City of San José Data Breach

On January 12, 2026, the City of San José discovered a data security incident involving a lost USB/thumb drive containing information related to current and former City employees. According to the notice, a workforce member misplaced the device on January 9, 2026, prompting the City to launch an internal investigation and notify law enforcement.

Following the investigation, the City determined that the files stored on the lost drive may have contained employee names and Social Security numbers. While the City reports that it has no evidence the information was viewed, accessed, or misused, it issued individual notification letters out of an abundance of caution.

To reduce further risk, the City of San José is reviewing its data storage and transfer policies. Impacted individuals are being offered 12 months of complimentary credit monitoring and identity protection services through Epiq Privacy Solutions ID, including credit monitoring, SSN monitoring, dark web scanning, address change monitoring, identity restoration assistance, and up to $1 million in identity theft insurance.

San José, California, located in the Santa Clara Valley, is the third-largest city in the state and recognized as the “Capital of Silicon Valley”. As a major global technology hub with over 2,500 companies, it features a diverse, innovative population, sunny climate, and a mix of urban-suburban living, serving as a hub for both high-tech industry and rich cultural history. 

Impacted individuals are encouraged to remain vigilant by reviewing financial account statements, monitoring credit reports, and promptly reporting suspicious activity. The notification also provides detailed instructions on placing fraud alerts, initiating credit freezes, and accessing additional protections through the Federal Trade Commission and major credit bureaus.

If you received a Notice of Data Breach letter from the City of San José, it confirms that your personal information — potentially including your Social Security number — may have been involved in this incident.

What information is involved in the City of San José Data Breach?

Compromised information may include:

Your Personally Identifiable Information (PII) includes data that can be used to identify you. When PII is exposed in a data breach, it increases the risk of identity theft, fraud, and other misuse. Individuals should take proactive steps to protect themselves, including credit monitoring, reviewing financial accounts, and considering security freezes or fraud alerts.

A specific subset of PII is Protected Health Information (PHI), which includes medical and health insurance data. PHI is protected under both federal and state privacy laws, including HIPAA and related state statutes. When PHI is exposed in a data breach, it can be used in conjunction with other personal data to commit identity theft, medical fraud, and insurance fraud.

If your information was involved in this breach, it is important to follow the instructions provided in the City’s notification letter regarding enrollment in complimentary identity protection services.

Residents of California benefit from enhanced privacy protections under the California Consumer Privacy Act (CCPA), which grants additional rights related to the collection, storage, and protection of personal information. California residents may also have additional legal remedies depending on the nature of the compromised data.

If you received a Notice of Data Breach letter related to the City of San José data breach, your personal and financial information may be at risk.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.