2026 — Briefing updated

This briefing was last reviewed and updated on November 5, 2026.

## Threat Group & Attack Vector

The notice describes an accidental upload, without identifying an external attacker or compromised system. [1](#source-1)

### Actors

- The notice describes an accidental upload; no threat actor is identified.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Center Theatre Group said EDD confirmed deletion from its databases. It reviewed reporting procedures and offered 12 months of credit monitoring and identity support. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/center-theatre-group-employee-file-disclosure-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Center Theatre Group notice of data breach

official · Center Theatre Group · Nov 3, 2026

<https://oag.ca.gov/system/files/Notification%20Letter%20-%20Template_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: The file included names and Social Security numbers, but not bank-account information.
2. **Resulted In · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: The notice describes an accidental upload, without identifying an external attacker or compromised system.
3. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-11-03
4. **Resulted In · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: Center Theatre Group inadvertently sent California’s Employment Development Department a file containing current and former employees’ personal information while reporting new hires on July 27, 2026.
5. **Resulted In · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: Center Theatre Group said EDD confirmed deletion from its databases. It reviewed reporting procedures and offered 12 months of credit monitoring and identity support.
6. **Resulted In · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: Employee file inadvertently uploaded
7. **Occurred At · 100% confidence · current**  
   Employee file inadvertently uploaded: 2026-07-27
8. **Resulted In · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: Notification letter dated
9. **Affected Organization · 100% confidence · current**  
   Center Theatre Group employee-file disclosure: Center Theatre Group

</details>