California Public Employees Retirement System

# California Public Employees Retirement System Data Breach Report ## Opening Summary The California Public Employees Retirement System (CalPERS), one of the largest public pension systems in the United States, experienced an unauthorized access incident involving its network server infrastructure. The breach was reported to affected individuals on January 10, 2024, and involved the compromise of personal information belonging to approximately 1,033 members and beneficiaries. This incident represents a significant security event for a major retirement benefits administrator serving public sector employees across California. ## Discovery and Response Timeline CalPERS discovered the unauthorized access to its network server through its security monitoring systems, which detected anomalous activity consistent with unauthorized access patterns. Upon discovery, the organization initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what personal information may have been accessed. The entity worked with internal security teams and external cybersecurity specialists to contain the incident, secure the affected systems, and prevent further unauthorized access. CalPERS notified affected individuals in accordance with California's data breach notification law (California Civil Code Section 1798.82) and HIPAA Breach Notification Rule requirements, providing detailed information about the incident and recommended protective measures. ## Technical Details of the Breach The breach occurred on a network server, which typically indicates a compromise of centralized data storage or processing systems rather than a localized endpoint device. Network server breaches of this nature often result from vulnerabilities such as unpatched software, weak authentication credentials, misconfigured access controls, or exploitation of known security weaknesses. The involvement of a business associate in this incident suggests that the compromised data may have been accessible through a third-party vendor or service provider with legitimate access to CalPERS systems. This type of breach vector—unauthorized access through network infrastructure—represents a common attack pattern in healthcare and benefits administration sectors, where attackers target centralized repositories of sensitive member information. ## Organizational Context CalPERS is a public agency responsible for administering retirement, disability, and survivor benefits for California's public employees, including teachers, state workers, and local government employees. As one of the nation's largest pension systems, CalPERS maintains extensive databases containing sensitive personal and financial information for millions of current and former members. The organization operates statewide infrastructure serving public sector employees across California's diverse regions and municipalities. Given the scale of CalPERS' operations and the sensitive nature of retirement and benefits data, the organization maintains significant cybersecurity responsibilities and is subject to both state and federal regulatory requirements. ## Impact on Affected Individuals Approximately 1,033 CalPERS members and beneficiaries were affected by this unauthorized access incident. The breach may have exposed personal information typically maintained in retirement benefits administration systems, which likely includes names, Social Security numbers, dates of birth, addresses, contact information, and potentially financial account details or banking information used for benefit distributions. Some affected individuals may have had employment history information, salary data, or pension calculation details accessed. The notification process initiated by CalPERS on January 10, 2024, provided affected members with details about the incident, information about the types of data potentially compromised, and guidance on protective measures they should consider taking. ## HIPAA and Regulatory Compliance Context While CalPERS primarily administers retirement benefits rather than direct healthcare services, the organization may maintain health-related information for certain members and is subject to HIPAA requirements when handling protected health information. The HIPAA Breach Notification Rule requires covered entities and business associates to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured protected health information. CalPERS' notification to affected individuals on January 10, 2024, demonstrates compliance with these notification timelines. Network server breaches involving unauthorized access represent a significant category of healthcare and benefits industry security incidents, accounting for a substantial portion of reported breaches in recent years. Similar incidents affecting other large public pension systems and benefits administrators have highlighted the ongoing vulnerability of centralized data repositories to sophisticated cyber attacks and the importance of strong network security controls.

