Ethan Conrad Properties Data Breach

Ethan Conrad Properties, the largest commercial landlord in the Sacramento region, is notifying current and former employees of a cybersecurity incident that may have exposed their personal information — a notice signed not by IT or legal, but by the company’s Chief People Officer.

Ethan Conrad Properties, a Sacramento-area commercial real estate company, has begun notifying individuals of a cybersecurity incident, according to a filing with the California Attorney General. According to the company’s notice letter, Ethan Conrad Properties discovered potentially suspicious activity within its network on August 24, 2026, and, working with third-party computer specialists, determined that certain employee data kept in the ordinary course of business may have been affected. Notice was sent, and the incident reported to the California Attorney General, on September 21, 2026 — about 28 days after discovery, a comparatively fast turnaround.

Source: Ethan Conrad Properties notice letter; California Attorney General data breach report sb24-630085, filed 09/21/2026.

An Employee Data Breach, Not a Customer One

The notice letter is signed by Sonia Olton, Ethan Conrad Properties’ Chief People Officer — not by IT, legal, or a customer-facing executive. Combined with the letter’s description of “employee data, kept in the ordinary course of business,” this points to a breach centered on the company’s own workforce records rather than tenant or customer data. If that’s accurate, the affected group is likely current and former employees whose payroll, HR, or personnel information was on the company’s network.

What Information May Have Been Involved

Ethan Conrad Properties’ notice letter states that the information believed to potentially be at risk may include an individual’s first and last name, in combination with one or more additional data elements — but the specific list of those additional elements is not available in the version of the letter reviewed for this post. The company states it has no evidence of attempted or actual misuse of any information as a result of the incident, and it is offering 12 months of complimentary credit monitoring through Cyberscout, a TransUnion company, out of an abundance of caution.

Why This Matters for Employees

Employee records — even “ordinary course of business” HR data — often include information like Social Security numbers, dates of birth, and banking details used for payroll. If you’re a current or former Ethan Conrad Properties employee, this breach is worth taking seriously even though the exact data categories haven’t been made public.

What You Can Do Now

• If you’re a current or former Ethan Conrad Properties employee, enroll in the complimentary Cyberscout credit monitoring described in your notice letter
• Review your credit reports and bank/payroll statements for any unfamiliar activity
• Watch for phishing attempts referencing Ethan Conrad Properties, your payroll, or your employment records
• Contact us for a free case review if you received a notice letter from Ethan Conrad Properties

Do You Have Legal Options?

Employers have a legal duty to secure the personal information they collect from employees as part of the employment relationship. If you’re a current or former Ethan Conrad Properties employee and received a notice letter, you may have legal options.

If you’re a current or former Ethan Conrad Properties employee and received a data breach notice, contact Emery | Reddy today for a free case review.

FAQ

Who is affected by the Ethan Conrad Properties breach?

The notice letter is signed by the company’s Chief People Officer and describes “employee data,” suggesting this breach is centered on current and former employees rather than tenants or customers.

What information was exposed?

Ethan Conrad Properties’ notice letter states that names, in combination with one or more additional data elements, may have been at risk, but the specific additional elements are not available in the version reviewed for this post.

How many people are affected?

No population figure has been released. Given the letter’s employee focus, the affected group is likely bounded by the company’s current and former headcount.

How long did it take Ethan Conrad Properties to notify people?

About 28 days — the company discovered the incident on August 24, 2026 and sent notice on September 21, 2026, which is a relatively fast turnaround compared to other breaches in this cycle.

Do I have a legal claim?

Employers have a legal duty to protect the personal information of their employees. If you’re a current or former Ethan Conrad Properties employee and received a notice letter, contact the Data Breach Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.