California Department of Corrections and Rehabilitation

The California Department of Corrections and Rehabilitation (CDCR) is a state agency responsible for the incarceration and rehabilitation of individuals within California's justice system. Its core mandate encompasses the operation of state prisons and the management of parole operations, alongside providing various rehabilitative programs for inmates and parolees. The agency directly handles a wide array of highly sensitive personal data, including medical information for its employees and visitors, mental health records for the incarcerated population, and personally identifiable information such as Social Security numbers and financial details for parolees enrolled in treatment programs. This data management is integral to its functions in custody, healthcare provision within facilities, and the supervision and treatment of individuals under its jurisdiction. The systems under CDCR's purview contain historical records spanning these diverse groups, reflecting the long-term nature of its operational data.

A documented cybersecurity incident in August 2022 provides specific insight into the scope and sensitivity of the information CDCR processes. The incident involved unauthorized access to a single system, potentially exposing the medical data of staff and visitors who underwent COVID-19 testing, as well as inmate mental health records and the personal and financial information of parolees. Notably, the breach did not involve the COVID-19 test results of incarcerated individuals. The agency's response included transitioning to a more secure system, conducting an investigation, notifying affected individuals afterward, and establishing dedicated support channels. This event underscores the critical data security responsibilities inherent in CDCR's role, as it safeguards information across multiple populations—employees, visitors, inmates, and parolees—within the state's correctional and rehabilitation framework. The nature of the exposed data highlights the intersection of public safety, healthcare, and personal privacy within the department's daily operations.