The California Department of Corrections and Rehabilitation says an unauthorized user gained access to a file system that held COVID-19 test data and inmates' mental health records.
State officials said malicious actors may have accessed the personal information, including bank account numbers, of people who filed for unemployment payments.
The state auditor's office waited three weeks before notifying the public of a data breach that's prompted an overhaul of the state government's cybersecurity.
After a ransomware attack last March, officials in Torrance, California, claimed residents' personal data had not been compromised. It's now available on public websites.