--- title: "Regional Center of Orange County document-disposal data incident" description: "Evidence-backed account of Regional Center of Orange County document-disposal data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/regional-center-orange-county-document-disposal-data-incident-2026" markdown_url: "https://www.ally.security/incidents/regional-center-orange-county-document-disposal-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/regional-center-orange-county-document-disposal-data-incident-2026/stix.json" --- # Regional Center of Orange County document-disposal data incident Documents intended for secure destruction at RCOC's Cypress office were mistakenly discarded in regular trash and could not be recovered. Unrecovered documents may have contained contact, identifying, and personal health information for people served through RCOC's Cypress office. Last modified Aug 9, 2026 · 2 sources ## Summary - **Environment:** Not publicly identified - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened Documents intended for secure destruction at [RCOC](https://www.rcocdd.com/)'s Cypress office were mistakenly discarded in regular trash and could not be recovered. [1](#source-1) [2](#source-2) ## Impact Unrecovered documents may have contained contact, identifying, and personal health information for people served through RCOC's Cypress office. [2](#source-2) Documented data types include: - Dates of birth — Dates of birth; potentially present in unrecovered documents. [2](#source-2) - Clinical information — Personal health information; potentially present in unrecovered documents. [2](#source-2) - Names — Names; potentially present in unrecovered documents. [2](#source-2) - Usernames and account identifiers — Unique Client Identifier numbers; potentially present in unrecovered documents. [2](#source-2) - Contact information — Addresses, phone numbers, and email addresses; potentially present in unrecovered documents. [2](#source-2) RCOC said it was not aware of misuse of the affected information. [2](#source-2) ## Timeline ### May 27, 2026 — Activity began Date documents intended for secure destruction were mistakenly placed in regular trash. [2](#source-2) ### May 28, 2026 — Discovery RCOC staff discovered the disposal error the following morning. [2](#source-2) ### July 27, 2026 — Public disclosure Date printed on RCOC's consumer notice and California regulator record. [2](#source-2) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector The cited public record does not establish a specific initial-access vector, malware family, exploited vulnerability, or ATT\&CK technique. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response RCOC could not readily determine which documents or individuals were involved and notified all individuals served through its Cypress office who might have been affected. A contracted janitorial service mistakenly put documents from bins designated for secure destruction into regular trash; collection had already occurred when RCOC tried to recover them. RCOC replaced the bins with secure destruction containers and said it was strengthening procedures, staff training, and vendor oversight. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Submitted Breach Notification Sample — Regional Center of Orange County regulatory · California Department of Justice, Office of the Attorney General ### Regional Center of Orange County notice of data breach regulatory · Regional Center of Orange County via California Department of Justice · Jul 27, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** May 2026 RCOC document-disposal incident: RCOC Cypress-office document exposure 2. **Exposed Data Category · 100% confidence · current** RCOC Cypress-office document exposure: Dates of birth 3. **Discovered At · 100% confidence · current** May 2026 RCOC document-disposal incident: 2026-05-28 4. **Exposed Data Category · 100% confidence · current** RCOC Cypress-office document exposure: Clinical information 5. **Exposed Data Category · 100% confidence · current** RCOC Cypress-office document exposure: Names 6. **Exposed Data Category · 100% confidence · current** RCOC Cypress-office document exposure: Usernames and account identifiers 7. **Affected Organization · 100% confidence · current** May 2026 RCOC document-disposal incident: Regional Center of Orange County 8. **Resulted In · 100% confidence · current** RCOC Cypress-office document exposure: RCOC could not readily determine which documents or individuals were involved and notified all individuals served through its Cypress office who might have been affected. 9. **Resulted In · 100% confidence · current** May 2026 RCOC document-disposal incident: A contracted janitorial service mistakenly put documents from bins designated for secure destruction into regular trash; collection had already occurred when RCOC tried to recover them. 10. **Resulted In · 100% confidence · current** May 2026 RCOC document-disposal incident: RCOC July 2026 breach notification 11. **Disclosed At · 100% confidence · current** RCOC July 2026 breach notification: 2026-07-27 12. **Exposed Data Category · 100% confidence · current** RCOC Cypress-office document exposure: Contact information 13. **Affected Organization · 100% confidence · current** RCOC Cypress-office document exposure: Regional Center of Orange County 14. **Resulted In · 100% confidence · current** May 2026 RCOC document-disposal incident: RCOC replaced the bins with secure destruction containers and said it was strengthening procedures, staff training, and vendor oversight. 15. **Began At · 100% confidence · current** May 2026 RCOC document-disposal incident: 2026-05-27 16. **Resulted In · 100% confidence · current** RCOC Cypress-office document exposure: RCOC said it was not aware of misuse of the affected information.