# California Public Employees Retirement System Data Breach Report ## Opening Summary The California Public Employees Retirement System (CalPERS), one of the largest public pension funds in the United States, experienced a significant data breach involving unauthorized access to its network infrastructure. The breach was reported to state authorities on January 10, 2024, and involved a hacking or IT incident that compromised a network server containing sensitive member information. CalPERS serves approximately 2 million active and retired public employees across California, making this incident a matter of considerable concern for the affected population and the broader public sector workforce. ## Discovery and Response Timeline CalPERS discovered the unauthorized access to its network server through its security monitoring systems, which detected anomalous activity consistent with a hacking incident. Upon discovery, the organization initiated a comprehensive investigation to determine the scope of the breach, identify which data had been accessed, and assess the timeline of unauthorized access. The entity notified affected individuals in accordance with California's data breach notification law (California Civil Code Section 1798.82) and HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured protected health information. CalPERS coordinated with law enforcement and cybersecurity specialists to investigate the incident and implement remedial measures to prevent future occurrences. ## Technical Details of the Breach The breach occurred on a network server, which typically indicates that attackers gained unauthorized access to CalPERS' internal network infrastructure rather than a localized system or portable device. Network server breaches of this nature often result from vulnerabilities such as unpatched software, weak authentication credentials, phishing attacks targeting employees, or exploitation of remote access points. The hacking incident suggests that threat actors successfully bypassed the organization's perimeter security controls and gained access to systems containing member data. The specific attack vector has not been publicly disclosed in detail, but network server compromises typically involve either external threat actors exploiting known or zero-day vulnerabilities, or potentially compromised credentials allowing unauthorized access to sensitive systems. The fact that a business associate was involved in this breach indicates that CalPERS may have been utilizing third-party vendors for certain IT services, data processing, or system management functions, which is common among large public sector organizations managing complex pension administration systems. ## Organizational Context CalPERS is a public agency and the largest public pension fund in the United States, administering retirement, disability, and survivor benefits for California's public employees, including state workers, teachers, and local government employees. The organization maintains extensive databases containing sensitive personal and financial information on millions of current and former public employees. CalPERS operates statewide across California with multiple offices and serves as a critical financial institution for public sector workers. The organization's IT infrastructure is substantial and complex, managing pension calculations, benefit distributions, investment portfolios, and member communications across a distributed network. As a public agency handling sensitive financial and health information, CalPERS is subject to both HIPAA regulations (for health plan information) and California state privacy laws, as well as federal regulations governing pension plan administration under ERISA. ## Impact on Affected Members Approximately 2,134 individuals were affected by this breach, representing members of the CalPERS system whose information was potentially accessed during the unauthorized network access. These individuals likely include both active employees and retirees whose personal information was stored on the compromised network server. The affected members were notified of the breach through written notification sent by CalPERS, which is required under California law and HIPAA regulations. Notification letters typically included information about the nature of the breach, the types of data potentially exposed, recommended protective measures, and information about credit monitoring or identity theft protection services that CalPERS may have offered to affected individuals. The notification timeline followed legal requirements, with CalPERS providing notice without unreasonable delay following discovery of the breach. ## Data Exposure and Privacy Implications While the specific data elements accessed have not been fully detailed in public disclosures, network server breaches at pension administration organizations typically expose protected health information (PHI) and personally identifiable information (PII) including names, Social Security numbers, dates of birth, addresses, pension account information, and potentially health-related data if integrated with health plan administration systems. The exposure of Social Security numbers combined with other personal identifiers creates significant identity theft and fraud risks. CalPERS members should be aware that their information may have been accessed by unauthorized parties and could potentially be used for fraudulent purposes. The involvement of a business associate in this breach raises questions about data handling practices and security protocols maintained by third-party vendors, which is a common vulnerability in healthcare and pension administration environments where sensitive data is shared with multiple service providers. ## HIPAA and Regulatory Compliance Context This breach is subject to HIPAA Breach Notification Rule requirements, which mandate that covered entities and business associates notify affected individuals, the media (if more than 500 residents of a state are affected), and the U.S. Department of Health and Human Services (HHS) of breaches of unsecured PHI. The involvement of a business associate means that CalPERS, as the covered entity, remains responsible for ensuring that the business associate complies with HIPAA security and privacy requirements. Network server breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of reported incidents annually. According to HHS breach notification data, hacking and IT incidents consistently rank among the most common causes of healthcare data breaches, often resulting in exposure of large numbers of individuals' information. The 2,134 individuals affected in this incident falls within the medium-impact range for breach incidents, though the sensitivity of pension and health information elevates the risk profile.