California law sets a 30-day clock for breach notices, requires reasonable security, and gives consumers a right to sue over some breaches. DarkThreat helps California security teams find breached and leaked credentials tied to their domain, so the assessment can start sooner.
These are the data types in California's breach law. Most of them show up in dark web leaks, so it helps to know which ones a finding touches.
A username or email address with a password or security question and answer that would permit access to an online account. No name is needed for this category.
A name with a Social Security, driver’s license, California ID, tax ID, passport or military ID number.
A name with an account, credit or debit card number and any code or password that would permit access to the account.
A name with medical information or health insurance information, such as a policy or subscriber number.
A name with fingerprint, retina, iris or similar data used to authenticate a person. Photos count only when used or stored for facial recognition.
A name with genetic data, or with data collected by an automated license plate recognition system.
For the categories that need a name, the law applies when either the name or the data element is not encrypted. Publicly available information lawfully made available from government records is excluded.
California Civil Code 1798.82 applies to any person or business that conducts business in California and owns or licenses computerized personal information. It defines a breach as unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information.
A dark web finding is not automatically a breach. It is a signal that your legal and incident response teams will want to assess. These are the questions the law asks.
Section 1798.82 applies when unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Encrypted data is also covered if the encryption key or security credential was likely taken too.
A business that owns or licenses the data notifies affected California residents. A business that only maintains data for another business must notify the owner or licensee immediately following discovery.
Notice is due within 30 calendar days of discovery or notification of the breach. Delay is allowed for the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the system.
The notice must be titled “Notice of Data Breach” and use the headings What Happened?, What Information Was Involved?, What We Are Doing, What You Can Do, and For More Information. Text must be in plain language and no smaller than 10-point type.
If one breach requires notice to more than 500 California residents, submit a single sample copy of the notice, without personal information, to the Attorney General electronically within 15 calendar days of notifying consumers.
If a breach involves only online account credentials, the notice can be electronic and direct people to change their password and security question, or take other steps to protect the account. If the leaked login is for an email account you provide, you cannot send the notice to that same email address.
If your business was the source of a breach that exposed Social Security, driver's license, California ID or similar ID numbers, the notice must offer identity theft prevention and mitigation services at no cost for at least 12 months.
HIPAA covered entities that fully comply with the HITECH Act notice rules are treated as meeting the California notice format requirements. They are not exempt from the rest of the section.
For the first practical steps, see what to do in the first 48 hours of a data breach and how to build an incident response plan around dark web alerts.
Section 1798.81.5 requires a business that owns, licenses or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices. Those practices must be appropriate to the nature of the information.
The duty also reaches your vendors. When you disclose California residents' personal information to a nonaffiliated third party under a contract, the contract must require that party to maintain reasonable security too.
The section does not list specific controls or name dark web monitoring. Alerts about leaked credentials can help with the detection part of a reasonable program, and with checking whether vendors that hold your data have been exposed. See data leak detection after a third-party vendor breach.
Some organizations fall outside this section, including health care providers regulated by California's Confidentiality of Medical Information Act, HIPAA covered entities and certain financial institutions. Those groups follow their own rules. Many teams organize their controls with the NIST Cybersecurity Framework or ISO 27001.
The California Consumer Privacy Act, as amended by the CPRA, gives consumers one private right of action. It applies only to security breaches, under Section 1798.150.
Because the claim depends on whether security was reasonable, the record of how your team detected and responded to an exposure matters. Your counsel can explain how the section applies to your business.
The California Attorney General accepts breach notice samples through an online form. Businesses use it when a single breach requires notice to more than 500 California residents.
The Attorney General also lets residents search data security breaches that have been submitted to and published by the office. Plan on your sample notice becoming visible to the public.
Healthcare and retail teams often face these questions first. See healthcare data leaks and breach notification and credit card data on dark web markets, plus our healthcare, HIPAA, ecommerce and PCI DSS pages.
For SaaS and tech teams: SSO and admin accounts, developer tokens and API keys, and infostealer logs.
Read the San Francisco pageFor media, entertainment and consumer brands: lookalike domains, fake social accounts and executive impersonation.
Read the Los Angeles pageDarkThreat helps with the detection side of your program. It monitors for breached and leaked credentials tied to your domain and sends email notifications when something is found.
Those alerts support your incident response plan and your legal review under California law. They do not replace either, and no tool makes an organization compliant with California law.
You can start with a 7-day free trial, and no credit card is required. Paid plans start from $288 per month. See pricing for plan details.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which domains you need watched.
They can. Section 1798.82 covers a username or email address combined with a password or security question and answer that would permit access to an online account. Whether a specific exposure requires notice depends on the facts, so involve your legal counsel early.
Section 1798.82 requires notice within 30 calendar days of discovery or notification of the breach. It allows delay for law enforcement needs, or as necessary to determine the scope of the breach and restore the reasonable integrity of the system.
If a single breach requires notice to more than 500 California residents, the business must electronically submit one sample copy of the notice to the Attorney General within 15 calendar days of notifying consumers.
Section 1798.150 lets a consumer bring a civil action when certain nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft or disclosure because a business failed to maintain reasonable security. Your counsel can advise on how it applies to you.
No tool can do that. DarkThreat supports the detection side of your security program by helping you find breached and leaked credentials tied to your domain. Notification decisions and legal compliance stay with your leadership and counsel.
DarkThreat offers a 7-day free trial with no credit card required. Paid plans start from $288 per month. See the pricing page for plan details.
This page summarizes public law and official regulator guidance for general information. It is not legal advice.
Explore DarkThreat coverage across additional US cities and states.
Join 500+ security teams monitoring 2M+ dark web sources daily. Schedule a demo to see the platform in action.
Setup in under 5 minutes · No agents or software required · Cancel anytime
