UCLA Health Data Breach: Medical Information Improperly Accessed
UCLA Health disclosed a data breach that exposed names, the last four digits of Social Security numbers, dates of birth, addresses, and medical information. If you received a notice, here's what it means — and what you can do.
What information was exposed
Per the company's filing — only the items below were involved. We don't pad the list.
Why medical-information exposure is serious
Medical records are among the most sensitive personal data that exist. Unlike a leaked password, exposed medical history cannot be "rotated" — a diagnosis, prescription history, or treatment record stays sensitive for life and can affect insurance, employment, and personal privacy.
Medical data is also valuable to identity thieves. It can be combined with other exposed identifiers to commit medical identity theft — filing fraudulent insurance claims, obtaining prescriptions, or even contaminating a victim's medical records with someone else's history.
Notably, the filing indicates the breach occurred in December 2024 but affected individuals weren't notified until roughly August 2026 — a gap of 19 months.
What affected individuals can do right now
Regardless of any legal action, if you received a notice there are protective steps worth taking:
- Place a free fraud alert or credit freeze with the three credit bureaus — a freeze is free and stops new accounts being opened in your name.
- Enroll in the credit monitoring UCLA Health offered — the filing notes identity-theft protection services were provided. It costs you nothing and is worth taking.
- Request a copy of your medical records and review for entries you don't recognize — medical identity theft can contaminate your file.
- Keep the notice letter. It's proof you were among those affected, which matters for any claim.
Timeline
Hosted copy of the notice filed with California Attorney General (original PDF).
Were you affected by the UCLA Health breach?
A class-action investigation is underway. If you received a notice, you may be eligible for compensation. Checking takes about two minutes.
Your information is kept private and used only to evaluate your claim.
Common questions
Is the UCLA Health data breach a confirmed lawsuit?
An investigation into a potential class action is underway. Whether a suit is ultimately filed depends on the facts and on counsel's assessment. Signing up registers your interest and lets attorneys evaluate eligibility — it is not itself a lawsuit.
Does it cost anything to join?
Class action representation in cases like this is typically handled on a contingency basis, meaning no upfront cost to you. Always confirm terms directly with the representing attorneys.
What if I'm not sure I was affected?
If you received a notification letter from UCLA Health, you were among those identified as affected. If you're unsure, the letter is the definitive indicator.